Managed IT services for small businesses means hiring an outside company to run, watch and secure your technology for a flat monthly fee, instead of calling someone when something breaks. The provider, often called an MSP, becomes your IT department. A typical agreement covers a help desk, remote monitoring and updates, security software, backups, setting up and removing user accounts, and planning for what to replace next.
Whether it's worth it depends less on the price and more on what's actually included. Two providers can both say "managed IT" and mean very different things. Get the inclusions and exclusions in writing, ask who watches security alerts at night, and ask when backups were last tested. For CPA firms, mortgage brokers, lenders and other firms under the FTC Safeguards Rule, much of the technical work the rule requires will land on this provider, though your firm stays responsible for compliance.
What managed IT is
The old model is break-fix. Something stops working, you call a tech, you pay by the hour. The tech has no reason to stop things from breaking, because breakage is the business.
Managed IT flips that. You pay a set amount each month, usually per user or per device, and the provider takes responsibility for keeping things running. Now problems cost them time, so they have a reason to prevent them.
For a firm with 5 to 100 staff, that usually means you don't need an IT person on payroll. Some larger firms keep one in-house person and hire a provider to back them up. That's often called co-managed IT.
| Break-fix | Managed IT | |
|---|---|---|
| How you pay | By the hour, when something breaks | A set monthly fee, usually per user or per device |
| Who works to prevent problems | Nobody is paid to | The provider, because problems cost them time |
| Updates and monitoring | Only when you ask | Ongoing, done remotely |
| Security | Whatever you set up yourself | Usually part of the package, though what's covered varies |
| Budgeting | Hard to predict | Mostly predictable, with hardware and projects often extra |
What managed IT includes
Every provider packages it differently, so get the list in writing. A typical managed IT agreement covers some or all of these.
Help desk. Staff can call, email or open a ticket when something's wrong. Check the hours, and whether after-hours help costs extra.
Monitoring and maintenance. The provider watches your computers and servers remotely, installs updates, and fixes problems before staff notice them.
Security. Security software on every device, email filtering, MFA setup and a firewall. This is where packages differ most. Ask whether someone is actually watching security alerts at night and on weekends, or whether the software just logs them.
Backups. Regular backups of your files and systems, with a copy kept somewhere ransomware can't reach. Ask when they last tested a restore.
User setup and removal. Accounts for new hires, and same-day removal when someone leaves.
Vendor wrangling. Dealing with your internet provider, phone system, printer company and software vendors so you don't have to.
Planning. Regular meetings to review what's aging out, what's at risk, and what to budget for next year. Sometimes called a virtual CIO.
Security testing and compliance help. Vulnerability scans, help with a risk assessment, staff training, and records you can show an auditor or insurer. Not every package includes this.
What it often doesn't include
Read the exclusions. These are the usual ones.
- New hardware and software licenses, which are often billed separately
- Projects, like an office move or a new server, often quoted on their own
- After-hours or on-site visits beyond a set number
- Help with line-of-business software the provider doesn't support
- Incident response after a breach, which may be billed hourly
None of that is a red flag on its own. It's only a problem if you find out after the fact.
Managed IT for financial firms
If you run a CPA or tax practice, mortgage brokerage, title company, lender, or a dealership that finances cars, your IT provider is doing more than keeping email up. The FTC Safeguards Rule requires a long list of controls, and most of the technical ones land on whoever runs your IT. MFA for anyone accessing your systems is one example (16 CFR 314.4(c)(5)). Encryption, access controls, logging, and regular testing or monitoring are others. Our FTC Safeguards Rule guide has the full list.
The rule also puts duties on you as the client. You have to oversee your service providers, including choosing ones that can keep data safe and requiring safeguards in their contracts. That includes your IT provider.
And it doesn't let you hand off the whole thing. The rule requires you to name a Qualified Individual to run your security program. That person can work for a provider, but your firm stays responsible for compliance. Many IT providers prefer that the Qualified Individual be someone at the firm, with the provider advising and doing the technical work.
Tax and accounting firms should also ask how a provider will help with the written security plan the IRS points them to. See our IRS WISP guide.
What to ask a managed IT provider
- What exactly is included, and what costs extra? Get it in writing, line by line.
- How fast do you respond, and how is that measured? Ask for their response targets for urgent and normal issues, and what happens if they miss them.
- Who watches security alerts at 2am on a Saturday? A name or a service, not "the system alerts us."
- How are backups done and tested? Ask for the date of the last restore test.
- Do you work with firms like mine? A provider that already serves tax practices or lenders will know your software and your rules.
- How do you help with the FTC Safeguards Rule? Ask what records they'll give you, like MFA status, patch reports and scan results.
- Who owns the admin passwords and accounts? You should. If you leave, you need to take everything with you.
- How long is the contract, and how do I leave? Ask about notice periods and what they'll hand over at the end.
- What does onboarding look like? A good provider starts by documenting everything you have.
Signs it isn't working
You're still the one chasing problems. Tickets sit for days. Nobody can tell you whether MFA is on everywhere. You've never had a planning meeting. Backups have never been tested. Your cyber insurance application asked questions your provider couldn't answer.
Businesses usually change providers at contract renewal, so know your renewal date. Start looking a few months before it, not the week it auto-renews.
Where to start
Find your current IT agreement and read what it actually covers. If you don't have one, or you're not sure what you're getting, our security check gives you a plain score and can match you with one IT company that works with firms like yours.