If you have searched for the best IT support in Brisbane, you have found lists. Ten providers, ranked, with a paragraph each.
Nearly all of those lists are written by someone on them, or by a site that sells the positions. That is worth knowing before you use one to make a decision about who holds the keys to your business.
What is actually useful is understanding what the services are, how they get charged for, and which questions separate a provider who will answer the phone in March from one who looked good in a proposal. That is what this is.
The services you are actually buying
“IT support” covers about ten distinct things. Most Brisbane providers offer a bundle of them, and the bundles are named differently at every shop, which is exactly why quotes are hard to compare.
Managed services. An outsourced IT department on a monthly fee. Monitoring, patching, updates, support, and someone whose job it is to notice problems before you do. Usually priced per user or per device.
Cybersecurity. Email filtering, multi factor authentication, device protection, application control, and monitoring for the things that get through. This is where the largest gap usually sits between what a business thinks it has and what it has.
Cloud services and Microsoft 365. Setting it up properly, keeping licences right, and managing the identity side so people have the access they need and nothing more.
Backup and recovery. Not the same as cloud storage. A backup you have restored from is a backup. Everything else is a hope.
Network management. Switches, firewalls, Wi-Fi, internet services, and the site-to-site links between offices.
Phone systems. Business phones now run over your internet connection, so they sit with IT rather than with a separate telco contract.
Onsite support. Someone turns up. Needed for hardware, cabling, new sites and the problems that cannot be described over the phone.
Remote support. The day to day. This is where the overwhelming majority of work happens.
Risk assessments. A structured look at where the gaps are, against a standard rather than against opinion.
IT strategy. Planning what gets replaced when, what the next two years cost, and what has to change before the business can grow.
You do not need all ten from one provider. You do need to know which ones you are buying and which ones you are quietly not.
How Brisbane providers charge
Three models dominate, and the difference matters more than the hourly rate.
Break-fix. You call when something breaks and you pay for the time. Cheap when nothing goes wrong, which encourages nobody to prevent anything. Fine for a two person business, poor for anything with staff depending on it.
Managed, per user or per device. A monthly fee covers support and maintenance. Per user usually suits offices where people have a laptop and a phone. Per device suits places with a lot of shared machines. Read which one you are being quoted, because the same business can price out very differently under each.
Co-managed. You have someone internal and the provider fills the gaps: after-hours cover, projects, security, the things one person cannot do alone.
Whichever model, get clear on what is not included. Projects, hardware, after-hours work, new site builds and vendor liaison are the usual exclusions, and they are where an unexpectedly large invoice comes from.
The questions that tell you the most
The Australian Signals Directorate publishes a short list of questions to ask managed service providers. They are aimed at your provider’s own security, which matters because a provider with privileged access to your systems is a route into your business.
Ask all five, word for word:
- Are you implementing better practice cyber security?
- Are you securely administering your systems and services?
- Are you monitoring activity on your systems and services?
- Are you regularly assessing your systems and services?
- Are you prepared for, and able to respond to, cyber security incidents?
ASD says a provider can demonstrate the first one by implementing the Essential Eight: patch applications, patch operating systems, multi factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups.
A provider who can talk through those eight for your business, and for their own, is telling you something. A provider who changes the subject to a product they resell is also telling you something.
Then add four practical ones:
What are your response targets, in writing, by priority? Ours are 15 minutes to respond and 4 hours to resolve when the business is stopped, one hour and 8 business hours for a major disruption, 4 business hours and 2 business days for a single user, and one business day and 5 business days for requests and changes. You do not have to match those numbers. You do have to be given numbers.
What happens after 6pm? Most Brisbane service desks, ours included, run 8am to 6pm weekdays. After that it is usually phone support at an after-hours rate. Find out the rate before the night you need it.
Who actually does the work? Ask whether support is local, offshore, or a mix, and be honest with yourself about whether you mind. Plenty of good providers use offshore teams well. The problem is finding out afterwards.
What does leaving look like? Notice period, who owns the documentation, who owns the licences, and how long a handover takes. A provider comfortable with that question is usually comfortable because they rarely get asked it for the wrong reasons.
What onboarding should look like
Switching providers is the part everyone underestimates. A vague answer here is the strongest warning sign on this page.
A structured transition has phases you can name. Ours runs two weeks: discovery in days one to three, findings on days four and five, stabilising on days six to eight, then transition and documentation on days nine and ten. The shape matters more than the timeline. You want to hear discovery, then a written set of findings, then fixes, then handover, with someone accountable at each step.
If the answer is “we will just take over the logins”, the documentation you end up with will be whatever the last provider left behind.
Two things specific to running a business in Queensland
Privacy obligations are not only for big companies. The Privacy Act generally exempts businesses with annual turnover of $3 million or less, but there are carve outs, and health service providers are covered regardless of turnover. That includes medical practices, dentists, pharmacists, allied health and child care. If that is you, it changes what your provider needs to be doing.
Storms are a real continuity risk here, not a theoretical one. Power goes out, internet goes with it, and phone systems that run over the internet go quiet. Ask how calls divert when a site loses power, and get the answer before summer rather than during it.
The honest summary
There is no top ten. There are providers who are a good fit for how your business runs and providers who are not, and the difference usually shows up in the first month rather than in the proposal.
One step for today: ring whoever supports your IT now and ask them the five ASD questions. Their answer, and how long it takes to get one, will tell you most of what you need to know about whether to keep looking.
If you would like a second opinion on the setup you already have, get in touch. If what you have is working, we will say so.