IT best practices for 2026

The businesses that avoid outages, breaches and budget shocks rarely have the newest tools. They do the basics, every time. Here are the basics for 2026.

Security

Most successful attacks still exploit basic weaknesses.

• MFA everywhere. Turn on MFA for email, VPN, cloud apps, admin consoles and finance systems, and make it mandatory. Authenticator apps or hardware keys such as YubiKeys beat SMS codes. One account without MFA is enough for a ransomware foothold.
• Long passwords. Require at least 14 characters, block known breached passwords and give staff a password manager. A 16-character passphrase beats 8 random characters. Stop forced changes every 90 days unless there is a sign of compromise.
• Email security. Set up SPF, DKIM and DMARC to stop spoofing. Scan attachments and links in real time. Train staff on phishing at least quarterly, test them with simulated phishing, and give them one clear way to report.
• EDR on every device. Antivirus is not enough. Endpoint detection and response (EDR) watches behaviour, hunts threats and responds on its own, on every laptop, desktop and server.
• Least privilege. Give each person only the access their job needs. Review it quarterly, and keep admin rights to a few people who never use them for daily work.

Backups

Ransomware, hardware failure, human error, disaster or an angry employee can each destroy data.

• The 3-2-1 rule. Keep 3 copies of your data on 2 kinds of storage, with 1 copy offsite. The 3-2-1-1-0 version adds one immutable copy and zero errors in restore tests.
• Test restores. An untested backup is a hope. Restore files, whole systems and whole environments at least quarterly for critical systems, and record how long it takes.
• Set RPO and RTO. The recovery point objective (RPO) is how much data you can lose. The recovery time objective (RTO) is how fast you must be running again. The business sets both, since a system earning $50,000 an hour needs a short RPO.

Patching

Unpatched software is among the most exploited weaknesses.

Patch	Apply within
Critical security	48 hours
High severity	1 week
Standard	30 days
Feature updates	A quarterly cycle, after testing

Automate patching, since manual patching falls behind. Include browsers, PDF readers, Java and business apps, not only the operating system. Test patches for critical apps in staging first.

Assets and licences

• Keep an inventory. Track every device, app and cloud service with its specs, version, warranty, user and purchase date.
• Plan refreshes. Laptops last three to four years and servers four to six. A rolling plan avoids emergency spending.
• Audit licences quarterly. Most organisations waste 15% to 25% of software spend on unused or underused licences.
• Retire devices properly. Wipe the data, reclaim the licence and remove the device from every system.

Documentation

At 2 AM, the person fixing things needs current documents. Keep these up to date.

• Network diagrams, IP schemes and VLANs.
• Server, firewall, switch and key app settings.
• Service, shared and admin accounts.
• Vendor contacts, contracts and support steps.
• Procedures for onboarding, offboarding and common fixes.
• Step-by-step disaster recovery.

Stale documents create false confidence, so review them quarterly and after every change. Store them in one searchable place the team can reach, and back them up.

Vendors

• Keep a vendor register. Record each vendor’s service, terms, renewal date, cost and contact. Set reminders 90 days before renewal so you negotiate instead of auto-renewing.
• Review each vendor yearly. Check service quality and terms, and ask whether it is still the best choice.
• Manage vendor risk. Check their security, ask for SOC 2 or ISO 27001, and write security terms into contracts. Their breach can become yours.

Disaster recovery

Write a plan for hardware failure, ransomware, natural disaster, a data centre outage and losing key staff. Name the steps, owners and messages for each.

Test it at least twice a year. Start with tabletop exercises, then recover single systems, then a full simulation if you can plan it. Set a call chain that works when email and phones are down, and include customers, partners and regulators where needed.

Cloud

Make the cloud the default for new apps, and ask on-premises systems to justify themselves. Existing workloads can stay where they are.

Cloud costs grow unchecked. Tag resources by department and project, and review spending monthly.

Right-size what is too big, and use reserved instances or savings plans. A cloud governance framework keeps cost tied to value.

Your provider secures its infrastructure. You secure your data, settings and access, so review settings, turn on logging and apply least privilege.

The checklist

• MFA on every system.
• A password manager for every user.
• SPF, DKIM and DMARC set up.
• EDR on every device.
• Permissions reviewed quarterly.
• 3-2-1 backups in place.
• Restores tested quarterly.
• RPO and RTO set for critical systems.
• Patching automated, on a set schedule.
• Third-party software patched too.
• A full asset inventory.
• A hardware refresh plan.
• Licences audited quarterly.
• Documents current.
• A disaster recovery plan, written and tested.
• A vendor register with renewal dates.
• Cloud costs watched and tuned.
• A security assessment each year.

If you meet fewer than half, start closing the gaps now.

Questions people ask

Where do we start if we are behind?

Start with MFA, backups and patching, which prevent most common incidents. Then move to documents, assets and the rest. Steady progress beats a sprint that burns out the team.

How much should we budget?

A common benchmark is 3% to 6% of revenue for all technology, with 15% to 20% of that on security. At $10 million in revenue, that is $300,000 to $600,000, with $45,000 to $120,000 on security. Industry, risk and regulation move these numbers.

Do these apply to a fully cloud-based company?

Yes, except on-site hardware. Cloud needs even more care with access, settings and cost, since resources are so easy to create.

How often should we review our practices?

Review everything yearly with the budget. Check security settings and test backups quarterly, and keep the asset list current all the time.

Should we hire or outsource?

Under 75 to 100 employees, a managed service provider usually gives better value. You get a team of specialists for less than two or three hires. Larger firms often mix their own staff with outside specialists for security, strategy and projects.