Everything a small business should have in place from day one — identity, devices, backups, data protection, and more — with a recommended tool for each item. The complete list, free to read and use.
In the portal — free to start
Track it as you go
Check items off, see your progress by category, and pick which tool you actually went with for each one.
Get a version built for your business
A short quiz on your size, budget, and industry filters this list down to what actually matters for you, in priority order.
The single most important category. Weak identity is how most breaches start.
Core identity & device platform
The foundation the rest of this category builds on.
The single best investment for identity and security at SME scale. Includes Entra ID (enterprise SSO, MFA, and Conditional Access), Defender for Business endpoint protection, Intune MDM, Teams, SharePoint, and 1TB OneDrive per user. One licence covers identity, devices, collaboration, and email — no separate tools needed for most businesses under 300 people.
Password manager
Pick one and get everyone using it before you grow — much harder to retrofit later.
The team password manager most security professionals recommend. Shared vaults, admin visibility of what is stored (not contents), and Watchtower alerts for breached or reused passwords. Establish the habit before you grow — it is much harder to retrofit.
Open-source alternative to 1Password. The free tier is enough for most small teams. Less polished but trusted by the security community, open-source, and independently audited. A credible choice if cost is a constraint.
Laptops and phones are the physical gateway into your business. Lock them down early.
Device management (company-owned)
Enrol and manage devices the business actually owns.
Mobile Device Management (MDM) included in Business Premium. Enrol all company devices, enforce encryption and compliance policies (minimum OS version, screen lock, BitLocker required), deploy and update software remotely, and wipe lost or stolen devices — all from the Microsoft Admin Centre. No separate MDM licence needed if you are already on Business Premium.
Application packaging and deployment tool that works alongside Intune. Packages standard .exe installers into the .intunewin format Intune requires for silent deployment. Build your software catalogue once, push updates and new installs to every enrolled device without touching each machine. Critical for device management at any meaningful scale.
Device management for BYOD (personal devices)
A different problem to company-owned devices — protects company data on phones and laptops the business doesn't own, typically without fully enrolling someone's personal device.
A lighter-touch alternative to full device enrolment, built for BYOD: protects and can remotely wipe company data (email, Teams, OneDrive) inside managed apps on a personal phone or laptop, without the business taking control of the whole device. The right tool when someone wants to check work email on their own phone but won't (and shouldn't have to) enrol it fully.
Disk encryption
Built into the OS on both platforms — there isn't really a choice to make here, just make sure it's switched on.
Full-disk encryption built into Windows 11 and macOS. If a laptop is stolen, the data is unreadable without the encryption key. Takes under 5 minutes to enable, and can be enforced and verified at scale via Intune compliance policies.
Email is the most common attack surface. A few DNS records and good defaults go a long way.
Business email & productivity suite
Exchange Online for business email, Teams for communication, SharePoint and OneDrive for file storage. Microsoft's anti-spam and anti-phishing filtering is best-in-class. Defender for Office 365 (included in Premium) adds safe links, safe attachments, and anti-impersonation protection on top.
The main alternative to M365. Gmail, Google Meet, Drive, and Docs. Better UX for some teams and marginally cheaper for the baseline plan. Security tooling is good but less integrated than M365 Premium — you will need third-party tools for endpoint security and MDM.
DNS management
Move your domain DNS to Cloudflare on day one. Free DDoS protection at the DNS layer, faster resolution globally, and the cleanest interface for managing SPF, DKIM, and DMARC records. Also makes SSL certificates and subdomain management straightforward. Note: Cloudflare doesn't manage every country-code domain suffix (e.g. .dk and some others require the local registrar's own DNS) — check Cloudflare supports your specific domain before migrating.
The test of a backup isn't making it — it's restoring from it. Do both.
Cloud backup for devices & files
Backs up Exchange Online email, OneDrive, and SharePoint on a schedule. If you are on M365, your email and files have a safety net here — but verify the backup policy is enabled and check the retention period. It does not replace a separate backup for anything outside of M365.
Simple, continuous cloud backup for laptops and desktops. Backs up everything not in cloud storage automatically — local project files, creative assets, application data. Cheap, reliable, and restores are straightforward. Good for anything that lives outside OneDrive or SharePoint.
Infrastructure backup (servers, VMs, databases)
Only relevant if you run anything beyond laptops and M365/Google Workspace.
Microsoft's cloud backup service for servers, VMs, and databases. If you run any infrastructure on Azure or on-premise servers, use this for policy-driven, consistent backup with geo-redundancy. Integrates natively with Azure Recovery Services.
The everyday tools — CRM, accounting, contracts — are part of your security posture too.
CRM
The best free CRM for early-stage businesses. Contacts, deals, email tracking, pipeline view, and basic automation — all free. The free tier is genuinely sufficient for most companies under 50 people. Do not track customers in spreadsheets: you will lose deals, miss follow-ups, and have no audit trail.
Accounting software
Cloud accounting software. Xero for most businesses; FreeAgent if you are a freelancer or small consultancy. Non-negotiable — running financials in spreadsheets creates compliance risk, makes tax painful, and gives you no real-time view of your numbers. Both integrate with HMRC Making Tax Digital.
E-signature
Free, open-source alternative to DocuSign if budget is the priority — legally binding e-signatures with a full audit trail. Self-host it for genuinely free, or use their hosted tier if you don't want to run it yourself. Less polished and fewer integrations than DocuSign, but a credible choice for an early-stage business watching costs.
E-signature software for contracts, NDAs, and agreements. Legally binding in the UK. Provides a full audit trail: who signed, when, from what device and IP. Do not email Word documents for signatures — you have no proof of what was agreed or who agreed it. UK-legal for standard contracts and NDAs (though not every use case — e.g. some deeds still require a witnessed wet signature; check if in doubt).
Data protection registration
A one-off registration, not really a "pick one" decision — but worth tracking here since it's easy to forget.
The ICO is the UK's data protection regulator — this registration is UK-specific. If you process any personal data and are UK-based, UK GDPR requires you to register. Most businesses are Tier 1 (£40/yr). Takes 10 minutes at ico.org.uk. If you're not UK-based, check your own jurisdiction's equivalent (e.g. the relevant EU supervisory authority, or your national data protection authority).
In the Fortify portal, a short quiz on your size, budget, and industry turns this into a prioritised list built for you — then you track progress against it as you actually go through it.