Managed IT services mean a company looks after your computers, network, accounts and security for a monthly fee, instead of waiting for something to break. For a small business with no in-house IT, it replaces the colleague who happens to know about computers with a team, a contract and a response time. The skill in buying it is working out exactly what the contract covers.
Break/fix or managed
| Model | How you pay | Suits | Weakness |
|---|---|---|---|
| Break/fix | By the hour or per call-out | Very small firms with few devices | Nobody is watching your systems, and costs spike during an incident |
| Managed service | A monthly fee per user or per device | Firms that rely on IT every day | You need to be clear about what is included |
| Co-managed | A provider supports your own IT person | Firms with some in-house IT | Roles must be clearly divided |
What IT support for small business usually includes
- A helpdesk with stated response targets
- Patching and updates for devices and software
- Protection and monitoring, such as endpoint protection, with someone watching the alerts
- Backup management, including restore tests
- Starting and leaving staff, with accounts created and removed on time
- Administration of Microsoft 365 or Google Workspace
- Network, Wi-Fi and firewall support
- Dealing with suppliers, such as your broadband provider and line-of-business software vendors
- Regular reviews and reports
How outsourced IT support is priced
Providers usually charge per user per month, per device per month, or in tiered bundles. Compare what each price leaves out: projects such as migrations, new hardware, out-of-hours support and on-site visits are often extra. Check the minimum term, the notice period and what happens to the price at renewal.
What to ask a managed service provider UK businesses use
- What are the response and resolution times in the service level agreement, and which hours do they cover?
- Who will have administrator access to our systems, and how is it protected, for example with multi-factor authentication and separate admin accounts?
- Which security accreditations do you hold? Ask to see the certificate for Cyber Essentials, or Cyber Essentials Plus, and ISO 27001 if they claim it.
- Is there a written data processing contract? UK GDPR requires one when a provider handles personal data for you, and it should say where data is stored.
- What is backed up, how often, and when did you last test a restore?
- If we leave, who owns the licences, the domain and the admin credentials, and will you help with the handover?
- Can we speak to a customer of a similar size?
Your provider will have powerful access to your systems, so treat its security like your own. Our guides to business security solutions, cloud backup software and cyber liability insurance cover the controls an IT provider should be handling with you.
Red flags
- No written service level agreement
- Unclear ownership of licences, domains or admin accounts
- Shared administrator passwords
- Unlimited support with no scope
- A long lock-in with no help when you leave
- Reluctance to show accreditations or documentation
What should happen in the first 30 days
- Take an inventory of devices, users, software licences, cloud services, your domain and admin accounts.
- Document access. Admin credentials should be stored securely, and you should know who holds them.
- Set a security baseline, with multi-factor authentication switched on, devices updated, and protection installed and monitored.
- Check the backups. Confirm what is backed up and run a test restore.
- Agree the support routes, including how to raise a request, how it is escalated and who to call out of hours.
- Hold a first review that walks through the findings and a short list of priorities.
Is a managed service worth it at your size?
It tends to pay for itself when you depend on IT every day, when downtime would cost more than the monthly fee, or when customers and contracts ask for security assurances such as Cyber Essentials. A very small business with a handful of cloud-based tools may manage with a good break/fix provider and clear instructions. Ask each provider to describe what they would do differently for your business, rather than accepting a standard package.
Common questions
Do I still need someone in-house? Often not at small sizes, but someone should own the relationship with the provider, approve changes and know who has access to what.
How long is the contract? Terms vary. Ask for the minimum term and the notice period, and check what happens to your data, licences and documentation if you leave.
Will they fix everything? The contract defines what is included, so read the exclusions, such as projects, hardware and support for third-party software.