A platform partner at a seed-stage Bay Area fund called me this summer to ask about IT support for VC firms and the portfolio companies they back. A bank partnering with one of her fintech investments had sent over a security questionnaire, and while helping that founder respond, she asked every founder in the fund's portfolio for a quick description of how they handled logins and laptops.
Twenty-five companies replied over two weeks. Three were on a different identity provider from everyone else, six had no administrator on their email and document systems besides the founder, and one still had an active account for a contractor who had left in the spring.
None of those founders had been careless. Each had made sensible choices in a hurry while building a product, and nobody had ever asked the fund to look, which is how a portfolio ends up with twenty-five setups and no baseline.
She wanted a way to raise that baseline without turning her platform team into a help desk for twenty-five companies. I told her the first step was deciding what the floor should be, and the second was deciding what the fund should leave alone.
What IT Support for VC Firms Covers (and What It Leaves Alone)
IT support for VC firms, as we use the term here, is a shared minimum standard for identity, devices, backup, email security, and offboarding that a venture firm's platform team encourages across its portfolio companies, with each company's day-to-day IT still run by the company or its own provider. A firm's own IT, such as LP data and fund operations, is a separate subject that this post leaves aside. The standard applies at the level of outcomes (every account has multi-factor authentication, every laptop is encrypted) but says nothing about which products get a company there.
Day-to-day work that stays with the company includes password resets, new-laptop setup, software requests, and the judgment calls about which tools suit the team. A fund that tries to manage everything centrally ends up supporting twenty-five sets of preferences. What’s more practical and useful is a narrower portfolio-level that makes sure each company starts from a floor that a customer, an auditor, or an acquirer will find reassuring.
Why a Perks List Is Not an IT Strategy
Most platform teams already run a perks program, and the best ones are worth having: credits for cloud hosting, discounts on productivity suites, negotiated rates on security tools. I like them, but I think they fall a little short of what founders actually need.
A discount on a password manager does nothing for a company whose founder never rolled it out, and a free year of endpoint protection can’t protect laptops that were never enrolled. The perk puts the product in the company's hands, but the baseline decides whether anyone effectively utilized it. A platform team can report what a perk saved without knowing whether the tool was ever switched on.
The Founder Can Do It, and That Is the Problem
Most technical founders can set up their own IT. A CTO who has run production infrastructure can configure an identity provider on a Saturday, and part of the appeal is that it makes a good puzzle: the problem is well defined, the tools are documented, and an afternoon of work produces a visible result. I understand the pull.
The cost of the time spent solving IT puzzles shows up somewhere else. Every hour a founder spends on device enrollment or admin permissions comes out of the product, the first enterprise customers, or the next hire, and a company at seed or Series A has very few of those hours to spare. IT is a $100,000 problem, and the founder is supposed to be working on a billion-dollar one.
Speed adds a second reason. A baseline in place from the first months takes a few hours of attention. The same baseline built in a hurry before a customer's security review takes far more of a founder's attention, usually under a deadline. At five people, a founder who enjoys the work can reasonably own the baseline. The trouble starts when an ongoing responsibility lacks a clear endpoint. Our post on the actual costs of DIY IT management puts numbers on that trade, and our post on IT growing pains after Series A covers what breaks between rounds.
The Five-Item Baseline Every Portfolio Company Needs by Series A
At Jones IT, we use five items as the floor because each one eventually appears in a customer questionnaire, a SOC 2 audit, or an investor's due diligence review. Each item below is written as an outcome a founder can confirm in a few minutes, and each answers a question the founder will be asked anyway.
1. Company-Owned Identity and Admin Access
Every employee signs in through one company-controlled identity provider (a service such as Google Workspace, Microsoft Entra ID, or Okta that holds logins in a single place), multi-factor authentication is enforced on every account, and at least two people at the company hold administrator rights. The domain registrar and DNS (Domain Name System) hosting sit in the company's name and not in a contractor's or a founder's personal account. Our post on identity and access management for startups walks through the identity setup.
2. Managed, Encrypted Laptops
Company laptops are enrolled in an MDM (mobile device management), disk encryption is on, and screen locks are enforced. A founder working from an unencrypted personal laptop has no way to wipe it if it goes missing, and that one machine may hold customer data. For Apple-heavy teams, our post on SOC 2 device access controls for an Apple fleet shows what auditors expect to see.
3. A Written IT Policy Employees Have Acknowledged
The company has a short written IT policy covering acceptable use, password and device rules, how to report a lost laptop or a suspicious email, and how data is backed up and restored. Every employee acknowledges it when they join and once a year after, and the company keeps the acknowledgments on file. Customer questionnaires and SOC 2 audits commonly ask for the policy and for proof that people have read it, so a document nobody acknowledged answers only half the question. Our posts on best practices for writing an IT policy and how to create an IT policy for your business cover what to include.
4. Email Protection and Phishing Training
Email filtering is on, company email requires multi-factor authentication, and employees complete short phishing training during onboarding and once a year after. Fraudulent invoices and wire-change requests are a standing risk for any company moving money quickly with few approval steps, and a ten-minute training that teaches staff to verify payment changes repays itself many times over. Our guides on types of phishing attacks and security awareness training evidence cover the details.
5. Offboarding with a Record
When someone leaves, their access ends the same day, and a record shows who closed each account and when. Contractors and advisors also belong in this process, since they are the people most likely to be missing from the HR system. Our post on employee IT lifecycle management covers the day-of mechanics.
The five items above resemble the approach in CISA's Cross-Sector Cybersecurity Performance Goals, a prioritized subset of practices selected for the common threats CISA observes. It is relevant for large as well as small organizations. CISA frames the goals as a place to begin, and the same framing applies here.
What the Baseline Does for Founders
It’s easy to view the baseline simply as the fund's request, so it helps to emphasize what the founder gets in return. A customer's security questionnaire, a bank partner's vendor review, and an investor's diligence list ask overlapping questions about logins, laptops, backups, training, and departures. A company with the five items in place answers from how it is already set up, while a company without them has to assemble the answers under deadline pressure. The quarterly check-in described below takes a few minutes and leaves the founder with current answers for the next questionnaire.
Where Standardization Should Stop
The floor works because it is low. Once a fund starts specifying products, ticketing tools, or response times, founders stop treating the baseline as a floor and start treating it as someone else's project.
Growth stage and sector pull the rest apart. A biotech company with lab instruments on its network, a fintech company answering to a sponsor bank, and an AI company holding sensitive training data have different next steps after the five items, and a platform team gains nothing by pretending otherwise. Our post on startup IT budget planning shows how the right spend shifts at each stage.
I go back and forth on whether a fund should require the baseline or only recommend it. Requirements get better follow-through, but they can also create resentment. Recommendations, on the other hand, are easier for founders to accept, but some companies won't act on them. How does a fund raise a baseline without sounding like it is issuing orders? I would pick a one-page baseline presented as what the fund's best-run companies already do, paired with an introduction to a provider for any founder who wants help.
Four Ways to Deliver the Baseline
Funds deliver the baseline in four ways, and each one trades verification against friction.
A Written Baseline and a Preferred Provider List
The platform team publishes the one-page baseline, lists a few providers who have worked well with portfolio companies, and leaves the rest to founders. Friction stays near zero, and so does verification, since the fund learns only what founders voluntarily share.
A Fund-Run Program
Some funds hire a person or a team to run IT for portfolio companies directly. Uniformity is high, and the platform team then owns the outcome when something breaks, along with the headcount to support every company's ticket queue.
A Fund-Negotiated Master Agreement
The fund negotiates pricing and terms with one or two providers, and each portfolio company then signs its own service agreement under those terms and holds its own administrator accounts. Consistency improves over a preferred provider list, since every participating company starts from the same scope and the same response commitments, and founders skip a round of vendor evaluation. The fund takes on more than it would with a list: it vouches for a provider, it has to renegotiate as the portfolio changes, and a founder who prefers a different provider feels pressure to switch. A fund considering this route should have counsel review who is a party to the agreement and what the fund is promising. We work with funds this way when a fund asks, with each company still signing its own agreement and owning its own accounts.
Each Company Hires Its Own Provider Against the Shared Baseline
The company signs its own agreement with a managed IT provider, holds its own administrator accounts, and measures the provider against the fund's baseline. Our clients work this way: each company contracts with Jones IT directly, and we configure identity, devices, backup, and email protection to whatever baseline the founder brings, even one the fund wrote. Companies with an internal IT person can choose a co-managed arrangement, which our post on right-sizing IT to your growth stage compares with fully managed support. The tradeoff is uniformity: twenty-five companies may choose twenty-five providers, so the written baseline has to supply the consistency that a single program would otherwise provide.
What a Platform Team Should See
The platform team needs enough visibility to know where problems exist, but it doesn't need administrator access. A short quarterly check-in gives them that visibility while leaving the systems under the founder's control. Six yes-or-no questions, one for each baseline item plus one on SOC 2, give the platform team a picture without a single login:
Is multi-factor authentication enforced on every account, and do at least two people at the company hold administrator rights?
Are all company laptops managed and encrypted?
Has every employee acknowledged the latest IT policy?
Has every employee completed phishing training this year?
Did everyone who left the company this quarter lose access the same day?
Where does the company stand on SOC 2: not started, in progress, or report issued?
The answers are self-reported, and a founder can easily answer yes without checking. The check-in is rather a prompt for a conversation, and the companies that answer no become the ones the platform team introduces to a provider. A partner who wants verification can ask for a screenshot or a short call, and the founder stays in control of what gets shared.
Platform Lead Checklist
Confirm each of the following before you send a baseline to your portfolio:
The baseline fits on one page and is written as outcomes, without product names.
A founder can confirm each item in under ten minutes.
The baseline lays down which items apply at seed and which can wait until Series A.
A specific person at the fund answers founder questions about it.
Two or three providers the fund has seen work well are listed as options, with no requirement to use them.
One person sends the quarterly check-in, and the founders answer it directly.
The fund never holds administrator access to a portfolio company's systems.
A company that answers no gets an introduction to a trusted provider and not an escalation.
The baseline is reviewed once a year and updated when customer or auditor expectations change.
A Baseline Founders Will Use
The platform partner from the opening wrote her baseline on one page, sent six questions to her founders at the start of the next quarter, and introduced the founders who answered no to providers they could hire directly. The bank's questionnaire got answered, and the next one will draw on answers she already has.
If you lead a fund platform operations, or are a founder whose investors have started asking about security, we are glad to hop on a call with you and walk through where your company stands against the baseline.
IT Support for Portfolio Companies: Common Questions
Should a VC firm require portfolio companies to follow an IT baseline?
We lean toward recommending a baseline over requiring one. A written one-page standard, a quarterly check-in, and an introduction to providers give founders a reason to act without making the fund responsible for outcomes. A requirement makes sense where a co-investor, a fund agreement, or an LP specifically demands it.
When should a portfolio company start SOC 2?
A company typically starts SOC 2, an attestation report built on the AICPA Trust Services Criteria, when customers or partners begin asking for one, and the five baseline items shorten the preparation. Our SOC 2 compliance timeline lays out the months involved, and our post on SOC 2 compliance tools covers the security stack.
Does the fund need access to portfolio company systems?
No. The fund needs only the status information, and should not hold any administrator account. Access held by an investor adds a third party to the company's risk and answers no question that a yes-or-no check-in cannot.
About The Author
Evan JonesFounder and CEO of Jones IT
With over two decades of IT experience in San Francisco, Evan guides Jones IT's long-term strategy, finances, and culture, with a vision of building the city's highest-rated IT services firm. Outside of work, you'll find him on the golf course or running Bay Area Warriors, his non-profit connecting Bay Area kids to college through basketball.
Learn how IT support for VC firms works best as a shared baseline. Protect your portfolio companies without adding a central help desk operational burden.