IT infrastructure setup: a guide for SMBs

Setting up an SMB's IT infrastructure takes seven steps: assessment, network, server or cloud, backups under the 3-2-1 rule, access rights, documentation and ongoing operations. The order matters, because each step builds on the one before. Alongside this, it is worth checking whether the company falls under Act LXIX of 2024, Hungary's cybersecurity act.

1. Assessment: what you have today and what you will need

The first step is a list of what already exists: devices, users, software, subscriptions, and where the company's data lives. The same list records who can access what, and who looks after the machines today.

The key question: which system stops the work when it goes down? The answer tells you what needs attention first and what can wait.

2. Network: everything else builds on it

The network is the router, the firewall, the switches and the Wi-Fi together. Put guests and company computers on separate networks, so a visitor's phone cannot see the server or the printer.

Grant remote access only over an encrypted connection, with individual accounts and multifactor authentication, never with a shared password.

3. Your own server or the cloud

According to Microsoft's shared responsibility guidance, in your own server room you own every layer, from the physical machine to the data. In the cloud the provider takes the physical layer, but data, endpoints, user accounts and access management remain the customer's responsibility in every model.

So the cloud does not take all of operations off your hands, only part of it. We covered the decision criteria in detail in our article on on-premise and cloud infrastructure.

4. Backups: the 3-2-1 rule

According to a guide published by Carnegie Mellon University in 2012 for US-CERT, a single backup is not enough. The 3-2-1 rule:

• 3 copies of every important file: one primary and two backups.
• 2 different media types, because each faces different hazards.
• 1 copy offsite, for example in the cloud or at another location.

Why you need to test the restore

The same guide warns that a rolling backup, overwritten again and again, can silently carry corruption or malware from the original files into the backup. Our advice is therefore to keep older versions in the backup as well.

Microsoft lists infrequent, untested or on-site-only backups among the typical gaps of on-premise environments. A backup is only worth something once you have tested restoring it.

5. Access rights: everyone gets what they need

Under the NIST definition, the principle of least privilege means a user only gets the minimum access needed for their assigned tasks. The accountant does not see into the development server, and the intern is not an administrator.

CISA recommends long, random passwords that are unique to each account, at least 16 characters, paired with multifactor authentication. Removing access when someone leaves matters as much as granting it when they join.

6. Documentation: so it is not all in one person's head

Write down what the steps above produced: a network diagram, a device list, who received which access rights, where the backup runs, and how to restore it. Service contracts and support contact details belong here too.

The test of good documentation is simple: when the colleague who knows the system is on holiday, can someone else get started from it?

7. Operations: setup is not a one-off job

According to Microsoft, on-premise environments often fall behind on security patches, monitor the network incompletely, and keep running hardware that no longer receives security updates.

Operations is therefore regular work: updates, monitoring, checking the backups and planning the replacement of ageing equipment. If you would rather not run your servers in house, see our server operations page.

Does Hungary's cybersecurity act apply to your company?

Act LXIX of 2024 regulates cybersecurity in line with the NIS2 directive and has applied since 1 January 2025. Coverage follows from the law itself, with no decision by the authority, and checking it is the manager's job. Act CXXXV of 2025 rewrote the size rule from 6 January 2026.

Under the current section 1(1)(d), two questions decide it:

• Sector: whether the activity fits a sector in Annex 2 (for example energy, transport, health) or Annex 3 (for example waste management, digital providers).
• Size: whether the company is medium-sized under the SME act, employs at least 50 people, or has net revenue above EUR 10 million and, if it files accounts, a balance sheet total above that too.

Size and exceptions

Under section 3 of the SME act, a small enterprise has under 50 staff and net revenue or balance sheet total of at most EUR 10 million. Medium-sized is the rest of the SME category, judged under that act's other rules too. A company that is not medium-sized must check the cybersecurity act's own thresholds.

The authority's January 2025 guide predates the amendment and bases size on the SME act alone, so on size the current text of the act prevails.

Annex 2 and 3 organisations providing electronic communications, trust, DNS, top-level domain registry or domain registration services are covered regardless of size. Under certain conditions the authority can also bring an organisation under the act individually.

If you are covered: deadlines with the SZTFH

Under section 23 of the act, these companies are supervised by the Supervisory Authority for Regulated Activities (SZTFH). According to the guide, banking services and financial market infrastructures are supervised by the Hungarian National Bank.

According to the SZTFH, registration must be requested within 30 days of starting operations or of coming under the act.

Within 120 days of registration you must sign a contract with an auditor, and the first audit must be completed within two years. Size-independent providers that are microenterprises under the SME act need no audit, but must still register.

In its own words, the guide does not take over the manager's responsibility for interpreting the law, so in borderline cases ask a lawyer.

If you would rather not do it alone

Our work started in IT infrastructure and data processing. Setting up IT infrastructure is still among our services today. Planning, development, operations and support stay in one hand, as described on our IT infrastructure service page.

Sources

• Act LXIX of 2024 on the cybersecurity of Hungary, National Legislation Database (current text, in Hungarian)
• Act CXXXV of 2025 (amendment of the scope), National Legislation Database (in Hungarian)
• NBSZ NKI: Guide to interpreting the scope of the Cybersecurity Act (January 2025, pre-amendment, in Hungarian)
• Act XXXIV of 2004 on small and medium-sized enterprises, National Legislation Database (in Hungarian)
• SZTFH: Cybersecurity (registration, auditor contract, audit; in Hungarian)
• Ruggiero, Heckathorn: Data Backup Options, Carnegie Mellon University for US-CERT (2012)
• Microsoft Learn: Shared responsibility in the cloud
• NIST CSRC glossary: least privilege
• CISA: Require Strong Passwords (for small and medium businesses)