Architecture · Network Architecture
Small Business Reference Architecture
A defensible design for an organisation of roughly 10, 100 people, cloud first, with a small on premises footprint.
IntermediateUpdated 2026-09-01
Overview
The modern small business pattern is cloud first: identity and productivity in a cloud tenant, devices managed over the internet, minimal on premises infrastructure, and a single resilient internet edge with segmented wireless and wired access.
The most common weaknesses at this size are a flat network, local administrator rights everywhere, an ISP supplied router as the only security control, and backups that exist but have never been restored.
Layer model
Edge & network
Business grade firewall with current supportRedundant internet where affordableVLANs for staff, guest, voice and IoTManaged switches and access points
Identity & devices
Cloud identity with MFA for everyoneDevice enrolment and complianceDisk encryption with key escrowNo standing local administrator rights
Data & applications
Cloud collaboration with governed sharingA small number of vetted SaaS applicationsDocumented integrations and admin accounts
Resilience & operations
Backup of cloud and any local data with an immutable copyEDR on every deviceMonitoring and alerting to a named ownerPatch and update rings
Design considerations
- Choose managed services deliberately; small teams should minimise systems they must patch themselves.
- Document the environment properly, small estates are usually the least documented and most person dependent.
- Define what happens when the one person who knows the environment is unavailable.
Security considerations
- MFA everywhere, admin accounts separate from daily accounts, and no shared logins.
- Immutable backup copy plus an annual restore test.
- Replace consumer networking equipment at the perimeter.
Failure points
- Single internet circuit
- One firewall without support cover
- Single administrator with sole knowledge
- Untested backups