Managed IT / MSP

Service description

Managed IT outsources a business's day-to-day technology to a provider, often called a managed service provider or MSP. The provider runs the help desk, monitors systems, applies updates and patches, manages devices and accounts, and handles vendors. The business pays a recurring fee for ongoing coverage instead of staffing IT in-house.

Common industries

Applies to any small or mid-size business without an in-house IT team.

ROI

Predictable monthly cost, better uptime, and coverage that's usually cheaper and more reliable than a small internal team.

Benefit

Outsource day-to-day IT — help desk, monitoring, patching, and management — to a provider instead of staffing it in-house.

Why get it

Systems that go unpatched or unmonitored fail and get breached. A provider keeps them updated and supported, so staff can work and the owner does not become the IT department.

When you benefit

Onboarding first, then continuous service under a recurring contract with a set term.

What it costs

Typically a monthly fee.

When you pay

Providers usually charge a monthly fee per user or per device, or a flat rate for a defined scope. Projects such as migrations, new hardware or office moves are often billed separately, and onboarding may carry a one-time fee.

Other costs

Software licenses and cloud subscriptions, hardware purchases and replacements, and any security tools or backups outside the base fee.

Risks to know

An MSP holds administrative access to the business's systems, so a breach of the provider can reach the business. Government cybersecurity agencies have warned that attackers target MSPs for this reason. Unclear scope can leave gaps nobody covers, and a provider that is hard to leave can lock the business in.

When risks arise

Access and scope problems often appear at onboarding or at the first incident. Lock-in and cost problems tend to show at renewal or when the business tries to switch providers.

The process

The provider inventories systems, fixes urgent issues and installs its monitoring tools. It then runs the help desk, patching and management on the agreed schedule. The business reviews reports and tickets, and the provider recommends upgrades and security improvements.

Your commitment

The business lists its systems, users and vendors and shares administrative credentials through the provider's secure process. It should agree on what the contract covers, response times and who approves changes, and keep its own copy of admin accounts and documentation.

Documents to gather

• Inventory of computers, servers and software
• List of users, vendors and licenses
• Network diagram and list of administrator accounts
• Current IT contracts and renewal dates

Helpful reading

• Protecting Against Cyber Threats to Managed Service Providers and their Customers — CISA, NSA, FBI and international partners
• Supply chain security guidance — National Cyber Security Centre (UK)
• Cybersecurity for Small Business — Federal Trade Commission
• Small Business Cybersecurity Corner — NIST