When budgets and internal time are tight, the challenge is not simply deciding what matters. Compliance, resilience and business systems may all be important; the hard part is choosing what to do first.
For most UK SMEs, a sensible order is:
- Establish an accurate technology and cost baseline through Technology Expense Management.
- Define compliance scope and address the relevant security controls.
- Set business continuity and Disaster Recovery requirements, then test recovery.
- Make changes to core systems, including Microsoft Dynamics 365 Business Central and specialist legacy platforms.
This is a sequence for making sound decisions, not a reason to ignore an urgent security incident or a looming contractual deadline. Its purpose is to prevent an expensive project being built on incomplete information.
Start with the baseline, not the shopping list
Technology Expense Management (TEM) is the strategic cost-saving foundation. Before approving a major project, establish what the business already uses, what it costs, who owns it and which services depend on it.
The baseline should cover software and cloud subscriptions, licences, hardware, support contracts, connectivity, backups, security services and renewal dates. Record a named business owner for each service, alongside its supplier, cost, users, purpose, criticality and renewal or exit terms. A spreadsheet can be enough to begin; clear ownership and reliable information matter more than elaborate tooling.
Maintain a savings ledger that records potential savings, the evidence behind each opportunity, an accountable owner, the action required and whether the saving has actually been realised. This distinguishes a possible reduction from a confirmed budget saving. It also helps avoid cancelling a service that appears duplicative but quietly supports payroll, reporting or customer operations.
Done properly, TEM turns scattered renewals into a prioritised view of cost, risk and dependency. The result is not “cut IT spend at all costs”. It is to redirect avoidable spend towards the risks and improvements that matter most.
Then scope compliance properly
With the technology estate visible, the business can define a realistic compliance scope. For many SMEs, this means understanding the requirements of Cyber Essentials and assessing whether an ISO/IEC 27001 information security management system is justified by customer expectations, contracts, risk or growth plans.
Cyber Essentials focuses on five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The National Cyber Security Centre’s overview explains the scheme. Preparation depends on knowing which users, devices and services are in scope; an incomplete inventory makes it harder to assess coverage and gather credible evidence.
ISO/IEC 27001 is broader. It is a framework for managing information security risks across an organisation, including people, processes, suppliers and technology. It is not simply a longer technical checklist, nor should certification be treated as a substitute for practical security controls. Define the intended scope, identify relevant risks and obligations, assign owners, and collect evidence that reflects how controls operate in practice. See the official ISO/IEC 27001 overview.
Consultancy can help an SME clarify scope, prepare evidence, identify gaps and plan implementation. However, implementation support is not independent certification: where certification is required, the assessment must be carried out by an appropriate independent certification body.
Set continuity requirements before buying recovery
The third stage is business continuity and Disaster Recovery. Start with business impact, not a backup product. Which activities must continue? What is the impact if a system, site, supplier or communications service is unavailable? What is the longest tolerable disruption?
For each critical service, agree a recovery time objective (RTO) (how quickly it needs to resume) and a recovery point objective (RPO): how much data loss, measured in time, the business can tolerate. These targets belong to the business, informed by operational realities and cost. “As fast as possible” is not a useful recovery specification.
Map the dependencies behind each service: identity and access, connectivity, people, premises, data, applications, integrations and suppliers. A finance system may rely on authentication, a payment interface, a reporting feed and a specialist support provider. Recovering the application alone may not restore the service.
Ransomware-resistant backups should be protected from routine administrator access and from compromise of the production environment. Depending on the design, that can include offline, immutable or otherwise isolated copies, with access controls and monitoring. Most importantly, test restoration. A successful backup job only shows that a job ran; it does not prove that the business can recover usable data within its agreed objectives.
The UK government’s business continuity toolkit describes the value of impact analysis, assigned responsibilities and exercising plans. Make restoration tests realistic, record what worked, and give someone responsibility for closing the gaps.
Only then reshape core systems
A baseline and agreed recovery requirements create a safer starting point for core systems work. For Microsoft Dynamics 365 Business Central, a Dynamics 365 Jump Start should define the business scope before configuration begins: which processes are changing, what data is moving, what integrations are required and how success will be measured.
Plan data ownership and cleansing, integration design, role and access requirements, end-to-end testing, user preparation, cutover and rollback. Confirm how the service depends on identity, connectivity, reporting and suppliers, and how those dependencies fit the continuity plan. Microsoft’s Dynamics 365 implementation guidance outlines the Success by Design stages: Strategize, Initiate, Implement, Prepare and Operate.
For specialist legacy estates, an assessment of IBM i Management should establish the platform’s operational condition, backup and recovery approach, interfaces, ownership and business dependencies. This is a high-value technical consultancy niche: decisions about integration, change or migration should be grounded in specialist understanding of the system, not assumptions that it can simply be switched off.
This consultancy-first approach reflects the Fractal IT Director identity: strategy and accountability first, with execution arranged around business outcomes. David’s experience in Google-certified IT project management, multi-national onboarding and IBM i system administration informs that practitioner-led perspective. It is authority for the work, not a reason to skip discovery.
Managed IT Services, Cloud Solutions, Network Solutions, Helpdesk Support and Voice and Connectivity can all help execute an agreed plan. They are bolt-on delivery capabilities, not a substitute for deciding what the business needs. Specialist channel partners can provide additional delivery capacity where the strategy calls for it. The role here is expert consultancy and support, not software resale.
A practical 12-month sequence
The timetable should reflect your risk, resources and deadlines, but a typical SME roadmap might look like this:
- Months 1–2: Baseline and ownership. Complete the TEM inventory, renewal view and savings ledger. Assign named service owners and prioritise the largest cost, risk and dependency gaps.
- Months 3–4: Compliance scope. Define the Cyber Essentials boundary, address material control gaps and decide whether ISO/IEC 27001 is appropriate. Build evidence into normal operations rather than gathering it only when an assessment is near.
- Months 5–7: Continuity and recovery. Complete the business impact analysis and dependency map. Agree RTOs and RPOs, document recovery responsibilities and test restoration against the objectives.
- Months 8–12: Core systems decisions and delivery. Use a Dynamics 365 Jump Start to agree Business Central scope, data, integrations, testing and cutover. Complete specialist IBM i Management assessment where relevant, and sequence changes around validated recovery arrangements.
The phases can overlap where evidence or preparation demands it; the point is to make later investment depend on earlier decisions. Starting with an ERP implementation can mean paying to recreate data, interfaces or processes that the baseline would have exposed. Buying recovery capacity before agreeing RTOs and dependencies can mean paying for the wrong level of resilience. Pursuing certification without clear scope and evidence can produce activity without durable control.
The order of operations is therefore a way to reduce rework: understand the estate and its cost, define what good control means, establish how the business will recover, and then change its core systems with those facts in view.
For strategic IT consultancy, visit Evestaff IT Support and Consultancy. For the wider Evestaff group of services, visit evestaff.co.uk.
SEO tags: Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity
Join The Discussion