Your First IT Stack: What to Set Up in Month One
The first month of a new IT environment is not the time to chase an ideal architecture.
It is the time to establish control.
You need to know what the organization owns, who can access it, where its data lives, how it is protected, and what happens when something goes wrong. Everything else becomes easier once those basics are in place.
The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide is built around the same idea: start by understanding the organization, identifying its risks, setting priorities, and building manageable practices rather than attempting to implement every control at once.
Here is a practical month-one roadmap.
Week One: Establish identity and ownership
Start with people, not hardware.
Before deploying tools, decide how users will authenticate and who owns each system.
Your first-week priorities should include:
A central business email and identity system
Individual accounts for every employee
Multifactor authentication for email, file storage, administrative tools, and remote access
Separate administrator and everyday user accounts
A documented onboarding and offboarding process
A secure recovery method for critical accounts
Do not allow shared administrator credentials. They make activity difficult to audit and become painful to rotate when someone leaves.
CISA recommends enabling MFA across systems such as email, file storage, and remote access because a stolen password alone should not be enough to enter a critical account.
By the end of week one, you should be able to answer:
Who has an account?
Who has administrator access?
Which accounts can reset other accounts?
How quickly can access be removed?
Week Two: Inventory and secure the endpoints
You cannot manage equipment you do not know exists.
Create a basic asset inventory that includes:
Laptops and desktops
Mobile devices
Servers and storage
Routers, switches, firewalls, and wireless access points
Printers and connected devices
SaaS platforms and cloud accounts
Software licenses
Device owner and physical location
Warranty and replacement date
The inventory does not need to be sophisticated. A maintained spreadsheet is better than an abandoned asset platform.
Next, establish a standard device configuration:
Supported operating-system version
Automatic security updates
Full-disk encryption
Endpoint protection
Screen-lock requirements
Removal of unnecessary local administrator access
A process for remotely disabling lost devices
CISA’s guidance for small and midsized businesses emphasizes asset inventory, software updates, logging, backups, MFA, and encryption as foundational security practices.
Week Three: Build the network and backup layer
The network does not need to be elaborate. It does need to be intentional.
At minimum, document:
Internet provider and support contact
Firewall and router
Managed switches
Wireless access points
IP ranges
DHCP and DNS
Guest wireless
Internal wireless
Any systems that must be isolated
Separate guest traffic from business systems. If the organization uses cameras, building controls, printers, manufacturing equipment, or other connected devices, consider placing them on their own network segments.
Then address backups.
Identify the data that would stop the business if it disappeared. Back it up automatically, retain multiple versions, and keep at least one recovery path that is not continuously exposed to the production environment.
A backup is not complete until someone has restored from it. Schedule a test before the end of the month.
CISA’s ransomware guidance recommends maintaining an inventory of physical and logical assets, backing up data frequently, and protecting backup copies from the same systems and credentials used in production.
Week Four: Add logs, documentation, and incident procedures
Once the basic stack is operating, make it observable.
Turn on logging for:
Identity and administrative activity
Email security events
Endpoint protection
Firewall activity
VPN or remote-access connections
Critical cloud platforms
Backup successes and failures
Do not collect logs simply to say that logging is enabled. Confirm who reviews them, which events require action, and how long the records are retained.
CISA describes logging as an accessible first step toward stronger cybersecurity because logs provide the record needed to identify unusual or unauthorized behavior.
Next, write the first version of the IT documentation.
Include:
Asset list
Network diagram
Access and recovery procedures
Vendor contacts
Backup instructions
Software renewal dates
Common troubleshooting steps
Onboarding and offboarding checklists
Finally, create a one-page incident plan:
Who receives the first call?
Who can authorize service shutdowns?
Which systems must be restored first?
How will employees receive updates?
Which outside providers may need to be contacted?
Where is the recovery documentation stored?
Keep a printed or offline copy of the critical contact list. A document that can only be opened through the failed system is not much of a recovery plan.
What can wait until month two
Do not try to build everything immediately.
The following can usually wait until the foundation is stable:
Complex automation
Advanced configuration management
Large-scale infrastructure-as-code programs
Extensive custom dashboards
Formal service catalogs
Sophisticated zero-trust projects
Perfect documentation
These may all become valuable. They are not more urgent than identity, inventory, backups, updates, network segmentation, and a basic response plan.
The month-one checklist
By day 30, you should have:
Centralized business accounts
MFA on critical systems
A current user and administrator list
A hardware, software, and SaaS inventory
Standard endpoint protections
A documented network
Segmented guest access
Automated backups
A completed restore test
Logging on critical systems
Basic IT documentation
A one-page incident plan
The first IT stack does not need to be impressive. It needs to be understandable, recoverable, and secure enough to support the next stage of growth.