Managed IT services means paying a provider a regular fee to look after your technology, instead of ringing someone when it breaks and paying by the hour to fix it.
That sentence is where the agreement between providers ends. What sits inside the fee varies enormously, and two quotes that look similar on the front page can describe very different arrangements. Here is what the term covers, what managed security should include, and the questions worth asking before you sign anything.
What managed IT services usually include
Most agreements are built from the same components, in different combinations:
- Service desk. Somewhere your staff can ring or email when something is wrong, with published hours.
- Device management and patching. Keeping workstations, servers and mobile devices updated and configured to a known standard.
- Monitoring. Watching systems so faults surface before someone reports them.
- Backup and recovery. Running backups, and more importantly testing that restores work.
- Identity and access. Accounts, groups, permissions, multi-factor authentication, and removing access when people leave.
- Security controls. Email protection, endpoint protection, application control, awareness training.
- Vendor coordination. Dealing with your internet provider, your software vendors and your hardware suppliers so your staff don’t have to.
- Advice. Someone who knows your environment telling you what to spend money on next, and what to leave alone.
To give a sense of scale, our service desk handled 2,034 tickets across 206 businesses in the year to August, averaging about 23 minutes each. Most managed IT work is small, frequent and unremarkable. That is what good looks like.
What is usually not included
Ask about each of these specifically, because the answer differs between providers and it is where the unexpected invoices come from:
- Projects and migrations
- Hardware and software purchases
- Onsite visits and travel time
- After-hours work
- Third party software licences
- Cabling and physical works
None of these should be included by default, and a provider excluding them is not being difficult. What matters is that you know which list each one sits on before you need it.
What managed IT security should cover
This is where quotes diverge most, and where “included” can mean anything from a full control set to an antivirus licence.
Start from the Essential Eight, the Australian Signals Directorate’s baseline. Its eight controls are application control, patching applications, restricting Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.
Every one of those is something a managed provider can own. So ask which of the eight are inside the fee, which maturity level you will be at, and how it gets measured. A provider who has not read the maturity model will give a vague answer to a very specific question.
Two more worth adding, because they cause real losses:
Email and payment fraud controls. Advanced email protection, plus a written rule that bank detail changes get verified by phone on a number you already had.
Security awareness training that runs continuously rather than once at induction.
And understand what stays yours regardless of who you hire. Microsoft’s shared responsibility model lists four things that remain the customer’s responsibility in every cloud model: your data, your endpoints, your accounts, and access management. A provider can operate those controls for you. They cannot make them someone else’s problem.
If you do one thing, do multi-factor authentication. ASD calls it one of the most effective ways to protect accounts against unauthorised access, and it is the control that most often turns a serious incident into a non-event.
The questions to ask before you sign
1. What exactly is in the fee, and what is billed on top? Ask for the exclusions list in writing. A provider who cannot produce one has not thought it through, or is hoping you won’t ask twice.
2. What are your response and resolution targets? These should be published per priority, not as a single number. Ours run from 15 minutes response and four hours resolution when a business is stopped, through an hour and eight business hours for major disruption, four business hours and two business days where there is a workaround or a single user affected, to one business day for requests and changes.
3. What are your support hours, and what happens outside them? Ours is 8am to 6pm Monday to Friday, with after-hours support by phone at the after-hours rate. Round the clock coverage is possible and it costs more. Decide honestly whether your business needs it or just likes the sound of it.
4. How do you handle security, specifically? See the section above. Listen for the Essential Eight, for backup testing rather than backup running, and for what happens in the first hour of an incident.
5. What does onboarding look like? A provider who does this regularly can describe it day by day. Ours is two weeks: discovery in days one to three, findings on days four and five, stabilising in days six to eight, then transition and documentation. If the answer is “we’ll get you sorted”, ask again.
6. Who owns our accounts, licences and documentation? Your tenant, your domain, your licences and your documentation should be in your name, with your own administrator account you keep. This is the question that decides whether leaving is straightforward or a hostage negotiation.
7. What happens if we leave? Ask for the offboarding process before you sign. Notice period, what gets handed over, in what format, and whether it is billable.
8. Can we see how you report? Ask for a sample monthly report. You should be able to see ticket volumes, what was patched, whether backups were tested, and what is being recommended next. Reporting that only shows green ticks is not reporting.
9. Who are we actually dealing with? In a small provider, the person in the meeting is the person who does the work. In a larger one, ask who your account contact is and who staffs the desk.
10. What accreditations do you hold? Certifications are not proof of good service, but they are proof that someone external checked. We are SMB1001 Gold certified and a Microsoft Partner. Ask what a provider holds and what it required of them.
The thing people forget to ask about
Strategy. A provider who only closes tickets will keep your business exactly where it is.
Ask whether you get a regular review, who attends it, and whether it produces a written plan with costs attached. A budget for the next twelve months, a view on what is ageing out, and an honest answer about what you don’t need to spend money on yet is worth more over a few years than a faster response time.
Start here: take question one and question seven to whoever you are considering, and ask for both answers in writing. How readily they arrive tells you most of what you need to know.
If you’d like a second opinion on a proposal you are holding, get in touch.