Managed IT is sold as support and bought as peace of mind, which leaves a gap where the detail should be. The detail is a list, and the list belongs in your agreement. Here is what sits on it, why each item is there, and the questions that tell you whether a provider is doing the work or describing it.
Start with the inventory, because everything else depends on it
The claim worth defending: managed IT is an inventory problem before it is a security problem. You cannot patch a laptop nobody recorded, disable an account nobody listed, or restore a system nobody knew was running. Every failure that follows in this article traces back to something absent from a list.
A working inventory covers devices, the people they belong to, the operating system each one runs, the software installed on it, the cloud services in use, the accounts inside those services, the domains, the licences and their renewal dates. It is maintained continuously. A provider who produces one in the first month, keeps it current, and shows it to you on request has already earned a good part of the fee.
Updates, patching and end of life
Security update management is one of the five technical controls in the government-backed Cyber Essentials scheme, alongside firewalls, secure configuration, user access control and malware protection. In practice it means operating system updates, application updates, firmware where it matters, and a record of what was applied and when.
The harder half is end of life. Microsoft's support notice records that Windows 10 support ended on 14 October 2025, which turned every remaining Windows 10 machine into a planning question. Devices reach that point on a schedule that is published years ahead, so a managed IT agreement should include a rolling view of which machines fall out of support and when. Finding out from a headline is the expensive route.
Identity and access
User access control is another of the five controls, and it is the one most affected by staff turnover. Each person gets their own account, with the permissions the role needs and no more. Administrator rights sit on separate accounts and are used deliberately. Multi-factor authentication is on. Leavers are removed on their last day, everywhere, including the services nobody remembers buying.
The government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026 by the Department for Science, Innovation and Technology and the Home Office, found that 73 per cent of businesses restrict administrator rights. That leaves a substantial minority where everyday accounts can install anything, which is exactly the condition ordinary malware relies on.
Backup and recovery
Backing up your data is the first of the five steps in the NCSC's small organisations guide, and the guide is explicit that backups should be tested so you know they can be restored. A backup becomes a control on the day someone restores from it.
Cloud services need this stated plainly, because the assumption runs the other way. Microsoft's documented shared responsibility model divides the work: Microsoft runs the physical infrastructure, the network and the platform, while the customer stays responsible for its own accounts, access controls and endpoints.
Retention settings and recycle bins are useful, and each one has a configured duration, so find out what yours are set to. If your agreement is silent about backing up your Microsoft 365 or Google Workspace tenant, it is silent about your email, your files and your shared drives. Ask for the tenant backup to be named in writing, with the restore test that proves it.
The survey found 74 per cent of businesses back up data to the cloud and 48 per cent use other means. The number that matters in your own business is smaller and more specific: when was the last restore test, and what did it prove?
Protection on the devices
Malware protection and firewalls are the remaining two of the five Cyber Essentials controls, and they are widely deployed already. The survey reports 81 per cent of businesses with up-to-date malware protection and 74 per cent with network firewalls. Deployment is the easy part. The managed part is the configuration: that protection is actually running on every device in the inventory, that alerts reach a person, and that a device which drops off the reporting for a fortnight is chased.
Secure configuration completes the set. Default passwords changed, unnecessary accounts disabled, unused software removed. It is unglamorous and it is where a large share of real incidents are stopped.
Monitoring, and what happens at three in the morning
Monitoring is only worth what the response behind it is worth. Ask who receives an alert, what they are authorised to do, and how you are told.
The same survey found that 43 per cent of UK businesses identified a cyber security breach or attack in the previous 12 months, rising to 46 per cent of small businesses, with phishing the most common and most disruptive type at 38 per cent of businesses.
It also found that 25 per cent of businesses have a formal incident response plan, which leaves three quarters with no formal incident response plan while two in five met an attack in the year measured. Producing that plan, and rehearsing it once a year, is reasonable to expect from a managed provider, and it belongs in the agreement.
The people part
Phishing is a people problem with technical controls around it. Avoiding phishing attacks is the fifth step in the NCSC's small organisations guide, alongside protecting against malware, keeping smartphones and tablets safe, and using passwords well. A managed agreement can include short, regular awareness sessions, a reporting route that takes ten seconds to use, and a rule that reporting a mistake early is always the right move.
Onboarding and offboarding belong here too. A new starter needs a device, accounts and access on day one. A leaver needs all three removed on the last day. Both are checklists, both are boring, and both are where small businesses lose control of their own systems.
There is a supply chain dimension the same survey measures. Only 15 per cent of businesses reviewed the cyber security risks posed by their immediate suppliers, and 6 per cent looked at the wider supply chain. Your IT provider holds administrative access to almost everything you own, which makes it the supplier most worth reviewing. Ask how it protects its own accounts and tools.
Procurement and lifecycle
Somebody has to decide what to buy, when to replace it and what to do with the old one. A managed provider that handles procurement should give you a replacement schedule, a standard build for new machines, and a disposal route that wipes data properly. Ask about the disposal route specifically. It is the step most often skipped.
Licences belong in the same conversation. Subscriptions renew quietly, seats stay assigned to people who left, and duplicate products creep in when two departments solve the same problem separately. A licence review once a quarter, run against the inventory, usually pays for a meaningful slice of the agreement itself.
What the first ninety days should produce
A new managed IT relationship has a natural shape, and you can hold a provider to it without knowing anything technical.
Month one is discovery and documentation: the inventory built, the accounts enumerated, the licences counted, the network diagrammed, the obvious gaps written down with a priority against each. You should receive that document. It is the single most useful artefact the relationship will ever produce, and it is also the thing you take with you if you change provider.
Month two is remediation of the cheap and urgent: multi-factor authentication switched on everywhere it is missing, dormant accounts closed, administrator rights separated, unsupported devices identified, backups configured and a first restore test performed.
Month three is routine: patching running on a cadence, monitoring reporting to a person, a monthly summary you can read in five minutes, and a plan with dates for the work that costs money. By the end of it you should be able to answer three questions without asking anyone: how many devices do we have, where does our data live, and how quickly could we get it back.
What usually sits outside the agreement
Be clear about the boundary. Line-of-business applications are often supported by their own vendor, not your IT provider. Telephony, connectivity and printers vary by contract. Bespoke software has its own support arrangement. Certification audits such as Cyber Essentials assessments are usually a separate piece of work, as are major projects: an office move, a migration, a new site.
All of that is fine when it is written down. It becomes a problem on the morning something breaks and two suppliers each describe it as the other's responsibility.
How to read a proposal
Ask for the inventory method, the patching cadence, the backup and restore-test routine, the offboarding checklist and the response targets, all in writing. Ask which of the five Cyber Essentials controls the provider maintains and which stay with you. Ask what is excluded. Then ask for the reporting: what you will see each month, and whether you can see the inventory yourself.
Where we fit
Our IT Managed Services cover the everyday running of the systems a business depends on, with the inventory, the updates, the access and the backups treated as the core of the work. If you are holding a proposal and cannot tell which of the items above it includes, that is the conversation to have first.