The complete standard, layer by layer. Details on each follow below.
| Layer | Standard | Also Supported |
|---|---|---|
| Productivity & Identity | Microsoft 365 Business Premium | Microsoft 365 Business Standard, E3/E5 |
| Directory Services | Windows Server – Active Directory, DNS, DHCP | Microsoft Entra ID, hybrid join |
| Virtualization | Proxmox VE + Proxmox Backup Server | Hyper-V |
| Servers & Storage | Dell PowerEdge & Dell storage | Certified refurbished PowerEdge |
| Network Storage | TrueNAS (ZFS) on Dell or iXsystems hardware | Synology for small file-share-only sites |
| Workstations | Dell OptiPlex / Latitude, HP Elite / Pro | Dell Precision, HP ZBook workstations |
| Desktop OS | Windows 11 Pro (or newer) | Windows 11 Enterprise |
| Linux Server OS | Ubuntu Server LTS | Debian Stable |
| Switching | Cisco Catalyst or Ubiquiti UniFi | Cisco Business series |
| Wireless | Ubiquiti UniFi access points | UniFi Cloud Gateway / controller hosting |
| Routing & Firewall | UniFi gateways, pfSense or OPNsense | Netgate appliances |
| Endpoint Security | SentinelOne EDR | ESET Endpoint Security |
| DNS Security | DNSFilter | Cisco Umbrella |
| Email Security | Proofpoint | Microsoft Defender for Office 365 |
| Power Protection | APC Smart-UPS | CyberPower PR / OR series |
“Also Supported” means we deploy and maintain it happily – it simply is not our first recommendation for a greenfield build.
Every choice below comes with a reason. If you disagree with one, we would genuinely like to hear it – that is how the list gets better.
Productivity, Email & Identity
Microsoft 365 is the anchor of the platform. It delivers business email, the Office applications your staff already know, cloud file storage, collaboration, and – most importantly – a modern identity provider with conditional access and multi-factor authentication built in. Business Premium is our default recommendation because it bundles the security and device management capabilities that smaller organizations otherwise go without.
Why it wins: one identity, one license, one support path covering email, documents, collaboration, and endpoint policy.
Domain Controllers & Core Services
On-premises identity still matters. Active Directory Domain Services remains the cleanest way to centrally manage Windows machines, enforce Group Policy, control file and print access, and keep authentication working when the internet does not. We deploy current, in-support Windows Server releases – typically with a pair of virtualized domain controllers for redundancy – and hybrid-join them to Entra ID so cloud and on-premises identity stay in sync.
Why it wins: centralized control over Windows endpoints that no cloud-only approach fully replaces yet.
Virtualization & Backup
Proxmox Virtual Environment is our hypervisor of choice. It is enterprise-grade KVM virtualization built on Debian, with clustering, high availability, live migration, ZFS storage, and snapshotting – without per-socket licensing that scales faster than your business does. Paired with Proxmox Backup Server, it gives you deduplicated, incremental, verifiable backups of every virtual machine, with restores measured in minutes.
Why it wins: enterprise virtualization features at a cost structure that makes sense for a small business, with no vendor holding your workloads hostage.
Server & Storage Hardware
Dell server hardware is the foundation everything else sits on. iDRAC out-of-band management means we can diagnose, reconfigure, and rebuild a server without driving to your office. ProSupport contracts put replacement parts on site the next business day – and in many cases, a technician with them. Redundant power supplies, hot-swap drives, and hardware RAID are standard, not upgrades.
Why it wins: serviceable hardware with real support behind it, and remote management that turns most emergencies into remote fixes.
Shared Storage & File Services
Where a client needs serious shared storage – a file server, a datastore for the virtualization cluster, or a backup target – we deploy TrueNAS. It is built on OpenZFS, which is the reason it is on this list: end-to-end checksumming catches silent data corruption that traditional RAID never notices, and instant, space-efficient snapshots turn a deleted folder or an encrypted share into a rollback rather than a restore.
TrueNAS presents storage over SMB, NFS, and iSCSI, so it can serve Windows file shares and Proxmox datastores from the same pool. Scheduled replication pushes snapshots to a second unit or an off-site target, which pairs naturally with our off-site backup service.
Why it wins: ZFS data integrity and snapshot-based recovery on hardware you own, with no per-terabyte licensing. Read-only snapshots are also one of the most effective ransomware defenses available – encrypted files simply get rolled back.
Desktops & Laptops
We deploy business-class machines only – Dell OptiPlex and Latitude, HP Elite and Pro. Consumer models cost less up front and more over their lifetime: shorter warranties, no on-site service, no standardized imaging, no firmware management, and no guarantee the same model exists in six months. Business lines give us stable configurations we can image, document, and support consistently across your fleet.
Why it wins: longer warranties, on-site service, stable model lines, and manageable firmware – the things that actually determine total cost of ownership.
Desktop Operating System
Windows 11 Pro or newer, on every workstation. Pro is the minimum edition – Home cannot join a domain, cannot be managed by Group Policy or Intune, and cannot use BitLocker properly, which rules it out of any managed environment. We keep endpoints on supported feature releases and patch them on a defined cadence rather than whenever a user happens to reboot.
Why it wins: it is the only desktop OS that fully supports the management, encryption, and policy controls the rest of this platform depends on.
Linux Server Platforms
For Linux workloads – web applications, databases, internal tooling, container hosts, appliances – we standardize on Ubuntu Server LTS and Debian Stable. Both offer multi-year support windows, predictable release cadences, enormous package ecosystems, and security update streams you can actually plan around. Ubuntu LTS gives five years of standard support out of the box; Debian Stable prioritizes conservatism, which is exactly what you want under a database.
Why it wins: long support lifecycles, no licensing overhead, and the same two distributions our team knows inside out.
Managed Switching
Managed switches, always. Unmanaged switches are invisible – no VLANs, no port security, no PoE control, no visibility when something floods the network. Cisco Catalyst is our recommendation where deep feature sets, strict compliance requirements, or existing Cisco investment are in play. Ubiquiti UniFi is our recommendation where a clean, unified management plane and excellent price-to-capability matter more.
Why it wins: segmentation and visibility at the network edge – the cheapest security control you will ever buy.
Access Points & Coverage
Ubiquiti UniFi access points give you genuine enterprise wireless – seamless roaming, multiple SSIDs mapped to separate VLANs, band steering, per-client visibility, and centralized firmware management – without a controller licensing model. We design coverage around your floor plan and construction, not around guesswork, and we put guest traffic on its own isolated network as a matter of course.
Why it wins: enterprise wireless behavior, centrally managed, with no recurring per-AP licensing.
Routing & Perimeter Firewall
The edge is where your network meets everything else, and the ISP-supplied box is not a firewall. For environments already standardized on UniFi, a UniFi gateway keeps routing, switching, and wireless under one management plane. Where you need deeper policy control, granular VPN configuration, or full transparency into the ruleset, we deploy pfSense or OPNsense on purpose-built hardware.
Why it wins: a real firewall with a ruleset we control, document, and can restore in minutes.
Endpoint Protection & EDR
SentinelOne is our standard for endpoint protection on every workstation and server. It is not signature-based antivirus – it watches behavior, and when it identifies an attack it contains the machine and remediates automatically, including rolling back ransomware encryption. That distinction matters most at 2:00 AM, when the response has to happen without a human in the loop.
Why it wins: autonomous response. It stops the attack whether or not anyone is watching the console. See our full security software stack for the layers that sit alongside it.
DNS Security & Content Filtering
Almost every attack has to resolve a domain name before it can do anything. DNSFilter sits at that step and refuses to answer for known-malicious and newly-registered domains, which stops a great deal of malware and phishing before a single packet reaches the target. It is the broadest protection in the stack: it covers every device on the network – printers, cameras, phones, guest laptops, anything you cannot install an agent on.
The same platform handles content filtering by category, so acceptable-use and compliance requirements are enforced without a separate product. Roaming agents extend the same policy to laptops that have left the office.
Why it wins: the cheapest and widest-reaching control on this list. It protects things you cannot put software on, and it blocks threats before the connection is ever made.
Email Security & Threat Protection
Email remains the way most breaches start, and the filtering bundled with a mail platform is not built to stop a targeted attack. Proofpoint sits in front of Microsoft 365 and inspects mail before it reaches the mailbox – sandboxing attachments, rewriting links so they are checked again at click time, and catching the business email compromise attempts that carry no payload at all and therefore sail past conventional scanning.
That last category is the one that costs businesses real money: a convincing message from “the owner” asking accounting to change wire instructions. There is no malware to detect, only intent, and that is precisely what this layer is tuned for.
Why it wins: it filters your single largest attack surface before delivery, and it catches the social-engineering attempts that contain nothing for an antivirus engine to find.
Uninterruptible Power
Every server, switch, firewall, and access point belongs on a UPS – ideally a line-interactive or online model with pure sine wave output, because modern power supplies do not tolerate simulated waveforms well. APC Smart-UPS is our default; CyberPower PR and OR series are an excellent value alternative. We size units to real load, configure automatic graceful shutdown, and track battery age so replacement happens on schedule instead of during an outage.
Why it wins: clean power and controlled shutdowns prevent the filesystem corruption and hardware failures that turn a brief outage into a multi-day recovery.
An environment assembled from whatever was on sale each year is an environment nobody fully understands – including the people who built it. A standard platform trades a little theoretical optimization for something far more valuable: predictability.
Our technicians have seen your exact configuration before. Diagnosis starts from knowledge, not discovery.
Common models mean common parts. A failed workstation gets swapped from stock instead of ordered and waited on.
One hardening standard applied everywhere. No forgotten device running a configuration nobody documented.
Known refresh windows and known end-of-support dates mean capital planning happens in advance, not in crisis.
Nobody rips out a working environment to match a document. We align you to the platform over time, at natural replacement points.
We document what you actually have – hardware, licensing, firmware, warranty status, and end-of-support dates.
We compare it against the RTP and rank the differences by risk, age, and business impact – not by what we would like to sell.
A multi-year plan tied to your budget cycle. What changes this quarter, what waits, and what it will cost when it comes due.
Each refresh, each failure, each expansion moves you closer to the standard. Over a few cycles, the environment simply becomes it.
If you run Hyper-V, Meraki, Fortinet, Lenovo, Google Workspace, or something else entirely, we can absolutely support it. The RTP is where we start when there is nothing to preserve and no constraint pulling us elsewhere. It is not a condition of working with us.
It also is not static. Products get added, and products get removed when they stop earning their place. We revisit this list as the market changes, and we will tell you plainly when something we previously recommended no longer makes the cut.
We will inventory what you have, show you where it lines up with the platform, and give you a straight answer on what actually needs attention. No obligation.
