What a solid IT Foundation Looks Like
A while back, we asked a handful of questions meant to help you take stock of where your business stood, technologically speaking. Could you remove a departing employee's access before the end of their last day? Is your backup something you've actually tested, or something you assume works? If your internet went down tomorrow, could you still get work done?
If you read that post, this one is the full picture behind those questions. If you didn't, that's fine too. This post stands on its own.
Here's a plain example of what happens when the foundation isn't there. A small firm's only bookkeeper gets a convincing email, made to look like it's from a vendor asking to update payment details. It's the kind of message that can slip past a careful person, and past a mail system that isn't set up to flag it. Nobody at the firm has a habit of confirming payment changes through a second channel, and because there's no second layer of verification on the accounting login, one compromised password would have been all it took on top of that. This time, the wire goes out, and it's gone for good. Nothing exotic happened here. No sophisticated hacker, no zero-day exploit. Just a handful of small gaps that all lined up at once.
That's the case for thinking about IT differently than most other spending in your business.
Stop thinking about IT foundation spending as an investment
A lot of technology spending genuinely does pay for itself. A new tool that saves your staff five hours a week, a system that lets you take on more clients without hiring, those are investments in the traditional sense, and it's fair to expect a return.
The foundation is different. Its job isn't to make you more money. Its job is to protect the money, time, and trust you've already built, by making sure a normal, everyday mistake doesn't turn into a business-threatening event. You won't see foundation spending show up as a new revenue line on your P&L. You'll see its absence show up as a bad week you didn't have to have.
That doesn't mean foundation spending is separate from growth. A reliable, well-organized technology environment is what lets your team actually use the tools that do generate revenue. It just means you shouldn't judge it by the same yardstick.
One more thing worth naming up front: people are, and always will be, the most unpredictable part of any technology environment. No policy or tool changes that. A solid foundation exists to plan for it anyway, which is something we'll come back to at the end.
What we mean by "foundation," and why the order matters
The goal of a solid IT foundation isn't to gold-plate every system in your business. It's to cover the handful of basic building blocks every business genuinely needs, in the most economical way that still holds up.
Some of these build on each other loosely. Others have a real, unavoidable order. You have to have an email provider before you can harden it against spoofing. You have to have computers before you can secure them. You have to have cloud storage before you can back it up properly. That's part of why the list below is ordered the way it is: existence comes before protection, and protection comes before everything downstream of it.
What every business should have in place
Email and identity
For most businesses, this decision comes down to Microsoft or Google. There are other options, but most of them come with trade-offs significant enough that they're worth thinking through carefully before choosing.
This decision matters more than it might seem, because it's rarely just email. It typically bundles your productivity suite (documents, spreadsheets, video calls) and your file storage, too. Get this one right and a lot of the rest of your foundation follows naturally. Get it wrong and you'll feel it in a dozen small ways for years.
Whichever platform you choose, your email should be hardened with a few technical safeguards that give the mail system on the receiving end a way to check whether a message claiming to be from your company actually lines up with your systems, or looks like someone pretending to be you. Properly configured, they make that kind of impersonation much easier to catch and block. They're not a complete guarantee, a convincing lookalike domain or a genuinely compromised vendor account can still slip through, which is exactly why unusual requests like a payment change are worth confirming a second way regardless. But they close off one of the most common tricks, the exact kind used in the scenario above.
Password management
Passwords are the digital keys to your business, and they deserve to be treated that way. They should never live on a sticky note or in an unprotected spreadsheet.
Every employee should have their own digital password vault, a secure place that stores and fills in passwords so nobody has to remember (or reuse) them. The business should have one as well, for the small number of shared credentials it inevitably ends up with. A good password vault also generates truly random passwords, which are far harder to guess or crack than anything a person would come up with.
This layer also includes a few related tools worth knowing by name, and it helps to know the one-line reason each one matters.
Single sign-on (SSO) lets someone log in once and securely access several systems, instead of juggling a different password for each one. The takeaway: fewer individual passwords to keep track of, since your password vault is doing the real work behind the scenes either way.
Two-factor or multi-factor authentication (2FA/MFA) adds a second check beyond the password itself, commonly a code from an authenticator app or a prompt on your phone, so a stolen password alone usually isn't enough to get in. The takeaway: it's the single biggest security boost for the effort involved.
Passkeys go a step further, replacing the password entirely with something tied to your device or account that's much harder to steal or trick someone into handing over. The takeaway: this is the direction authentication is heading industry-wide, more secure, and once set up, easier to use than remembering anything at all.
Data management
Your storage should be segmented in a way that makes sense: employee working files, shared collaborative files, and finalized corporate documents don't belong in the same undifferentiated pile.
You also need a proper 3-2-1 backup, three copies of your data, on two different types of storage, with one copy stored somewhere offsite, and it needs to be tested regularly, not just set up and forgotten. A backup nobody has tried to restore isn't a backup, it's a hope.
Office network
Your office network exists to do three things well: keep your systems organized, let people reach what they need securely from wherever they are, and keep a single problem from spreading to everything else. Here's what that looks like in practice.
Business-class network hardware and a properly segmented internal network are the baseline here, keeping your systems organized and reducing how far a problem can spread if something does go wrong.
If your business has any internal-only systems, files, servers, printers, anything reachable only from inside the office network, you should have VPN access to reach them securely from outside. A VPN, short for virtual private network, is essentially a private, locked tunnel between your device and those systems.
Even if your business runs entirely on cloud tools with nothing internal to protect, it's still worth having one in most cases. Good business-class network hardware (UniFi and similar brands) usually includes VPN capability already, so the extra setup and cost are close to nothing. When something is nearly free to turn on and adds a layer of protection for the moments someone connects from a conference, a client's office, or a coffee shop, there's little reason not to have it ready by default.
Network-level DNS filtering is worth having too. DNS is essentially the phone book of the internet, it's what translates the website address you type in into the actual location your computer connects to. Filtering at that level blocks malicious and ad-based sites before they ever load, which matters because ads are a surprisingly common way malware ends up on a computer in the first place. As a side benefit, it also reduces the bandwidth those ads would otherwise consume.
Finally, business-class internet service typically comes with real uptime guarantees and faster support when something goes wrong, and for businesses that genuinely cannot afford downtime, a fallback provider is worth the cost.
Business-class computers and devices
Your team's hardware should be reliable, current, protected, and easy to manage, that's really the whole list. In practice that means well-built devices on a reasonable replacement cycle (most businesses land somewhere around five years), kept on the latest software the manufacturer supports, with enough memory and storage that everyday work doesn't feel like a struggle, and running endpoint protection that actively watches for suspicious behavior and helps stop it before it spreads, rather than only relying on a list of known viruses the way older tools did.
Company-provided mobile devices should be purchased through a formal business account. That's what lets you enroll them in a management program, so they can be tracked, and if one is ever lost or stolen, locked or wiped remotely. And every device, computers and phones alike, should have encryption turned on, so a lost or stolen device doesn't hand over your company's data along with itself.
IT documentation
Your environment should be fully documented, what you have, how it's configured, and who's responsible for what. Your password policy should be written down. And two processes in particular deserve their own documentation: how a new employee gets set up, and how a departing employee's access gets removed.
This last piece matters more than it gets credit for. A business that only one person understands is a business one bad day away from a real problem.
What's not part of the foundation
This list is intentionally broad, because it covers both IT-specific systems and IT-adjacent business decisions. Not everything here is simply "an IT project for later." Some of these are entirely different categories of investment that just happen to depend on a solid foundation being in place first.
Things that build on top of the foundation, once it's solid: AI and automation tools, SEO and AEO, your line-of-business application, and your website. None of these are unimportant. They're just not what makes your technology environment stable, they're what you do once it already is.
Risk-transfer and compliance layers: compliance systems and cyber liability insurance. Here's the honest nuance worth understanding. Most compliance requirements are actually built substantially from the same foundational pieces already covered above, identity, backup, device security, documentation. But compliance regimes almost always carry additional requirements beyond the foundation itself, formal audits, specific retention rules, industry-specific controls that go further than a general baseline. Foundation isn't compliance. It's a large part of what compliance is built on top of.
Situational tools: pen-testing falls here. In plain terms, it's hiring someone to intentionally try to break into your systems, the same way an attacker would, so you can find and fix the weak points before someone with bad intentions does. It's a genuinely valuable exercise, but it makes the most sense once you already have a stable baseline in place to test against. Testing security controls that don't exist yet doesn't tell you much, so it's not something every small business needs on day one.
Why the foundation matters more than any single defense
No system removes the human element from a business. A solid foundation exists to make sure a normal, understandable mistake doesn't become a business-ending event.
That's really the whole point. A solid foundation doesn't promise nothing will ever go wrong. Its job is to do two things: lower the odds that something goes wrong in the first place, and shrink the damage when something does anyway.
A few concrete examples of what that looks like in practice. A phished password does a lot less damage when multi-factor authentication is in place, because the password alone usually isn't enough to get in. A message pretending to be your company is much harder to pull off when your email authentication is properly configured. And a ransomware incident becomes a bad afternoon instead of a bad year, when your backups are tested and you know they actually restore. [Link: stolen laptop post, tied to the recovery point]
That's what the ROI reframe from earlier is really about. A solid foundation is what determines whether an incident becomes a story you tell later, or a threat to the business itself.
What comes next
Here's the part worth sitting with: a foundation isn't something you build once and check off. Like a building's foundation, small cracks form naturally over time. Software changes, staff change, threats change, and small gaps open up that weren't there before. A solid foundation isn't one that never cracks. It's one somebody is actually watching.
That's really what "solid" means in practice, not a checklist completed once, but a foundation with someone paying ongoing attention to it, catching the small issues before they become structural ones.
If you read through this and aren't sure where your business actually stands, that's a completely normal place to be. Most businesses have some of this in place and some real gaps, and figuring out which is which doesn't mean fixing everything at once. A short conversation is usually enough to see the whole picture and decide, together, what's actually worth doing first.
Book a free discovery call, no pressure, just a clearer picture of where things stand.
