Guide · IT management
Managed IT for SMEs: what outsourced IT management covers and what to ask
Outsourced IT management, also called managed IT services, means that an outside provider takes responsibility for running part or all of a company's IT for a recurring fee: user support, workstations, servers, network, back-ups, updates and security. For an SME it replaces or supports an in-house IT person. The contract should state exactly what is covered, how fast the provider responds, who holds the passwords and the documentation, and how you can leave.
What does managed IT cover?
- Support. A helpdesk for users, by phone, by email, remotely and on site.
- Workstations and accounts. Set-up, updates, mailboxes, licences, and the arrival and departure of staff.
- Servers and cloud services. Updates, monitoring and capacity.
- Network. Firewall, switches, Wi-Fi and remote access.
- Back-ups. A daily check, a copy in a second location, and restore tests.
- Security. Patches, protection on each device, access rights, and action when something happens.
- Suppliers. One contact towards the telecom operator and the software vendors.
Not every contract includes all of this. Some cover monitoring only, and projects such as a move or a new server are usually quoted separately.
When does outsourcing make sense?
- IT is done on the side by someone who has another job.
- One person holds all the knowledge, and nothing is written down.
- Nobody can say when a back-up was last restored as a test.
- An insurer, a customer or an auditor asks for proof of your security measures.
- The company is growing or opening a second site.
A combination also works: an internal person for daily questions, and a provider for servers, network, security and cover during absence.
What should the contract state?
- Scope. A list of the equipment and services covered, what is excluded, and how work outside the scope is charged.
- Times. Response and resolution times per priority, and the hours of service. A response time is not a resolution time.
- Back-ups. What is saved, how often, where, for how long, and how often a restore is tested.
- Access. The administrator accounts are yours, with the passwords kept where you can reach them.
- Documentation. It belongs to you and is kept up to date.
- Reporting. What you receive, and how often.
- Data. Where it is kept, and a data processing agreement where personal data is involved.
- Exit. The notice period, and the handover of access and documentation to a successor.
What do you ask a provider before signing?
- How do you start: with an inventory, or with a price?
- Who answers when we call, and does that person know our set-up?
- What happens outside office hours?
- Can we see a sample of your report?
- If ransomware hits us, who does what in the first hour?
- Which tools do you install on our machines, and what happens to them when the contract ends?
- What do you not do?
How we approach it
We begin by taking stock of what you run and who depends on it, and by checking the back-ups and updates, so that we know what we are responsible for before we change anything. What we manage and report on is described under servers and hosting. For the network side, a network audit is the usual first step.
Frequently asked questions
Do we lose control when we outsource our IT?
Not if the contract is right. The administrator accounts, the documentation and the data remain yours, and the provider reports on what was done. Control is lost when one party, inside or outside, holds knowledge that is written down nowhere.
Do we still need someone in-house?
You need a contact person, not necessarily a technician. Someone has to set priorities, approve changes and costs, and tell the provider when staff arrive or leave. In a small company that is often the manager or the office manager.
A fixed monthly fee, or payment per intervention?
A fixed fee gives the provider a reason to prevent problems, because each incident costs them time. Payment per intervention looks cheaper while nothing goes wrong, but it usually means nobody does the updates, the monitoring and the restore tests. Many contracts combine a fixed fee for management with a separate rate for projects.
How does a change of provider work?
The outgoing provider hands over the inventory, the documentation and every administrator account, ideally with a period in which both are available. The new provider should document what it finds and check the back-ups before changing anything. An exit clause in the old contract makes this far easier.
Let's talk about your project.
Tell us where you are and where you want to be. We'll come back within one working day with a first view. A person reads your message and answers it.