I have set up IT departments for supermarket chains, a factory with hundreds of employees, a mall and an ICT company. Every time the situation looked different, and every time the same order of work saved the project. This is the playbook.
1. Inventory before anything else
List every device, license, domain, mailbox, server, vendor contract and password owner. You will find domains registered to former employees, licenses nobody uses and servers nobody dares to reboot. You cannot secure or budget what you have not counted.
2. Fix the network foundation
- Structured cabling with labeled patch panels, so a fault takes minutes to trace.
- VLANs to separate staff, servers, cameras, guests and point-of-sale.
- A real firewall with documented rules, and VPN site-to-site between branches.
- Managed Wi-Fi with a separate guest network.
3. One identity per person
A central directory (Active Directory or a cloud directory) with one account per employee, group-based permissions and multi-factor authentication. When someone leaves, one disabled account must close every door.
4. Backups you have actually restored
Follow the 3-2-1 rule: three copies, two different media, one off-site. Then test a restore every quarter. Until you restore, it is not a backup; it is a hope.
5. Take ownership of email, domains and hosting
Domains, DNS, email and hosting must be in company-owned accounts, with renewal reminders and at least two administrators. A forgotten renewal can take the whole business offline.
6. Policies people can follow
Short, clear policies for passwords, acceptable use, remote access and onboarding/offboarding. A one-page policy that people read beats a forty-page document nobody opens.
7. Helpdesk and documentation
Every request goes through a ticketing or CRM system, even in a small team. Over time the tickets show where to invest, and the documentation (network diagrams, runbooks, credentials in a password manager) means the department does not depend on a single person.
8. A roadmap and a budget
Finish with a 12-month roadmap that management can approve: quick wins first, then the projects that reduce risk the most. IT stops being a cost center when the business can see what each step buys them.
