You set up email on a credit card in week one, everyone works on their own laptop, and the passwords live in one founder's head. That is how most UK startups begin, and IT support for startups only becomes a question when something forces it: a big client's security questionnaire, a tender asking for Cyber Essentials, a lost laptop, or hiring person number eight and realising nobody knows the admin password. This guide sets out the IT a startup needs at roughly 1, 10 and 25 people, what you can do yourself for free, and the honest point at which paying someone to run it makes sense.
Do startups need IT support?
Not on day one. You do need to make IT decisions on day one, though, and the two are easy to confuse.
Getting the foundations right is cheap and mostly self serve. Paying someone to run your IT makes sense once an outage, a lost deal or a week of founder time would cost more than the fee.
Getting the foundations wrong costs you in three ways later. You unpick personal accounts, licences bought on different cards and files spread across private drives. A client or insurer asks a question you cannot answer. And one person holds every password, which hurts the week they are ill, on holiday or gone.
Small firms are targets too. The government's Cyber security breaches survey 2025/2026 found that 42% of micro businesses and 46% of small businesses had identified a cyber breach or attack in the previous 12 months.
Before your first hire: the foundations
None of this needs a provider. The best single checklist is the NCSC's Small organisations guide to cyber security, which says you do not need to be a technical expert and that many of its steps take as little as five minutes. The NCSC's free Cyber Action Toolkit breaks the work into short actions for sole traders and small businesses, alongside its free Check Your Cyber Security tool.
One business identity for email and files
Buy a company domain and run email and files on a business Microsoft 365 or Google Workspace account, not personal Gmail. Create the main administrator account in the company's name, store its details in a company password manager, and make sure a second person can get in. A tenant tied to one founder's personal email is the most tedious thing to unpick later. If you are on Microsoft, start by setting up Microsoft 365 properly from day one.
Passkeys first, then multi factor authentication everywhere
The NCSC now puts passkeys first: where your email provider supports them, it says to enable them for staff accounts as a priority. Everywhere else, use a strong, unique password and two step verification, which the NCSC calls one of the most effective ways to protect accounts while passwords are still in use. Cover banking, payroll and your domain hosting too, not just email. Here is how to turn on two factor authentication.
Backups you have tested
Keeping files in Microsoft 365 or Google Workspace is not the same as having a backup. Microsoft's own guidance on shared responsibility in the cloud says you remain responsible for your data, and for Microsoft 365 it puts your data, settings and user accounts on your side of the line. Back up to a separate service and test a restore so you know it works. Our guide to backing up Microsoft 365 and your files covers the options.
Register with the ICO and know your UK GDPR duty
In the ICO's words, organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. The amount depends on size and turnover, and the ICO's data protection fee self assessment tells you whether you need to pay. Separately, UK GDPR expects security "appropriate to the risk", not a fixed checklist.
One to five people: this may be enough for now
Plainly, a team of one to five may not need a managed IT service yet. If you have done the four things above and your devices update themselves, you have a sound baseline. Use a pay as you go technician for the occasional fix and spend the rest on the business. If you would like someone to check what you have set up, book a free IT review and we will tell you if it is enough for now.
From 5 to 10 people: making it repeatable
Company owned devices, set up the same way
On a personal laptop you cannot enforce updates, insist on encryption or remove company data when it goes missing. Buy company laptops and set each one up the same way. Device management makes that practical: Microsoft 365 Business Premium includes Microsoft Intune Plan 1, which lets you enrol, monitor and manage devices. Microsoft's documentation says a lost or stolen company device can be wiped remotely, and on personal devices you can remove organisation data from managed apps.
Joiners and leavers
Write a checklist and use it every time. For a joiner: account created, licence assigned, passkey or two step verification enrolled, device issued and recorded, and access limited to what they need. The leaver step is the one founders forget. Block their sign in and remove their access the same day, change any shared passwords they knew, recover the device, and hand their mailbox and files to someone else.
Patching and antivirus that you can prove
Turn on automatic updates for operating systems, browsers and apps, then check they are actually installing. Make sure every device has malware protection switched on, and keep a simple record of both, because "I think so" is not an answer a client accepts. Security update management and malware protection are also two of the five technical controls in Cyber Essentials.
From 10 to 25 people: when clients and insurers start asking
Cyber Essentials before you need it
Cyber Essentials is a government backed scheme built on five technical controls designed to prevent the most common internet based attacks: firewalls, secure configuration, security update management, user access control and malware protection. Under the government's procurement policy note PPN 014, it is required for some central government contracts, for example where a supplier handles citizens' personal information. Larger private clients often ask about it in supplier questionnaires too. Certify before a deadline is attached; if you have followed the steps above, you are a long way there. When you are ready, start with getting Cyber Essentials certified.
The insurer's questionnaire
The NCSC notes that buying cyber insurance might require you to provide information about your security controls, and that some insurers offer discounts where Cyber Essentials is in place. Insurer questionnaires often ask about multi factor authentication, backups and how you keep software updated. Here is what cyber insurers ask small firms.
A one page IT security policy
Write down the rules before you have 25 people following different ones: who can install software, how passwords and two step verification work, which devices can reach company data, and what to do straight away if a laptop is lost. Start from a one page IT security policy template.
When to bring in outside help, and what kind
There are three honest options.
- A freelancer or pay as you go provider. Good for the setup work and the odd fix, and usually enough at one to five people. The risk is that nobody is watching between calls.
- A managed IT provider. It earns its place once you have around 10 or more people, clients asking security questions, or one person holding all the knowledge. Our comparison of pay as you go or a managed contract sets out the trade off, and this is how we approach managed IT support for growing small businesses.
- A hybrid. Someone in house handles simple admin such as adding users, and a provider takes security, monitoring and the awkward bits.
If you are weighing up IT support for small business startups, five signals say it is time:
- You are spending founder hours on IT instead of the business.
- You cannot answer a client's security questionnaire with confidence.
- Only one person knows the admin passwords.
- You have had a near miss: a lost device, a suspicious login or a restore that failed.
- You are about to grow past 10 or 15 people.
What we do
HGC IT Solutions is based nearby in Dorchester and supports small businesses across the UK. We work remote first, with on-site visits across Dorset when needed, and clients elsewhere in the UK are supported remotely. We are a Microsoft Cloud Solution Provider (CSP) partner, we hold Cyber Essentials Plus, the independently audited level of the scheme, and we provide 24/7 monitoring with human response in UK business hours. There are no long-term contracts, which matters when you cannot predict next year's headcount. If you are not ready for a managed service, we will say so.
Whether you are one of the founders based in Dorset or anywhere else in the UK, the first step is the same: talk to us about a free IT review.
Frequently asked questions
Do startups need IT support?
Not always on day one. A founder can set up a business Microsoft 365 or Google account, passkeys or multi factor authentication, and tested backups without a provider. Outside support starts to make sense around 10 staff, or when clients and insurers start asking security questions.
What IT does a new business need?
A company domain and business email account owned by the company, passkeys or multi factor authentication on every account, tested backups, malware protection and automatic updates on every device, and a simple record of who has access to what.
When should a startup get Cyber Essentials?
Before a client, tender or insurer asks for it. Cyber Essentials checks five technical controls that a small business can usually put in place early, and it is required for some central government contracts.
Should a startup use a freelancer or a managed IT provider?
A freelancer or pay as you go provider suits a very small team needing setup and occasional fixes. A managed provider suits a growing team that needs monitoring, security and someone accountable between calls.
