The standard your IT is built to, written down before you sign.
Our Recommended Technology Platform is the hardware, software, network and security standard Novix IT supports inside every managed IT plan. Each category has two levels: what we recommend buying or building today, and the minimum your kit has to meet to be supported at no extra cost.
A standard estate is what makes a service level honest. When every device is managed the same way, on supported software, behind a supported firewall, our engineers resolve issues against a known baseline rather than rediscovering your setup each time, and the security layer covers every user without gaps.
- Recommended is what we would buy or build today. New equipment and new builds should meet it.
- Minimum is what your kit must meet to be supported inside your plan at no extra cost. Anything below it is supported on a best-endeavours basis, outside the service levels, and may be charged at our out-of-scope rate. We say so upfront.
The standard in one lineWindows 11 Pro on business hardware under five years old and under warranty, Microsoft 365 Business Premium, everything licensed and in vendor support, a supported business firewall, and the Novix security layer on every device and every user.
Workstations
Business ranges only, bought with a warranty that outlasts the working life of the device. A laptop is the default, because it keeps people working wherever they are.
| Recommended | Minimum | |
|---|---|---|
| Form factor | A laptop by default. Desktops only for fixed roles such as reception, heavy CAD work or shared stations | Any business-grade laptop or desktop |
| Make and range | Lenovo ThinkPad (T series, X1 Carbon) or ThinkBook, HP ProBook or EliteBook, Lenovo ThinkCentre or HP Pro and Elite desktops. Never consumer models | Consumer models are supported on a best-endeavours basis only |
| Processor | Current-generation Intel Core Ultra 5 or AMD Ryzen 5, or better | On Microsoft's supported processor list for Windows 11 |
| Memory and storage | 16GB RAM and a 512GB NVMe SSD. 32GB RAM for heavy spreadsheet, CAD or multi-screen users | 16GB RAM and an SSD |
| Operating system | Windows 11 Pro, with TPM 2.0 and Secure Boot enabled | Windows 11 Pro or Enterprise. Windows 11 Home cannot be managed properly and needs upgrading to Pro |
| Age and warranty | Three-year on-site manufacturer warranty from purchase | Under five years old and under manufacturer warranty, standard or extended |
| Management | Enrolled into Microsoft Intune (through Autopilot for new devices), BitLocker encryption on, and the Novix management, protection and admin-rights agents installed | The Novix management and protection agents installed |
Copilot+ PCs, with a built-in AI processor (NPU), are not a requirement. They are worth taking on a new purchase when the price difference is small, since that is where Windows is heading, but not worth a large premium yet.
Servers, cloud and platform
Cloud first. Microsoft 365 is the platform your firm runs on, and an on-premises server is the exception that has to earn its place, not the default. When a server does stay, it is held to the same standard as everything else.
| Recommended | Minimum | |
|---|---|---|
| Platform | Microsoft 365 Business Premium: Microsoft Entra ID for identity and sign-in, SharePoint, OneDrive and Teams for files, Intune for devices. Licences are billed separately from the service fee | Business Premium for new clients. Without it, Intune and Conditional Access cannot be applied and part of the security layer does not work. Existing clients on Business Standard move up through the Technology and Strategy Review |
| Where business data lives | Microsoft 365 | Microsoft 365, or a server that meets every on-premises condition below |
| Hosted servers | Microsoft Azure, only when a workload cannot move to a cloud application and a hosted server makes more sense than a box in the office. Assessed case by case | Not required |
| On-premises servers | By exception only: a line-of-business application that needs a local server, very large files, or a regulatory reason. HPE ProLiant or Synology NAS | Under five years old, under warranty, correctly licensed, on a UPS and backed up by Novix |
| Server operating system | A current Windows Server release, correctly licensed | Windows Server 2019 or later. Windows Server 2016 reaches end of support on 12 January 2027, so it is accepted only with a replacement agreed at onboarding |
Networking
The network is where the security layer meets the office. We recommend three firewall and wireless families equally and build every one of them to the same design, so the choice comes down to your sites and budget rather than to what we prefer to support.
| Recommended | Minimum | |
|---|---|---|
| Firewalls, switches and wireless | UniFi, Cisco Meraki or FortiGate, with security subscriptions and licensing kept current | A business-grade firewall under vendor support, on current firmware, with its security licensing active. An internet provider's router on its own does not count |
| Network design | Separate network segments for different kinds of traffic, certificate-based (802.1X) Wi-Fi for company devices, and isolated networks for guests and personal devices | No consumer mesh Wi-Fi or unmanaged switches in the core network |
| Cabling | Cat6 | Cat5e |
| Printers | HP business printers | Business-grade. Consumer printers are supported on a best-endeavours basis only |
Certificate-based Wi-Fi means each company device proves who it is with a certificate issued to it, rather than everyone sharing one password. When someone leaves or a laptop goes missing, that one device is shut out and nobody else has to change anything.
Approved software
Two rules sit under every line of this table: everything correctly licensed under the manufacturer's terms, and everything still in the vendor's support. Software that no longer receives security updates is a standing risk to the whole firm, not just to the person using it.
| Recommended | Minimum | |
|---|---|---|
| Operating system | Windows 11 Pro | Windows 10 has been out of support since October 2025. With Microsoft's paid Extended Security Updates it is tolerated as a time-limited bridge, with a replacement date agreed. Without them it is below the minimum |
| Office applications | Microsoft 365 Apps (Word, Excel, Outlook and the rest) on the current channel, through Microsoft 365 Business Premium | Office LTSC 2024 where a firm genuinely needs a perpetual licence. Office 2019 has been out of support since October 2025 and Office 2021 support ends on 13 October 2026, so neither meets the minimum |
| Meetings, chat and calling | Microsoft Teams. Zoom stays approved for joining external meetings | Skype was retired in May 2025 and is not supported |
| Web browser | Microsoft Edge managed through Intune, or Google Chrome | Licensed and in vendor support |
| Design and documents | Adobe Acrobat and Creative Cloud, licensed | Licensed and in vendor support |
| Email signatures | Exclaimer, managed by Novix | Licensed and in vendor support |
| Line-of-business applications | Correctly licensed and covered by an active support agreement with the supplier | Correctly licensed. Without a supplier support agreement, supported on a best-endeavours basis |
Unapproved software, and what to use instead
Every item on this list either duplicates something Novix already runs for you or opens a route into the firm that nobody is watching. Each one comes with the approved alternative, so the answer is never just no.
| Not approved | Use instead |
|---|---|
| Unlicensed or pirated software | Properly licensed copies |
| Free “tune-up”, “cleaner” or driver-updater utilities | Patching and maintenance through Novix device management |
| Third-party or free antivirus | The endpoint protection Novix manages on every device |
| Remote access tools such as TeamViewer, LogMeIn, AnyDesk, ScreenConnect and VNC | Novix remote support tools, used by Novix engineers only |
| Consumer VPN apps | Novix-managed remote access |
| Personal cloud storage (personal Dropbox, Google Drive or OneDrive) for company data | SharePoint and OneDrive for Business |
| Personal password managers, or passwords saved in the browser, for work accounts | The business password manager Novix manages |
| AI tools nobody has approved, used with company or client data | Microsoft Copilot, or an AI tool we have approved with you |
| Software out of vendor support | A supported version, planned in through the Technology and Strategy Review |
Security, built into every plan
Security is part of every plan, not an add-on, and we do not sell it separately. IT and security are one service, run by one team, so these layers go onto every device and every user as a Novix standard. We describe each layer by what it does rather than by product name: publishing exactly which products protect our clients would only help someone trying to get past them.
| Layer | What it does | Plans |
|---|---|---|
| Endpoint protection and response | Detects and stops malicious activity on every device, managed by Novix | Launch, Build, Scale |
| Email security | Filters phishing, malicious links and harmful attachments before they reach the inbox | Launch, Build, Scale |
| DNS filtering | Blocks connections to known malicious and unwanted websites, wherever the device is | Launch, Build, Scale |
| Multi-factor authentication and sign-in control | Microsoft Entra ID multi-factor authentication with Conditional Access, applied as a Novix standard to every user, with no exceptions | Launch, Build, Scale |
| Admin rights | Users do not hold local administrator rights. Elevation is approved on request | Launch, Build, Scale |
| Microsoft 365 backup | Backs up your Microsoft 365 data separately from Microsoft | Launch, Build, Scale |
| Server and endpoint backup | Backs up servers and virtual machines | Priced per server or virtual machine |
| Password manager | One managed business vault for work passwords, in place of personal managers and saved browser passwords | Build, Scale |
| Security awareness training | Short training and simulated phishing emails, so your people recognise a real one | Build, Scale |
| Vulnerability management | Checks your Microsoft 365 environment for weaknesses and misconfiguration | Build, Scale |
| Security operations centre and SIEM | Security events from across your estate collected in one place and investigated by a managed security operations centre | Scale |
| Cyber Essentials monitoring | Checks your devices against the Cyber Essentials controls, so readiness is known before an assessment | Scale |
See how each layer sits in the packages on our plans, or read how we run security day to day on the cyber security page.
Trusted vendors
The manufacturers we buy from and build on: Lenovo, HP (PCs and printers), HPE (servers), Synology, Ubiquiti (UniFi), Cisco Meraki, Fortinet (FortiGate) and Microsoft.
Moving up to the recommended standard
We take on what you have. Anything below the recommended level is planned onto it over time as part of your technology roadmap, at the quarterly Technology and Strategy Review, so replacements are budgeted and scheduled rather than sprung on you. A short list of items is dealt with at onboarding instead of being phased in, because we cannot secure a firm while they stay in place.
What we will not support
- Unlicensed or pirated software. We will not install, maintain or work around it.
- Refusing the security layer. A user who will not use multi-factor authentication, or a device that cannot carry our protection and management agents, is outside the service. We cannot secure it, and we will not pretend to.
- Third-party remote access tools left in place. They are removed at onboarding. If a firm insists on keeping one, that device is not supported.
- Personal devices outside the BYOD rules. Personal phones and laptops are supported only when enrolled under the bring-your-own-device policy, with device management and a separate network.
Supported at extra cost or on best endeavours, without service levels
- Out-of-support operating systems or Office, while on an agreed replacement plan
- Hardware out of manufacturer warranty
- Consumer-grade equipment and unmanaged network equipment
- Line-of-business software without a supplier support agreement
Not sure where your firm sits? Ask us to check your estate against the standard and we will tell you what meets it, what falls below it, and what that means for your plan.
faq
Questions firms ask about the platform
Because a service level is only honest when the estate behind it is known. Every device, application and network that sits outside a standard is an exception our engineers have to work around, and exceptions are where response times slip and security gaps open. The minimum is the line at which we can support your kit inside the plan at no extra cost and stand behind the service levels. We state it before you sign, so there are no surprises later.
No. We take on what you have. Anything below the recommended level is planned onto it over time as part of your technology roadmap, and that planning happens at the quarterly Technology and Strategy Review, so replacements are budgeted rather than sprung on you. The exceptions are the few items we will not support, such as unlicensed software or third-party remote access tools, which are dealt with at onboarding rather than phased in.
Yes. Macs are supported on the three most recent major macOS versions, which are the ones Apple still patches, and they are managed through Microsoft Intune alongside your Windows devices. They sit outside the Recommended Technology Platform itself, which is built around Windows 11 Pro, so a Mac-heavy firm should talk to us about how that affects its plan.
Publishing exactly which security products our clients run would give an attacker a head start, so this page describes each layer by what it does instead. The layers themselves are Novix standard and applied to every client. The hardware, Microsoft and business software we recommend are named, because knowing them helps you buy the right kit and tells an attacker nothing useful.