90-day roadmap
A 90-day cyber security roadmap for SMEs
Most SMEs do not have a lack-of-tools problem. They have a sequencing problem. This roadmap puts the work in the right order: understand your position, close the priority gaps, then turn the work into evidence for customers, insurers and certification.
THE ROADMAP
Why 90 days?
Ninety days is short enough to keep focus and long enough to fit the rhythm of leadership meetings, insurance renewals and customer security questionnaires. In that time, your business can improve its Microsoft 365 security, reduce obvious cyber risks, gather evidence for insurance and customer questionnaires, and create a clearer path towards Cyber Essentials.
what this means
The three phases of the 90-day roadmap
Days 1-30 - Visibility
Map your Microsoft 365 setup, devices, users and privileged accounts. Review your Microsoft Secure Score, backup position and the questions customers, insurers or suppliers are likely to ask.
Days 31-60 - Hardening
Reduce the highest-risk gaps first. Enforce MFA, block legacy authentication, reduce admin access, improve device management, harden email protection and confirm backups are properly configured.
Days 61-90 - Evidencing
Turn the work into proof. Gather security evidence, document key policies, review logs and retention settings, confirm your Cyber Essentials position and create a simple board-level summary.
THE OUTCOME
Reduce risk, collect evidence and prepare for Cyber Essentials
By day 90, your business should have a clearer Microsoft 365 security position, stronger access controls, tested backup evidence and a simple summary you can use with customers, insurers, auditors and your leadership team.
2026 CYBER RESILIENCE REPORT
Find out more in our new 2026 Cyber Resilience Report
The 90-day roadmap is one section of our 2026 SME Cyber Resilience Report. Download the full PDF for practical guidance on Microsoft 365 security, Cyber Essentials, customer questionnaires, insurance evidence and SME cyber resilience.
- Why It’s Now Commercial – Why cyber resilience now affects contracts, insurance and customer confidence.
- The Microsoft-365 Gap – The common security settings SMEs miss – and the eight checks to make first.
- Frameworks Compared – Cyber Essentials, Cyber Essentials Plus, ISO 27001, SOC 2 and NIST – when each one matters.
- Monitoring & Evidence – What to record, review and evidence before a customer or insurer asks.
- Zero Trust, Simply – How to reduce unnecessary access without slowing people down.
- The 90-Day Roadmap – A practical order of work: visibility, hardening, evidence and certification.
- The Self-Assessment – A 25-question check to run with your leadership team in 15 minutes.
PROOF
what our clients say
I have been using INDIGO IT as our trusted IT partner for more than 20 years, both with my previous and current company. They are so good I had to take them with me – recommended!
Mark Bosher · CAD/IT Manager – Watkins Payne
I have always found INDIGO IT to be technically ahead and keen to ensure we get the best service. I have had the good fortune of dealing with them for about 6 years now.
Peter Sudlow · MD, Sapphire Wealth
Meet Matt, Managing Director of INDIGO IT
Making Great IT Personal and Accessible
Frequently Asked Questions
Here are some of the most common questions businesses ask us:
What should be included in a 90-day cyber security plan?
A practical 90-day plan should cover visibility, hardening and evidence: know your setup, fix the priority gaps, then document what has changed for customers, insurers and internal leadership.
Can cyber security be improved without slowing staff down?
Yes. The best approach stages changes carefully, explains what is changing, pilots controls with a small group and uses Microsoft 365 policies to improve security without unnecessary friction.
What is the difference between IT support and managed IT services?
IT support is often reactive help when something breaks. Managed IT services are broader: monitoring, maintenance, security, planning, user support, supplier management and continual improvement.
What is the best first cyber security step for an SME?
Start with visibility. Know your Microsoft Secure Score, who has admin access, whether MFA is enforced, whether backups are tested and what evidence you can provide if a customer or insurer asks.
Why choose a local managed IT provider?
A local provider can combine remote support with in-person help when needed, understand regional business networks and build a closer working relationship with owners, managers and internal teams. posture.