If you run or manage a Manchester company that is adding staff, opening a second location, or moving into bigger space in the Millyard or downtown, this IT checklist is for you. The technology that worked at 10 people quietly breaks at 50 and becomes a real business risk at 150. Use the milestones below to find what to fix now, before a lost laptop, a failed restore, or an insurance questionnaire finds it for you.

Why Headcount Milestones Matter

IT problems rarely arrive gradually. They show up at predictable thresholds, because that is when informal habits stop scaling.

• Around 10 employees: everyone knows everyone, and “ask Dave, he’s good with computers” still works.
• Around 50 employees: turnover, multiple locations, and customer security questionnaires make informal processes risky.
• Around 150 employees: downtime costs real money every hour, and auditors, insurers, and larger customers expect documented controls.

The checklist below is organized by area, with what to have in place at each stage. If you are somewhere in between, treat the earlier stage’s items as the floor.

Onboarding and Offboarding

Every new hire should be productive on day one. Every departure should be closed out the same day. Both depend on a repeatable process, not memory.

At 10 employees

• A written new-hire list: accounts, equipment, software, and who approves each.
• A written departure list: accounts disabled, devices collected, shared passwords changed.
• One person accountable for both, with a named backup.

At 50 employees

• Role-based access, so a sales hire and an accountant get different permissions automatically.
• Devices set up and configured before the employee’s first day, not during it.
• HR, the hiring manager, and IT working from the same trigger, so nobody finds out about a departure two weeks late.

At 150 employees

• Documented timelines for both processes, with a record of completion.
• A way to account for every device and every account tied to a departed employee.
• A plan for seasonal or contract staff who need temporary access that actually expires.

The most common gap we see in growing New Hampshire and Massachusetts businesses is the former employee whose accounts are still active months later. It is easy to miss and expensive to explain.

Identity and Access Controls

As headcount grows, the question shifts from “does everyone have a login?” to “does everyone have only the access they need, and can we prove it?”

• Everyone at every size: unique logins for every person and multi-factor authentication on email and any system holding customer or financial data. Multi-factor authentication means a second proof of identity, like a code on a phone, in addition to a password.
• By 50 employees: a central place to manage who has access to what, and a password manager in place of spreadsheets and sticky notes.
• By 150 employees: regular access reviews, where managers confirm that each person’s permissions still match their job, and limits on who can hold administrator rights.

Shared logins are the habit to retire first. If three people use one account, you cannot tell who did what, and you cannot remove one person’s access without disrupting the others.

Backup and Recovery Testing

Having backups and being able to restore from them are two different things. Many businesses learn the difference during an outage.

The questions to answer at any size

• What data is backed up, and what is not? Laptops, cloud apps, and line-of-business systems are often missed.
• How long can we be down before it hurts? That is your recovery time target.
• How much recent work can we afford to lose? That is your recovery point target.
• When did we last actually restore something, and did it work?

What changes with growth

• 10 employees: confirm critical files and email are protected and that someone has tested a restore at least once.
• 50 employees: scheduled restore tests, with results recorded, and a copy of backups kept separate from your main systems so a single incident cannot reach both.
• 150 employees: a written recovery plan that names who does what, in what order, and how staff keep working while systems come back.

A backup you have never tested is a hope, not a plan.

Network and Wi-Fi Capacity

Moving into a larger space, whether in a Millyard building or a downtown office, is the moment to get the network right. Retrofitting later costs more and disrupts more.

• Coverage and capacity: Wi-Fi that works in an empty office often struggles when 60 people, video calls, and a dozen conference rooms are all active. Plan for peak use, not average use.
• Separation: keep guest Wi-Fi, staff devices, and sensitive systems on separate networks so a visitor’s phone never shares a network with your accounting data.
• Internet resilience: at 50 employees and beyond, a single internet connection is a single point of failure. Decide what an hour of lost connectivity costs you, then decide whether a backup connection is worth it.
• Second locations: staff at both sites need the same access, the same protections, and the same support, without relying on a few hand-built workarounds.
• Documentation: a current diagram of what is connected where, so changes and troubleshooting do not depend on one person’s memory.

Security Policies and Cyber-Insurance Readiness

Insurers, banks, and larger customers increasingly ask detailed security questions before they will write a policy or sign a contract. Having good answers ready saves time, and sometimes saves the deal.

Policies worth having in writing

• Acceptable use of company devices and accounts
• Password and multi-factor authentication requirements
• Remote work and personal device rules
• Incident reporting: who staff tell, and how fast, when something looks wrong
• Vendor access: how outside parties get into your systems and how that access ends

What insurers commonly ask about

• Multi-factor authentication on email, remote access, and administrator accounts
• Tested, protected backups
• Protection on every laptop and server, with someone actually watching the alerts
• Regular staff security training
• A documented incident response plan

Applications are often declined or surcharged because of a single “no” on a questionnaire. Finding that gap before renewal is far better than finding it during one. For a deeper look, see our overview of cybersecurity services for New Hampshire businesses.

Compliance Triggers as You Grow

Growth often pulls you into obligations you did not have before. Common triggers for Massachusetts and New Hampshire businesses:

• Handling personal information: both states have breach-notification laws, and Massachusetts has specific data security requirements for businesses holding residents’ personal information.
• Healthcare and benefits data: if you handle patient information or support health plans, federal privacy and security rules may apply.
• Payment cards: accepting cards brings payment security requirements that scale with volume.
• Government and defense work: contracts that involve federal data can carry specific cybersecurity requirements, and those requirements flow down to subcontractors. Rules and deadlines here change, so confirm current requirements with your contracting officer or a qualified advisor.
• Customer contracts: larger clients increasingly include security terms and send questionnaires, regardless of your industry.

The practical advice: know which obligations apply to you, document how you meet them, and revisit the list each time you add a service line, a location, or a major customer. If you are unsure what applies, a short scoping conversation is a reasonable first step.

When to Move From Ad-Hoc Help to Managed or Co-Managed IT

Most growing companies start with a capable employee, a part-time contractor, or a call-when-it-breaks arrangement. That can work for a while. These signs suggest it is time for something more structured:

• IT problems are pulling a manager or senior employee away from their actual job.
• Only one person knows how things are set up, and they are a single point of failure.
• You are fixing the same issues repeatedly instead of preventing them.
• You are opening a second location or moving offices and nobody owns the plan.
• An insurer, customer, or auditor has asked questions you could not answer confidently.
• Downtime has started to cost real money.

There are two common paths. A fully managed arrangement means an outside team handles day-to-day IT, security, and planning. A co-managed arrangement keeps your internal IT person or team and adds depth, coverage, and tools around them. Co-managed is often the right fit when you already have someone skilled in-house who needs backup and a bench behind them. You can read more about co-managed IT services or, if you want the full picture, our guide to managed IT in New Hampshire.

If you are specifically weighing managed IT services in Manchester, NH, we are the trusted managed IT partner for the region, serving Manchester, Bedford, and the rest of southern New Hampshire and the Merrimack Valley. Neighboring companies can see our Bedford, NH page, and teams in the construction and professional services space may want to see how we approach the Vantage-style growth challenges we cover here.

Talk Through Your Checklist With a Local Partner

You do not need to fix everything at once. Pick the two or three items on this list that worry you most, and start there. If you would like a second set of eyes, we are happy to walk through it with you. We serve small-to-mid-sized businesses across professional services, construction, healthcare, manufacturing, nonprofits, and other industries throughout Massachusetts and New Hampshire.

Last updated: November 5, 2026