Best Practices Checklist

Best practice is using Microsoft Entra ID for identity and access management: one account per person that controls what they can sign in to, from where, and on which devices. Multifactor authentication and Conditional Access policies are built on it.

• AnswerWhat is Conditional Access?
• ServiceEntra ID & Microsoft Security
• ProjectRetiring Active Directory servers and moving identity to Microsoft Entra
• ProjectNonprofit moves from an on-premises server to Entra ID and SharePoint
• ProjectStronger security with MFA for a healthcare provider

Use single sign-on wherever possible, ideally linked to your Microsoft Entra identity. Staff have one strong sign-in to protect instead of a password for every application, and turning off one account cuts off access everywhere. Also helps identify shadow IT risks.

• AnswerHow does single sign-on work?
• ServiceEntra ID & Microsoft Security
• ServiceBusiness Systems Integration
• ProjectLaw firm improves security with Microsoft 365 and SSO

Administrator accounts should be separate from day-to-day user accounts. If you are an administrator, you should have to raise your permissions before doing administrative work, to reduce the likelihood that you make an important change “accidentally.” This prevents easy-to-avoid mistakes and keeps a compromised password from having a far-reaching impact. Increasingly, insurance companies are making this capability mandatory!

• ServiceEntra ID & Microsoft Security
• ServiceCybersecurity
• IndustryCPAs & Accounting Firms
• IndustryFinancial Services
• IndustryHealthcare
• ProjectSecure administrative passwords on servers

Review your users on a regular schedule. Have any team members left? Are their accounts still active? Are you still paying for their licenses? Former employees’ accounts are a common way in for attackers, and an easy one to close.

• ServiceEntra ID & Microsoft Security
• ServiceMicrosoft 365 Licensing

Provide every user a professional password manager account for their own passwords and for securely sharing important "shared resources" such as corporate credit cards across the organization. We prefer Keeper for both. Shared credentials stay in one place, with a record of who can see them.

• ServiceCybersecurity
• ProjectEnterprise password manager rollout

All users should take part in both security awareness training and a reasonable level of phishing simulation. Most attacks start with a person being tricked, so your staff are part of your defenses.

• AnswerAre we too small to be a target for hackers?
• AnswerHow do we stop fake invoices and wire-transfer fraud sent by email?
• ServiceCybersecurity
• ProjectSecurity awareness training for a financial services firm

Have written policies for how staff use computers and data, and explicitly include a section on artificial intelligence: which AI tools are approved, and what information may and may not be put into them.

• AnswerWhat should an AI acceptable-use policy say?
• AnswerIs it safe to put client data into ChatGPT?
• ServicePractical Compliance
• ServiceCopilot & AI Readiness

Compliance depends on your industry. For example, if your organization is a Covered Entity handling protected health information, you need Business Associate Agreements (BAAs) with your vendors. Repeat for the requirements that apply to you, such as SEC and FINRA rules, CMMC, or the FTC Safeguards Rule.

• AnswerDo we need a HIPAA risk assessment?
• AnswerDoes the FTC Safeguards Rule apply to our dealership?
• AnswerDoes our accounting firm need a written information security plan (WISP)?
• ServicePractical Compliance
• ServiceHIPAA
• ServiceCMMC
• ServiceFinancial Services (SEC Reg S-P, FINRA, FTC Safeguards)
• IndustryHealthcare
• IndustryFinancial Services
• IndustryCPAs & Accounting Firms
• IndustryAuto Dealers
• ProjectMicrosoft 365 tenant separation to meet compliance requirements
• ProjectEmail migration for a regulated financial services firm

Do you know all of your vendors and suppliers? Do you have their contact information? Do you know specifically what each one provides, including services and Service Level Agreements? Vendors with access to your systems or data are part of your risk, and their contracts are part of your costs.

• AnswerHow do we measure whether our IT provider is doing a good job?
• AnswerWhat does a virtual CIO (vCIO) do?
• ServiceTechnology Leadership (vCIO)

Identify where your data resides so you can classify and protect it. Protecting it belongs within your business continuity and disaster recovery plan.

• AnswerWhat is data classification, and do we need it?
• AnswerWill Copilot show employees files they shouldn't see?
• ServiceAI & Data Audit

This document describes how your organization continues to operate in extreme situations: weather events, facility failures, data problems such as equipment failure, internet outages, and the death, disability, or departure of a key employee.

• AnswerHow do we protect our organization from ransomware?
• AnswerDoes Microsoft 365 back up our email and files, or do we need our own backup?
• ServiceTechnology Leadership (vCIO)
• ServiceServers & Colocation
• ProjectRescuing a healthcare organization from a server failure
• ProjectRescuing a civil engineering company from a failing file server
• ProjectCellular internet backup for a nonprofit with VIP client data requirements

We recommend Microsoft SharePoint for organization-wide and team resources, including document storage, and OneDrive for each person’s own working files. Access follows your Entra identity, and files are available securely from anywhere.

• ServiceSharePoint
• ServiceMicrosoft 365
• ProjectSharePoint build-out for a financial services startup
• ProjectConstruction company moves from GoDaddy and Box to Microsoft 365 and SharePoint
• ProjectSecure file drop site for a consulting company

Servers and workstations should have mandatory disk encryption: BitLocker for Windows, FileVault for macOS. Recovery keys should be managed centrally and securely by your IT department or outsourced IT provider, so a lost laptop is an inconvenience rather than a data breach.

• ServiceEntra ID & Microsoft Security
• ServiceCybersecurity
• ProjectBetter device management with Microsoft Intune for an engineering firm

Keep a list of all your equipment, including serial numbers and warranty information. It’s the starting point for budgeting replacements, insurance claims, and knowing what needs protecting.

• AnswerHow often should computers be replaced?
• ServiceDepot & Device Lifecycle
• ProjectEquipment reorganization for a first-time managed IT client
• ProjectA steady procurement process for a fast-growing trucking company

Laptops, desktops, servers, switches, firewalls, and access points are all kept at current software and firmware levels. Every critical infrastructure device has a current warranty with next-business-day replacement, and trained staff (or a partner such as navitend) coordinate any manufacturer repairs.

• AnswerIs it safe to keep a machine running an old version of Windows?
• AnswerHow often should computers be replaced?
• ServiceDepot & Device Lifecycle
• ServiceManaged IT & Help Desk
• ProjectWindows 10 end-of-life device procurement and upgrades
• ProjectUpgrading a municipality’s Windows 10 desktops to Windows 11
• ProjectServer room cleanup

Endpoint protection is the modern term for “antivirus.” Today’s tools watch for suspicious behavior, not just known viruses, and are monitored so that an alert gets a response.

• AnswerWhat's the difference between EDR and MDR?
• AnswerHow do we protect our organization from ransomware?
• ServiceCybersecurity
• ServiceManaged IT & Help Desk

A firewall manages the traffic that can come in to and go out of your network. It should be kept current, configured deliberately, and reviewed when your needs change.

• ServiceCybersecurity
• ServiceManaged IT & Help Desk
• ProjectFirewall and wireless upgrade for a public safety network
• ProjectCorporate network reconfiguration across three campuses
• ProjectNetwork redesign for a high-end retailer

Every organization needs at least two separate and distinct Wi-Fi networks: one for staff and one for guests, plus one for volunteers where needed. Some organizations need more. For example, a CMMC Level 2 organization needs additional boundaries in how it manages network access.

• ServiceManaged IT & Help Desk
• ServiceCybersecurity
• ServiceCMMC
• IndustryNonprofits
• ProjectWi-Fi upgrade for a nonprofit
• ProjectFirewall and wireless upgrade for a public safety network

Provision your Apple devices with Apple Business Manager for better administration and security. Devices set themselves up with your settings, and they stay the organization’s even if an employee leaves with one.

• ServiceDepot & Device Lifecycle
• ProjectApple Business Manager setup and device management
• ProjectTablets, mobility, and security for a growing service organization

navitend recommends Microsoft 365 at the Business Premium level. Alongside email, Teams, and the Office apps, it includes the identity, device management, and security features many of the practices on this list rely on.

• AnswerWhich Microsoft 365 license do we need: Business Standard, Business Premium, or E3?
• ServiceMicrosoft 365 Licensing
• ServiceMicrosoft 365
• ProjectDevice management and license refresh

Engage professional IT support for day-to-day issues, IT projects, and consulting and direction for your organization. One team that knows you supports you both every day and when something severe happens.

• AnswerShould we outsource IT or hire our own IT staff?
• AnswerHow do we know it's time to replace our IT provider?
• AnswerWhat does a virtual CIO (vCIO) do?
• ServiceManaged IT & Help Desk
• ServiceTechnology Leadership (vCIO)
• ProjectEquipment reorganization for a first-time managed IT client