The estate, run properly

Usually not, and we will say so if that is the case. The common arrangement is co-managed: we take the repetitive load — tier-one tickets, patching, monitoring, out-of-hours — and your team keeps the work that needs institutional knowledge, like your line-of-business applications and internal projects. Full outsourcing makes sense for smaller organisations with no IT staff, or where an internal team is about to lose its only engineer.

It is normally priced per user or per device per month, with the range driven by how much of the estate we cover and what response times you need. What matters more than the headline rate is what is inside it: ask whether patching, backup testing, onboarding and offboarding, vendor escalation and out-of-hours cover are included or billed on top. We quote after the audit, because quoting before it means guessing.

Against agreed severity levels. A critical incident — a site down, a system unreachable for everyone — gets a response within the hour and continuous work until service is restored. Routine requests such as a password reset or new starter setup run to a same-day or next-day target. The exact numbers are in the service agreement, and we report performance against them every month rather than only when you ask.

No planned downtime. Onboarding is mostly discovery and instrumentation: we install monitoring agents, enrol devices, document the estate and take over vendor relationships, all of which happens alongside normal operation. Where a change does need a restart — a firmware update, a server patch that has been deferred for months — it goes in an agreed maintenance window. The first four to six weeks are the busiest, because that is when the deferred maintenance gets cleared.

In most cases yes, and we will be direct about the risk. Plenty of organisations depend on an application that only runs on an old operating system. We can isolate and support that, but we will also tell you what it exposes you to and what replacing it would involve. What we will not do is quietly keep an unsupported, internet-facing system patched-looking on a compliance report.

Yes, as a defined part of the agreement rather than best effort. That means a rota, an escalation path and a documented definition of what qualifies as out-of-hours critical. Organisations with genuine 24/7 operations get a different arrangement — and different pricing — from those who need a Saturday morning safety net.