Starting out
Get the foundations right.
- Domain, registrar & DNS
- Microsoft 365 or Google Workspace
- One account per person + MFA
- Password manager
- Basic device security
- Website & listings
- Choose an IT provider
Technology is your business now
The screen and camera are the new meeting room. Cloud platforms are the new filing cabinet. Automation is your back office, and your website and CRM are your front counter and sales team. Get the foundations right and everything else is easier. Get them wrong and you pay for it for years.
What usually happens
Tools get bought one at a time when something breaks or a salesperson calls. A few years later nobody's sure who controls the domain, three people share one login, and there's a subscription nobody remembers signing up for.
What should happen
A simple plan that matches your stage. The business owns every account. Security is switched on from day one. New tools get added because they fit, not because they were on special.
Step 1
1 2 3 4
Find your stage
You don't need enterprise technology on day one. You do need day-one decisions that won't create expensive problems on day 1,000.
Operating
Make the business run smoothly.
- CRM evaluation
- Digital first, then automate
- Business-level reporting
- Backup & recovery
- Document storage & e-signing
- Internal & client communication
- Company devices vs BYOD
Scaling
Stop relying on memory.
- Finance & commercial systems
- Automation & AI (with guardrails)
- Project management & time tracking
- Device management & BYOD policy
- Continuity & disaster recovery
- Regular independent security review
Established
Add complexity only where it pays.
- Comprehensive IT support & device management
- Business intelligence
- Regulatory reporting & audits
- Certification (e.g. Essential Eight, ISO 27001)
- Virtual desktops
- Custom software
Step 2
The map: every piece of business technology
19 categories that cover everything a business runs on. Each one has a security side, shown at the bottom of each card.
Domain name & registrar
Your domain (yourbusiness.com.au) is your address on the internet. The registrar is the company you rent it from.
Put multi-factor authentication (MFA) on the registrar account and turn on registrar lock.
DNS
DNS is the phone book that tells the internet where your website and email live.
Publish SPF, DKIM and DMARC records so criminals can't send email pretending to be you.
Email, files & collaboration
A business-grade platform for email, calendars, file storage, chat and video calls. For most Australian SMBs that's Microsoft 365 or Google Workspace.
Most of the security you need is already in the licence. It just has to be switched on and checked.
Identity & accounts
Every person gets their own account, and that account is the key to everything else.
MFA on everything (preferably an app or passkey, not SMS). Keep admin accounts separate from everyday accounts.
Passwords
A business password manager stores and shares passwords securely.
Move to passkeys wherever an app supports them.
Devices
Laptops, desktops, phones and tablets, plus the software that manages and protects them.
Encryption (BitLocker or FileVault), automatic updates, and device management (like Microsoft Intune) so a lost device can be wiped.
Cybersecurity
The protections that stop, detect and respond to attacks: endpoint protection, email filtering, configuration hardening and monitoring.
See The Last Cybersecurity Guide Your Business Will Ever Need.
Backup & recovery
Separate copies of your data that you can restore if something is deleted, encrypted or lost.
Test a restore at least once a year. A backup you've never restored is a hope, not a plan.
Phones & communication
Business phone numbers, call handling, messaging and video, for talking to staff and to clients.
Don't let client conversations live in personal WhatsApp or SMS threads you can't access or retain.
Website & online presence
Your website, hosting, social media accounts and online listings such as Google Business Profile.
Keep a valid HTTPS certificate, apply platform and plugin updates, and put MFA on every admin and social account.
CRM & client data
A customer relationship management system that holds your clients, contacts, leads and history.
Turn on MFA or single sign-on, and remove access the day someone leaves.
Documents & e-signing
Templates, document storage and electronic signatures for quotes, contracts and forms.
Share via secure links with expiry, not attachments.
Finance & commercial systems
Accounting, invoicing, payroll, expenses, payments and subscription tracking. Xero, MYOB, QuickBooks and the apps around them.
Confirm any change of bank details by phone on a known number, never by replying to the email.
Work & project management
Task lists, project boards, time tracking and job management.
Every extra app is another login and another copy of your data, so keep the list short.
Reporting & business intelligence
Dashboards and reports that show how the business is going: sales, cash, pipeline, service levels and security.
Keep reporting data in your own business environment, not someone else's account.
Automation, integration & AI
Connecting your systems so data flows between them automatically, and using AI tools to speed up work.
Use business-grade AI with data protection (such as Microsoft 365 Copilot) and have a short AI policy telling staff what is and isn't allowed.
IT support & suppliers
Who you call when things break, plus everyone else who supplies your technology.
Your IT provider fixing things isn't the same as someone checking that it's secure. Have both.
Policies, compliance & insurance
The rules you work by and the proof that you follow them: policies, registers, certifications and cyber insurance.
Make sure the controls you declared on your cyber insurance application are actually in place.
Continuity & advanced infrastructure
Business continuity and disaster recovery planning, plus bigger-business tools such as virtual desktops and custom software.
Know your critical systems, who to call, and how long you can survive without each one.
Step 3
🔐
📲
📝
Start with the three things that matter most
If you do nothing else this week, do these.
Know who holds the keys
Find out who controls your domain name, your registrar login and every admin account. If it's a former employee, your web designer or "not sure", fix that first.
Turn on MFA everywhere
Email, banking, accounting, registrar, website and social media. It blocks the vast majority of account takeovers and costs nothing.
Write a one-page list
Every system and supplier you use, who owns it, what it costs and when it renews. You'll probably find something to cancel.
Why cybersecurity runs through all of it
Small businesses are targeted because they're easier to get into, not because they're less valuable. Security isn't a product you buy at the end. It's how each of the decisions above gets made.
The cybersecurity essentials
The bare-minimum checklist every small business should have in place, and why someone independent should check it.
See the essentialsWhere do you stand today?
Answer a few quick questions and get an instant score, with the most important things to fix first.
Take the free Risk CheckKeep learning
Plain-English guides that go deeper on each part of the map.
GuideThe Last Technology Guide Your Business Will Ever Need
GuideThe Last Cybersecurity Guide Your Business Will Ever Need
DomainsIf you can't tell me who controls your company domain name, read this
PasswordsThe password manager every small business should be using
Microsoft 365The 10 Microsoft 365 security settings to switch on today
BackupsBackups & encryption for small businesses
DevicesDo BYODs damage your clients' experience?
AIAI in the workplace: three guardrails every business needs
BaselineThe ACSC Essential Eight, explained
How I can help
Whether you're starting from scratch or untangling what you've already got.
Starting out
Set up properly from day one: domain, Microsoft 365, accounts, devices and security, all in the business's name, with no software mark-ups.
See setup projectsAlready running
A plain-English review of what you've got, what's missing for your stage, and a prioritised list of what to fix.
Audit & ConsultGrowing
Ongoing security, monthly reporting and someone to call, at a flat monthly price with no lock-in.
See plans & pricesCommon questions
What technology do I need to start a business?
At minimum: a domain name in the business's name, business email and file storage (Microsoft 365 or Google Workspace), one account per person with multi-factor authentication, a password manager, secure devices, backups and a simple website. Everything else can be added as you grow.
Should I use Microsoft 365 or Google Workspace?
Both are good. Pick one and commit. For most Australian small businesses Microsoft 365 Business Premium is the sweet spot because the security tools are included in the licence. The right answer depends on the tools your industry already uses.
Do I need an IT provider from day one?
Not necessarily, but you do need someone who knows how your setup works and who holds the keys. A one-off setup done properly early on is far cheaper than untangling a messy one later.
Is free email good enough for a new business?
No. Free and personal accounts don't give the business ownership or control, they look less professional, and they lack the security features a business needs. Business email on your own domain costs a few dollars per person per month.
Where does cybersecurity fit in?
Everywhere. It isn't a separate purchase at the end; every decision on this page has a security side, and getting it right from the start costs far less than fixing it after an incident.
I already have a business. Is it too late?
Not at all. Most of the businesses I work with are established. A review shows what's missing for your stage and what to fix first.