01
Why Your IT Foundation Matters
Most businesses build IT reactively — adding tools as needs arise, fixing problems after they occur. Businesses that stay secure as they grow do the opposite: they build a foundation designed to be secure from the start.
This checklist covers the core setup that De4sec implements for every new client. Done correctly, it takes 2–5 days for a business of 1–20 staff.
A properly configured IT environment costs less than one hour of downtime from a ransomware event.
02
Identity & Access Management
Microsoft 365 Setup
✓Create tenant with custom domain — not @outlook.com
✓Assign licences by role — not everyone needs E3
✓Configure tenant region, timezone, and compliance settings
Multi-Factor Authentication
✓Enable MFA for every user — no exceptions
✓Use Microsoft Authenticator app, not SMS where possible
✓Disable legacy auth protocols (SMTP Auth, IMAP, POP3 where not required)
✓Create a break-glass admin account for emergencies
Conditional Access
✓Require MFA for all cloud app access
✓Block legacy authentication protocols
✓Require compliant device for sensitive data access
✓Flag logins from unexpected countries
Admin Separation
✓Dedicated admin accounts separate from daily-use accounts
✓Admin accounts have no mailbox and are never used for browsing
✓Apply Privileged Identity Management (PIM) for Just-in-Time admin access
03
Device & Endpoint Security
Microsoft Intune
✓Enrol all Windows and macOS devices
✓Configure compliance policies — encryption, OS version, screen lock
✓Deploy Microsoft Defender for Endpoint baseline
✓Create device groups for ring-based update rollout
Encryption
✓Enable BitLocker (Windows) via Intune policy
✓Enable FileVault (macOS) via Intune
✓Confirm keys are escrowed to Entra ID — not just local
Endpoint Protection Baseline
✓Defender real-time protection enabled on all devices
✓Tamper protection enabled
✓Cloud-delivered protection and auto-sample submission enabled
✓Attack surface reduction rules configured
✓Web content filtering applied
Wi-Fi
✓Separate SSIDs for business, guest, and IoT/POS
✓Business Wi-Fi on WPA3 or WPA2-Enterprise
✓Guest Wi-Fi isolated from business network
✓Default router admin credentials changed
Segmentation
✓VLAN separation for POS/payment systems
✓Firewall rules: deny by default, allow by exception
✓Unused ports and services disabled
Email Authentication
✓SPF record published
✓DKIM configured and signing all outbound email
✓DMARC at p=quarantine minimum, reporting to monitored mailbox
05
Backup & Disaster Recovery
The most common finding in our assessments: backups that have never been tested.
Backup Scope
✓Microsoft 365 mailboxes (requires third-party tool)
✓SharePoint and OneDrive content
✓On-premise servers and NAS
✓Critical application databases
Backup Configuration
✓Daily automated backups
✓30-day minimum retention (90 days preferred)
✓Offsite or separate cloud region copy
✓Immutable or ransomware-protected storage
Recovery Testing
✓Test restore within 30 days of initial setup
✓Quarterly restore tests — document results
✓Document RTO and RPO for business
Microsoft 365 Monitoring
✓Unified audit log enabled
✓Sign-in monitoring — alert on impossible travel
✓Microsoft Secure Score above 60% for SMB baseline
✓Defender alerts reviewed weekly
Endpoint Monitoring
✓Intune device compliance reports reviewed
✓Patch compliance report monthly — target 95%+
✓Defender incidents reviewed and resolved
Incident Response Contacts
✓Who to call if incident occurs — documented
✓What to do in first 30 minutes if ransomware suspected
✓Printed copy kept off-site
