Managed IT for companies too small for an IT department

What this actually solves

A company of thirty or forty people has real IT and no way to own it. The email, the laptops, the file shares, the licences and the Wi-Fi are all business-critical, but there is not enough work to justify a full-time hire and far too much to leave to whoever happens to be good with computers. So it drifts. Nobody knows how many licences are being paid for. Two people share a login. A laptop leaves with someone and nobody asks for it back. It works until the morning email stops, and then the whole company sits still.

The second driver is newer and increasingly the one that starts the conversation. Your own customers have begun asking security questions as a condition of doing business — are devices encrypted, is access reviewed, how fast are security updates applied, when was a backup last restored. A small company without managed IT cannot answer those questions honestly, and losing a contract over an unanswerable questionnaire costs considerably more than the retainer would have.

Underneath both is a mechanism worth stating plainly. Software that was never updated and accounts that were never closed are doors left standing open — nobody has to force them, and nothing clever is required to walk through. That is why the unglamorous parts of this service — the patching schedule and the leaver checklist — are the parts that actually protect you.

How the work runs

1. Audit the estate before promising anything. How many devices and what condition they are in, which accounts exist and who owns them, what software is licensed, what is running that nobody approved, and what is out of support. Almost every audit finds licences being paid for by nobody and at least one account belonging to a person who left. One to two weeks.
2. Documentation. The asset register, the account inventory, the network layout, the supplier and licence records, and the recovery notes. This is the most valuable thing in the engagement and the thing most providers keep badly, because it is invisible until the day someone else has to use it. One to two weeks, then maintained continuously.
3. Remote monitoring and device management. Tooling so every machine is visible without walking to it — health, updates and alerts through a monitoring agent, and policy through device management so encryption, screen locks, password rules and remote wipe are enforced rather than requested. One to two weeks.
4. Backup, and a restore that is actually performed. Deciding what is backed up, how long it is kept and where the second copy lives is the easy half. The half that counts is restoring something on a schedule and writing down that it worked. Three to five days to set up, then tested on a recurring cycle.
5. Joiner and leaver checklists with owners and clocks. Every step named, every step assigned to HR, IT or the manager, and every step timed — which access closes within the hour and which within a day. Leaver processing is the most neglected task in small company IT and the most dangerous; a departed employee's mailbox staying open for months is entirely normal and entirely avoidable. Three to five days.
6. Patching policy and the daily queue. Update timeframes by risk class, an emergency path for the ones that cannot wait, and the ordinary helpdesk running underneath it all, with a monthly report written for an owner rather than an engineer. Ongoing.

What moves the price

The range is $500–$8,000/mo, ongoing, and it is usually structured per user per month.

Whether anyone has to be physically present. Remote-only is the cheapest arrangement that exists here. The moment the agreement includes attendance — a scheduled visit, a new office, a failed machine — you are buying a person's travel and a block of their day, and that is priced as its own line.

The size and age of the estate. Forty modern laptops on one platform with cloud identity is a straightforward month. The same headcount spread across mixed hardware, an ageing on-premise server and three generations of operating system is a different job: nothing can be done once and applied to everything, so each platform, each generation and the server are all handled separately.

Where the scope boundary sits. Every excluded item you agree to include has a cost, and legacy systems are the expensive ones. A single unsupported server inside the boundary can absorb more attention than the rest of the company combined, which is why it belongs in the agreement explicitly, one way or the other.

What usually goes wrong

The scope says all IT support. Three words that make a provider responsible for the ancient server nobody dares restart, the owner's home printer and the machine in the warehouse running software discontinued a decade ago. In this service the excluded list is more important than the included one, and it should be the longer of the two. If a proposal does not contain one, that is the finding.

Backups are configured and never restored. Green ticks in a console are not evidence. Backups fail silently in ordinary ways — a new folder that was never added to the job, a database that needs quiescing to be captured consistently, a retention setting that quietly rolled off the version you needed. Restoring on a schedule is the only method that proves anything, and it takes an hour.

Leavers are treated as paperwork rather than a clock. The manager tells HR, HR tells IT eventually, and in the meantime an active account with a working password sits outside the building. Everything that person had access to has to close on a defined timetable, and the device has to come back, or the leaver checklist is decoration. It is the single most common gap found in a first audit and the fastest one to close.