Set Up Business IT From Scratch: A UK Guide for Self-Employed Starters

Start with what you already have

Picture a few people starting out. A plumber with a van and a phone full of customer photos. A consultant with one old laptop and a client who wants a signed contract by Friday. A baker taking orders through social media. Someone returning to work after years away, quietly wondering whether everyone else got a memo. Their circumstances differ, but the technology underneath is much the same: somewhere to receive email, a device you can trust, a copy of your work and a way for customers to find and pay you.

You do not need expensive software for any of that. An older laptop and your existing mobile make a perfectly respectable starting kit, with one condition: they must still receive security updates from their maker. We show you how to check below. The National Cyber Security Centre (NCSC) says the same in its guidance for small organisations - a device does not need to be the latest model, just one that is still supported.

The guide follows the order you will need things. Day One Essentials is a weekend's work and can cost nothing (an external drive is the one optional purchase). Getting Ready for Customers is what to sort before you advertise or send your first invoice. Things to Consider as You Grow is the shelf where everything else lives until the business can afford it. There is a printable checklist at the end.

Why bother at all? The NCSC says around one in two small organisations suffer a cyber incident each year, and that small businesses are about as likely to be hit by online crime as large ones. Most of what follows is about not handing anyone an easy win, and not locking yourself out of your own business by accident.

Day One Essentials: your own email address and well-guarded accounts

Almost every account you will ever create for the business - banking, tax, suppliers, social media, your domain name - uses an email address to prove it is you. Whoever controls that inbox can reset the passwords to everything else. That makes it the single most important thing you set up, and it is why the NCSC tells small organisations to secure their email account first and then move on to other important accounts.

If you use your personal address for everything, you will eventually have a very untidy problem: your business and your private life share one inbox, one password and often one family member who knows the login. A separate account for the business is free to create, easy to hand over or close later and keeps customer messages out of the pile with your holiday bookings. A free account from a mainstream provider is fine for now. A proper address on your own domain comes later.

Two-step verification (2SV) means that after your password, the account asks for a second check, such as a code from an authenticator app. It stops someone who has guessed or stolen your password from simply walking in. The NCSC's view is that any type of 2SV is better than none. Where a service offers passkeys, it prefers those even more, because a passkey cannot be tricked out of you by a convincing fake login page.

• Do not reuse your personal email password for the business account. If you already have, change it first - the NCSC says to do this as soon as possible.
• Do not share one login with a partner, relative or helpful friend. Shared logins make it impossible to tell who did what and awkward to remove someone later.
• Do not keep passwords on a sticky note on the monitor. A password manager is free if you use the one built into your phone, computer or browser, and it is much harder to lose or photograph.

1. Create a new email account used only for the business. Use it for every business sign-up from now on.
2. Set a strong password that you have never used anywhere else. Three random words strung together is a good approach, as the NCSC suggests, and a password manager can remember it for you.
3. Turn on 2SV for that account, using an authenticator app if you can, and switch on a passkey if the provider offers one. If you are shown backup codes, save them somewhere that is not the same phone that receives the codes.
4. Check the recovery options (usually a backup phone number or address) are ones you control and that are up to date. Recovery details that point to an old number are the most common way people lock themselves out.
5. Write down where your emergency information lives - the master password for your password manager and the backup codes - and tell one person you trust where to find it, so the business is not stranded if you are ill or abroad. A sealed envelope in a safe place is perfectly fine.
6. Check it worked: open the account's security settings and confirm that 2SV shows as on, a recovery option is present and you can find your backup codes. Do the same for each important account (bank, tax, domain) as you create it.

Day One Essentials: make your laptop and phone safe to work on

Your devices hold your email, your customers and your money. Most of what keeps them safe is already built in; the job is to check it is switched on and that the device is still supported.

The one worth knowing about right now is Windows 10. Microsoft ended standard support for it on 14 October 2025. Microsoft's consumer Extended Security Updates programme, which gives eligible Windows 10 version 22H2 Home and Pro PCs further updates, currently runs until 12 October 2027, and enrolment needs an administrator Microsoft account. It is a consumer programme, domain-joined or managed devices are not eligible, and we have not been able to confirm how Microsoft treats a PC used for sole-trader work. Treat it as breathing space to plan an upgrade, not as a long-term answer.

If your PC can run Windows 11, upgrading is usually the better route; Windows Update will normally tell you whether it qualifies. If it cannot, a decent refurbished or entry-level machine is more sensible than nursing an unsupported one. The NCSC advises replacing devices their manufacturer no longer supports, and says a replacement does not need to be the newest model.

• If the family shares the laptop, give business work its own user account with its own password, so customer files are not one click away from someone else's game.
• Phones and tablets are the devices most likely to be lost, so they matter most for screen locks. Turn on your phone's find, lock and erase feature while you still have it in your hand.
• Full-disk encryption (switching on the device's built-in encryption so a stolen laptop's drive cannot be read) is worth enabling if your laptop offers it. Before you do, make sure you know where the recovery key is saved and that you can reach it from another device, or you can lock yourself out.

1. Check how old your software is. On a Windows PC, open Settings, choose System, then About and look at Windows specifications. On a Mac, check Software Update in System Settings. On a phone, look for a software update section in Settings. If the device is on a version its maker no longer supports, put replacing it on your near-term list.
2. Install any waiting updates, then turn on automatic updates for the system and your apps. The NCSC suggests doing the first big update on Wi-Fi with the device plugged in. A major update can take a while and may restart the machine more than once, so do it when you are not about to take a call.
3. Set a screen lock on every device you use for work, including personal ones. The NCSC recommends a six-digit PIN or a strong password, a different one on each device, and nothing guessable such as 123456.
4. Check the built-in protection is on. The NCSC notes that modern devices generally ship with antivirus and a firewall enabled, so on Windows open the Windows Security app and look for any warnings rather than buying extra software.
5. Delete apps you do not use and install new ones only from the official app store or the maker's own website.
6. Check it worked: restart each device. It should ask for your PIN or password, update itself without nagging and show no red warnings in its security settings.

Day One Essentials: back up your work before you need to

A backup is a separate copy of your important files that still exists if your laptop is stolen, dies or gets hit by ransomware. The NCSC says to copy everything the business needs to run: documents, invoices, emails, contacts, customer details, your website content and, for the plumber in our example, the job photos on the phone.

The NCSC's practical suggestion is two backups: one online (it gives iCloud, Google Drive and OneDrive as examples) and one on a storage device such as an external hard drive, so that one survives if the other is lost, stolen or fails. Protect the online account with 2SV, and keep the physical drive somewhere secure and unplugged when you are not using it, because some malicious software spreads to anything connected.

A word on syncing. Many cloud storage apps mirror a folder across your devices. That is handy, but a mirror copies mistakes too: delete a file or let something scramble your documents and the change can follow. Many services keep deleted files or earlier versions for a limited time, so find out how long, but we would still rather you had a proper second copy. And an external drive left in the same bag as the laptop is a nice way to lose both in one go.

1. Pick the one folder where your business files live and move anything scattered on the desktop or in downloads into it. A single folder makes backups straightforward.
2. Switch on online backup or folder sync for that folder with a provider you already have an account with, signed in using your business email. The first upload can take hours on a large folder or slow connection, so leave the device plugged in and let it carry on in the background.
3. Copy the same folder to an external drive, then disconnect it and store it away from the laptop. Repeat on a regular day, such as the first of the month; set a calendar reminder as you will not otherwise remember.
4. Check it worked, which is the step most people skip: choose a file at random and restore it. Open it from the online service on your phone or another computer, and open it from the external drive. The NCSC advises learning how to restore your backups and checking they hold everything important, and a backup you have never opened is a theory.

Getting Ready for Customers: a domain name you actually own

A domain name is your address on the internet, such as yourbusiness.co.uk. It gives you a professional email address and somewhere to point a website. It also hides one of the most common small-business traps, so it deserves care.

The registrant is the person or organisation recorded on the register as holding the right to use the domain. The registrar is the company you buy it through, which acts on your behalf. Nominet, which runs .uk domains, says in its terms that a domain name is not property and has no owner in the usual sense; the registrant holds the right to use it. If the web designer, the nephew who is good with computers or a hosting company is listed as registrant, you may have no automatic right to your own business address. Renewal instructions also pass from the registrant to the registrar, and Nominet's terms say failing to renew leads to the registrar requesting deletion of the domain.

That matters beyond the website. If the domain lapses, your email address goes with it, and so does your ability to reset the passwords of anything tied to that address. A forgotten renewal is not just an embarrassing blank website.

• If a friend or freelancer already registered a domain for you, ask them who the registrant is. If it is not you, ask your registrar or the current holder to start a registrant change; Nominet describes the process for .uk domains on its transferring page. Do this calmly and early, while everyone is still friendly.
• If a website builder or hosting package says it includes a free domain, check it is registered in your name, that you can log in to see it and that you can move it elsewhere later.

1. Choose a name that is short and easy to say over the phone. Check it is not confusingly close to a well-known business.
2. Buy it from a mainstream registrar through an account you create with your business email address, and enter yourself or your business as the registrant. Do not let anyone else buy it for you using their account.
3. Look at the renewal price before you pay. Some registrars advertise a cheap first year and charge more when it renews.
4. Turn on auto-renew and attach a payment card that does not expire next month. Add a calendar reminder a couple of months before the renewal date, as a second line of defence if the card fails.
5. Check it worked: log in to the registrar yourself, using only your own details, and confirm that the registrant shows the right name and that you can see the renewal date. If you cannot log in without someone else's help, the domain is not yet properly yours.

Getting Ready for Customers: email, website and getting paid

Once you have a domain, you can have email on it, such as hello at your domain, which looks more established than a free address. Microsoft 365 and Google Workspace are the two mainstream options. Both are normally paid per person per month, so check the current price on the provider's site. They are not the only choices, simply the ones most people will already recognise. Set up the administrator account on your business email with the same care as before: unique password, 2SV and recovery details. If you start on a free account, you can switch later, so keep the old address forwarding for a while so nothing is missed.

A website can start small: who you are, what you do, where you work and how to get in touch. For many sole traders a single page is plenty, and a couple of well-kept social media or business listing pages can do more work than an elaborate site nobody maintains. Before signing up to a website builder, check whether you can export your content, whether the domain stays in your name, what it costs on renewal and how to cancel.

Keep invoices, receipts and quotes in one place. The government's sole trader guidance says to keep business records from the day you start trading, so you can work out your profit or loss. A spreadsheet in your backed-up folder is a legitimate way to start. If you later move to an invoicing or accounting tool, check you can export your data first. Tax registration is a separate subject, but gov.uk sets out when you must register for Self Assessment.

• Before you click Start free trial, ask whether it needs a card, when it converts to paid and what it costs afterwards. Put the end date in your calendar.
• Pay for online services from one card or account, so the subscription list is easy to spot on a statement. Glance through it monthly for anything you do not recognise.
• Annual contracts often renew automatically. Make a note of the renewal date and the notice you need to give.
• Ask of any service you rely on: if I stopped using this tomorrow, could I take my data with me?

Getting Ready for Customers: customer information, the ICO fee and scams

The moment you keep a customer's name, phone number, address or emails, you are handling personal data. Sole traders are covered by data protection law, and the Information Commissioner's Office (ICO) collects an annual data protection fee from organisations that use personal information unless they are exempt. The fee is £52 or £78 for most small organisations, depending on size and turnover, and the ICO says paying by Direct Debit takes £5 off. Not paying when you should can lead to a fine. The ICO's guidance is under review because of the Data (Use and Access) Act, so check the current position on its site, and use the ICO's online self-assessment if you are unsure whether you need to pay.

Practically, keep customer details in as few places as you can: your email, your invoices and your backed-up folder, rather than scattered across notebooks, group chats and screenshots. Fewer places means fewer things to protect and fewer to lose.

Scams are the other thing arriving with your first customers. Business email is a popular target because a hijacked inbox can reveal bank details and be used to impersonate you. The NCSC's advice on suspicious messages is to look for odd sender addresses, unexpected attachments and generic greetings, and to contact the organisation using details from its official website rather than anything in the message. An email asking you, or asking you to ask a customer, to change bank details deserves a phone call to a number you already trust.

Things to Consider as You Grow

None of this needs doing now. It is the shelf for when there is money and, probably, more people.

When someone else starts working with you, give them their own login for every shared service rather than a copy of yours. The NCSC suggests reviewing who has access to your important accounts every few months, and removing accounts and people who no longer need them. Moving from free to paid email and file storage usually adds proper user management, so access can be removed in one place when someone leaves.

A business-oriented password manager with shared vaults becomes worth it when more than one person needs the same logins. Until then, the free built-in ones are fine.

If you want a structured next step, the NCSC's free Cyber Action Toolkit gives sole traders and small businesses a personalised list of small actions, and is intended as a first step towards Cyber Essentials, the government-backed certification that some customers, particularly larger ones and public bodies, may ask for. Do the toolkit when it suits you; pursue the certificate when a customer asks or you want the reassurance.

Also on the later shelf: professional invoicing or accounting software, a booking system or customer database, a second backup service, a separate business phone number, and cyber insurance. They are all useful in the right business, and none is needed to start.

One more thing for the longer term: put a quarterly reminder in your calendar to run through the checklist below. Domains, cards and phones all change over time, and drift is what catches people out. If something does go wrong, the NCSC publishes free resources for sole traders and small organisations recovering from a scam or cyber attack.

Your printable checklist

Print this page, or copy the list into a notebook, and tick each line when it is done. Day One is for this weekend; the other two groups can wait until you are close to your first customers or your first hire.

• Day One: I have a separate email account used only for the business.
• Day One: that account has a strong unique password, two-step verification on and a passkey if offered.
• Day One: my recovery phone number and backup address are current, and I know where my backup codes are.
• Day One: one trusted person knows where to find my emergency access information.
• Day One: I am using a password manager, not sticky notes.
• Day One: my laptop and phone are on versions their maker still supports, with automatic updates on.
• Day One: every device I work on has a screen lock with a PIN or password, and my phone's find and erase feature is on.
• Day One: Windows Security or the equivalent shows no warnings.
• Day One: business files are in one folder, copied online and onto an external drive kept unplugged and away from the laptop.
• Day One: I have restored at least one file from each backup to prove it works.
• Getting Ready for Customers: my domain is registered in my own name, with me as registrant.
• Getting Ready for Customers: I can log in to the registrar myself and see the renewal date.
• Getting Ready for Customers: auto-renew is on, the card is in date and there is a calendar reminder.
• Getting Ready for Customers: I know the renewal price for my domain and any website or email service.
• Getting Ready for Customers: I have a list of every subscription, its renewal date and how to cancel it.
• Getting Ready for Customers: my invoices and records are kept in one place and I can export them.
• Getting Ready for Customers: I have checked whether I need to pay the ICO data protection fee.
• Getting Ready for Customers: I know to phone a trusted number before changing anyone's bank details.
• Things to Consider as You Grow: everyone has their own login and I review who has access every few months.
• Things to Consider as You Grow: I have tried the NCSC Cyber Action Toolkit.
• Things to Consider as You Grow: I have a quarterly reminder to repeat this checklist.