Your IT Stack at 30, 50, and 100 Employees: What Should Already Be True
Technology debt is the quietest kind of debt there is. Nobody sends you a statement. There is no due date printed at the top, no minimum payment, no late notice in the mail. It just sits there, compounding, until the day it stops being quiet. That day usually shows up as a failed insurance renewal, a new hire who cannot log in on their first morning, or an auditor asking for a document that does not exist. By then it is not a maintenance task. It is a fire.
Here is what I have learned watching companies grow through it: the businesses that stay out of those fires are not smarter or luckier than the ones that get burned. They are just on a schedule. They fixed things when they were supposed to, on a calendar keyed to headcount instead of to the day something broke.
That is the whole idea behind this piece. Your IT stack should hit certain marks at certain sizes. Miss a mark and you are not running lean, you are carrying debt. So let us walk the three checkpoints that matter most for a growing company: 30 people, 50 people, and 100 people. At each one, I will tell you what should already be true, why that layer becomes mandatory when it does, and what it costs you to fall behind.
Read this as a schedule, not a scorecard
Before the stages, one reframe. This is not a test you pass or fail. It is a maintenance schedule, like the one in your car's glove box. The point of the schedule is that you change the oil before the engine seizes, not after. You do the work on a calm Tuesday because the alternative is doing it during a breach, an audit, or the week your one technical person quits.
So if you read the next three sections and find a gap, that is good news, not bad. A gap you can see is a gap you can close on your own terms. The expensive gaps are the ones you find out about from somebody else.
At 30 people: the survival layer
By the time you have 30 employees, four things should already be running, quietly, every day, without anyone thinking about them.
Universal multifactor authentication, on every account, no exceptions. Email filtering that catches the phishing attempts before they reach an inbox. Endpoint protection on every laptop and desktop, so a single bad click does not become a company-wide problem. And automated backup that you have actually tested by restoring something, not just switched on and assumed.
That is the survival layer. It is called survival because the failure mode is existential. A 30-person company that takes a ransomware hit with no tested backup is not having a bad week. It is fighting for its life, and a meaningful number of companies in that spot do not make it. I wrote a whole piece on what that actually feels like from the inside, hour by hour, in what happens to your business during a ransomware attack. It is not fear-selling. It is just the timeline.
If any of those four are missing at 30 people, that is not a roadmap item for next quarter. That is a this-month problem. The good news is that these are also the most solvable items on the entire list. A focused team can close all four gaps in weeks, not months.
At 50 people: the scale layer
At 50 people, survival is no longer the question. You have made it. Now the question is whether your operation can keep up with itself, because at this size the cracks stop being about security and start being about process.
Four things should be true here. Onboarding and offboarding are automated, so a new hire has what they need on day one and a departing employee loses access the moment they leave, not three months later. Your runbooks are documented, which is a plain way of saying the knowledge is written down somewhere instead of living in one person's head. You have a real password manager instead of a shared spreadsheet or a sticky note under a keyboard. And you have an actual process for managing your vendors, because by now you have a lot of them.
The thread running through all four is the same: at 50 people, you can no longer afford for your operation to depend on any single person remembering how things work. That dependency is the most common and most invisible risk at this stage. It usually surfaces the week your accidental IT person, the one who quietly held it all together, finally burns out or moves on. I wrote about that exact moment in when you outgrow your accidental IT person, because it arrives for almost everyone, and it always arrives sooner than people expect.
Miss the scale layer and the cost is not a catastrophe. It is friction, everywhere, all the time. It is the slow tax of a company that has outgrown its own habits. That makes it a this-quarter problem: not an emergency, but not something to keep ignoring either.
At 100 people: the maturity layer
At 100 people, you are a real institution, and the world starts treating you like one. Customers run security reviews before they sign. Partners ask for documentation. Regulators, depending on your industry, stop being theoretical.
Three things should be true. You have a compliance baseline that fits your industry, whether that is SOC 2, HIPAA, PCI, or something specific to your space. You have a formal incident response plan, written down, with names and roles attached. And you have a backup-and-recovery plan that you have actually fire-drilled, not just discussed in a meeting and filed away.
That last distinction is the one I want to land hard. At this stage, the difference between a company that recovers from a serious incident and one that does not is almost never whether they had a plan. It is whether they ever ran it. A recovery plan you have tested is an asset. A recovery plan you have only written is a comforting document that may or may not work on the worst day of your year, and the worst day is a terrible time to find out.
The maturity layer is also where your security posture and your insurability become the same conversation. The controls underwriters demand at renewal are, almost line for line, the controls a 100-person company should already have. If you want the full picture of what that renewal now looks like and how to get ready, I laid it out in cyber insurance renewal just got harder.
The pattern worth internalizing
Step back from the three checkpoints and you can see the rule underneath them: roughly every 50 people, a new layer becomes mandatory. Survival at 30. Scale at 50. Maturity at 100. The work never stops being necessary, it just keeps moving up the stack as you grow.
The companies that struggle are the ones still running the 30-person playbook at 80 people. That is not lean. That is debt with interest accruing, and the longer you hold it, the more it costs to clear. The companies that thrive treat each threshold as a scheduled upgrade, not a surprise.
There is a reason this gets easier with the right foundation underneath it. A modern, cloud-first platform delivers a large share of these layers as a built-in feature rather than a series of bolt-on purchases. That is most of the argument for why Microsoft 365 Business Premium is the SMB operating system: it answers a big chunk of this checklist as a side effect of running it.
Your next move
Take ten minutes and walk your own stack against these three lists. Be honest about what is actually true today versus what you assume is true. The gaps you find are not a verdict on how you have run things. They are a to-do list, and a to-do list you control on a calm day is worth ten times the same list handed to you during a crisis.
If you want the broader operating manual that this checklist lives inside, the full picture of what to run, when to hire, and what it should cost as you grow is in our pillar guide, IT for growth-stage companies. And if you would rather have someone walk your stack with you and tell you the truth about where you stand, that is exactly the conversation we are built for.
Frequently Asked Questions
What IT should a 30-person company already have in place? At 30 employees, four things should be running every day: universal multifactor authentication on every account, email filtering to stop phishing, endpoint protection on every device, and automated backups you have actually tested by restoring from them. This is the survival layer, because the failure mode is existential. If any are missing, treat it as a this-month priority, not a someday item.
What changes in your IT needs at 50 employees? At 50 people the risk shifts from security to process. You should have automated onboarding and offboarding, documented runbooks so knowledge is not trapped in one person, a real password manager instead of a shared spreadsheet, and a process for managing vendors. The common thread is that your operation can no longer depend on any single person remembering how everything works.
When does a company need formal compliance and incident response? Around 100 employees. At that size you should have a compliance baseline that fits your industry, such as SOC 2, HIPAA, or PCI, a written incident response plan with named roles, and a backup-and-recovery plan you have actually fire-drilled. The distinction that matters is testing: a recovery plan you have run is an asset, while one you have only written may not work when you need it most.
How often do IT requirements change as a company grows? Roughly every 50 people, a new layer becomes mandatory: a survival layer around 30, a scale layer around 50, and a maturity layer around 100. The work does not disappear, it moves up the stack as you grow. Companies that run an earlier-stage playbook at a later-stage size are carrying technology debt that gets more expensive the longer it goes unaddressed.
Does moving to Microsoft 365 help cover these stages? Yes. A cloud-first platform like Microsoft 365 Business Premium builds in many of these layers, including enforced multifactor authentication, managed devices, endpoint protection, and recoverable cloud storage. Running a modern platform satisfies a large part of the checklist as a side effect, which is faster and less expensive than assembling and integrating separate products one at a time.