We have never had real IT. Where do you even start?

This is a very common starting point and it is a better one than people assume, because there is no previous provider's mess to unpick and no arguments about why something was built a particular way.

Week one is discovery. What computers exist, how old they are, what software the business actually depends on, where the files live, what internet and Wi-Fi equipment is in place, and most importantly who holds the administrator accounts and the domain name. That last one produces a surprise more often than not. Domains registered to a former employee, a Microsoft tenant set up by a web designer, an admin password nobody has.

Then four things, in this order, because this is the order that reduces risk fastest:

• Control of your own accounts. The business owns the domain, the Microsoft or Google tenant, and the administrator credentials. Nothing else matters if you do not have this.
• Multi-factor authentication on email. The single highest value control there is, and it is free and takes an afternoon.
• A backup that is verified by restoring from it. Not a backup that reports success. One we have restored from in front of you.
• A password manager, so the spreadsheet and the sticky notes go away and the business can actually find its own credentials.

After those four, the rest is a prioritized list with costs attached, and it goes at whatever pace your budget allows. Aging computers, the Wi-Fi, documentation, whatever the specifics turn out to be.

What we will not do is arrive and tell you everything has to be replaced. Some of what you have is probably fine. The first month is about finding out which parts, and getting the four things above in place while we do.