Recommended Technology Platform

There is no one-size-fits-all for equipment, but we have several best-practices we recommend to ensure your environment is supportable and reliable. This is a general list, but your business may have more stringent requirements that we will bring up with you over time. In addition to any requirements below, we recommend all equipment either has an active warranty or a spare is kept on-site at all times.

We recommend laptops and desktops with the following minimum specifications and an active warranty from the manufacturer.

• Current Generation Intel Core i5/i7/i9 or Core Ultra 5/7/9 Processor within 5 Prior Generations
• 16GB RAM (memory)
• 512GB Solid State Drive (SSD) for storage
• Windows 11

We do not recommend non-Professional versions of Windows (sometimes referred to as Home) for business use.

Servers should be selected to be suitable for the customer's business needs and software requirements. Servers should run an operating system and applications currently under vendor support, and the life expectancy of the server should be considered when choosing an operating system to ensure support and updates are available at least through the server's expected lifetime. Servers should have active next-business-day warranties to minimize the risk of extended downtime and unexpected repair expenses.

• Current Generation Intel Xeon Processor within 7 prior Generations (Core i5/i7/i9 or Core Ultra 5/7/9 in some circumstances)
• 32GB RAM (memory)
• 1TB Solid State Drive (SSD) for storage
• Windows Server 2016 Standard* (for more than 10 computers) or Windows 11 Professional (for fewer than 10 computers)
• RAID1 or better for storage redundancy suggested
• Dual power supplies for power redundancy are suggested

We recommend that a backup hard drive or network storage device is used for local backup of the server. This device should use high-quality enterprise storage drives and should be sized to hold at minimum 3 full backups of the server(s) it is meant to protect, or more depending on the retention requirements of your organization. If possible, the local storage destination should use unique access credentials separate from the rest of the network, to reduce the likelihood of malicious tampering or deletion, and should be located on an isolated network segment with limited access.

All backups should be copied as soon as reasonable to a secured and isolated storage location physically away from the premises of the server(s) being backed up, encrypted using 128-bit or higher encryption with a strong, unique encryption key that is stored separately from the backups, and in a location inaccessible without unique credentials.

Our recommended firewall is a Unifi Gateway sized appropriately for internet connection speed, with an active CyberSecure subscription. In some circumstances, a more robust firewall may be needed — in those cases, our recommended firewall is a Fortinet FortiGate F-Series with an active FortiGuard UTM subscription.

Firewall firmware should be periodically reviewed and updated to the latest release on a regular cadence, or more rapidly if a security issue is discovered that may be exploited externally.

Firewalls should be configured to allow the minimum inbound access necessary for the organization to operate (ideally zero, with VPN protection if required), and all administrative management should be restricted and not available from the general internet.

Ethernet switching fabrics should be designed for the environment. Where appropriate, quality unmanaged switches may be acceptable, but we highly recommend fully managed switches for all environments. We recommend consistent models and brands when possible to reduce the number of unusual support issues.

Our preferred brands of switches are Unifi and Fortinet.

To a greater extent than even switching, wireless needs to be designed for the environment. In all cases, we do not recommend using any wireless provided by an ISP modem or other equipment.

Our preferred brands of wireless equipment are Unifi and Fortinet.

Staff and guest networks should be segmented for security, and staff or other internal wireless networks should be secured with WPA2 security or higher, with a long, random, unique passphrase if not using Enterprise authentication.

We recommend at bare minimum a business-class broadband Internet connection, but this may not be suitable for all purposes. If Internet is required for primary business operations, we recommend at minimum redundant broadband services with one being a business fiber circuit and the other being a cellular connection.

We recommend all servers and critical network infrastructure have appropriately sized battery backups that are regularly tested and maintained.

We recommend all authentication used in the business comply with Current NIST Guidelines for Password Management. For convenience, the key guidelines are summarized below.