Most new businesses get to IT setup eventually — usually right after something goes wrong. A client asks how you protect their data and you don't have a clean answer. A laptop gets lost and nothing was backed up. A hire's first day arrives and there's no real way to give them access without handing over a shared password. None of that has to happen. Here's what's worth having in place before it does — the same eight-part checklist we run through with every Legacy Launch client.
1. Identity & email
Business email on your own domain, not a personal Gmail or Yahoo address. A domain registrar account you actually control the login to — not one sitting in a web designer's account from years ago. And a general inbox or forwarding address set up for inquiries, so it isn't routing to someone's personal phone.
2. Passwords & access
A real password manager, not a notes app or a sticky note. A unique password on every account — especially email, banking, and anything that touches money. Two-factor authentication turned on for email, banking, and payment processors specifically; that's the short list of accounts where a compromised password does the most damage.
3. Devices
Automatic updates turned on for every laptop and phone. Disk encryption enabled — FileVault on Mac, BitLocker on Windows. Screen lock set to activate within a few minutes on every device. None of this takes long to set up once, and all of it is the difference between a lost laptop being an inconvenience or an actual incident.
4. Backup & recovery
Business files backed up automatically to the cloud — not just sitting on one laptop. A plan, even an informal one, for what happens if a device is lost or stolen. And ideally you've actually restored a file from that backup once, just to confirm it works before you need it to.
5. Domain & web presence
Domain renewal on auto-pay — a lapsed domain is a lost business, and it happens more than people think. A website served over HTTPS, not showing a browser warning. And a working contact method beyond a personal cell number listed as the only way to reach you.
6. Data & privacy basics
Client or customer information kept somewhere organized, not scattered across personal drives and random spreadsheets. Knowing whether your industry has specific requirements — healthcare, legal, and financial businesses especially. And a simple, honest answer ready if a customer asks how you protect their information.
7. Getting ready to hire
A plan for individual logins per person, not a shared "the office password" everyone uses. A simple offboarding step so access gets revoked the day someone leaves. And company devices set up separately from anyone's personal accounts, from day one.
8. Signs it's time for help
If you've caught yourself saying "I've been meaning to get to that" about anything above, that's the signal. Same if a client or investor has asked a security question you couldn't answer cleanly, or you're about to bring on your first employee or contractor and none of this is in place yet. Those are the three moments this list usually gets acted on — better to do it before one of them forces the issue.
The full one-page version of this checklist — the same one we hand every Legacy Launch client — is free to download here. Work through it yourself on your own time, or skip straight to having it done.