What Is Included in Managed IT Services?

At minimum, a managed IT services agreement covers every computer the company owns, the network edge, the email platform, the people who join and leave, security monitoring, and support for everyone. In our 2024 guide to IT support companies we put it this way: "A good MSP will provide network security and minimal service calls, all while actively catching problems before they occur."

At NRVPC, the minimum managed scope for every client is six items:

• All company-owned computers. Desktops, laptops, servers, and the network gear that connects them. Every one is enrolled in 24/7 monitoring with an 8-minute average issue detection.
• The firewall. We manage Sophos, SonicWall, or UniFi at every site, with documented rules.
• The email and productivity platform. Microsoft 365, Google Workspace, or a local domain, including accounts, groups, mail flow, and MFA.
• User onboarding and offboarding. Submit our onboarding or offboarding form and the accounts and access are set up or removed within an hour. New hires' computers can be preconfigured and shipped ready to use; the hardware and shipping are billed separately.
• Network security monitoring and response. Alerts from the firewall, endpoints, and identity platform go to an engineer who acts on them.
• Unlimited help desk. Every employee can call, email, or request remote support as often as they need, with direct access to a certified engineer.

That is the floor. If you are still deciding between an MSP, in-house IT, and a contractor, start with what is a managed service provider and in-house IT vs MSP vs IT contractor. The managed IT services page describes how the six items fit together, and the remote IT monitoring page covers the monitoring layer.

Nine security standards come with the service, and every NRVPC client keeps all nine. Here is each standard and the tool or practice behind it:

1. MFA on all email and VPN. Enforced in Microsoft 365 or Google Workspace and on the firewall VPN.
2. Documented firewall rules. Every rule on the Sophos, SonicWall, or UniFi firewall is written down, reviewed, and owned.
3. Managed endpoint security on every computer. Next-generation security software (Bitdefender), monitored by our team.
4. Encryption on all devices holding sensitive data. Every computer and server that holds it is encrypted, whichever platform it runs on.
5. Least privilege. Staff hold the access their role needs, and administrator rights stay with administrators.
6. No end-of-life equipment or operating systems. When a vendor stops patching something, it leaves the network.
7. All servers under warranty, with a 3-year minimum on new devices. Dell and HP hardware is bought with the warranty that matches its planned life.
8. Quarterly security audits. We review the standards above every quarter and report the results at your business review.
9. Employee security awareness training. Cybersecurity training for your team, plus quarterly phishing awareness campaigns, so they learn to spot the messages that get past filters.

The network security management page covers how monitoring and response work across these standards. For healthcare practices, these nine standards are the technical controls behind HIPAA. For law firms, they support attorney-client confidentiality. For nonprofits, they satisfy the security clauses in grant and donor agreements.

If you want the whole list in one sentence, we wrote it for real estate agents in our wire-fraud guide: "They will keep your devices, security software, and email accounts safe." That sentence is the scope of a managed IT agreement, in plain English.

The monthly fee covers keeping your technology running and supporting the people who use it. Work that adds, moves or changes what you have is an Additional Service, quoted separately. These services aren't excluded: NRVPC does this work regularly. If you're unsure which side something falls on, ask us before the work begins. We'll tell you, and put a number in writing first.

• Projects and change requests. Server builds and migrations, network redesigns, tenant migrations, platform changes, and any work that needs planning, scheduling or a statement of work. Work of 8 hours or more, or multiple engineers, is a project.
• New equipment and deployments. On-site hardware rollouts, and setting up newly bought servers, printers, scanners, phones or network equipment. The hardware itself is billed at cost plus 15%, which covers scoping research, ordering and returns.
• Adds, moves and changes. Onboarding or offboarding requests not sent through our forms, new or restructured mailboxes and distribution groups, new printers or phone extensions, call-flow and queue changes, and moving equipment or staff.
• New sites and office moves. Opening, moving, closing or building out an office, including cabling, carrier coordination and on-site setup.
• New applications and services. Buying, setting up, connecting or renewing software, certificates and outside services that aren't listed in your agreement.
• Advisory and compliance work. Security questionnaires, audits, penetration tests, vendor security assessments and compliance attestations.
• Unsupported systems. Personal or unmanaged devices, equipment past its manufacturer's support, and applications that aren't on your supported list.
• Third-party vendors. Extended coordination with your software vendors, carriers or equipment suppliers on matters outside the systems NRVPC manages.

No approval, no work, no invoice. Additional work is billed by the hour unless we quote a fixed price for it, and it appears on your monthly invoice. Requests that take less than 15 minutes are absorbed in your monthly fee: we don't invoice for small favors. Projects get a statement of work with a set timeline and price, so the monthly number holds. In an emergency, work can start on your spoken approval, confirmed in writing afterwards, and fixes for critical vulnerabilities (CVSS 9.0 or higher) are always pre-authorized.

Two billing lines complete the picture. Microsoft 365 Business Premium or Google Workspace licenses are included in the monthly fee, along with the licenses for the twelve services above. Hardware NRVPC buys for you is billed at cost plus a 15% markup, which covers scoping research, ordering and returns.

Third-party vendor systems are the tools your industry runs on: an EHR, an X-ray or EKG system, a case management platform, a donor database. In our 2024 post on choosing an IT contractor, now expanded in in-house IT vs MSP vs IT contractor, we wrote: "If you want your business to run on a specific set of provided tools, an MSP is your best bet. However, if you have multiple systems that can't be automated and you need help administering them, hire in-house or get an IT contractor." At NRVPC the flat fee covers the devices, network, and logins those systems depend on; each vendor owns its platform, and NRVPC coordinates with the vendor, opening the ticket and staying on the call. Longer coordination on matters outside the systems NRVPC manages is an Additional Service.

Five pieces of strategic work are included in the monthly fee: a quarterly CIO and IT management meeting with your leadership, monthly executive reports, a 3-year technology roadmap, hardware refresh budgeting, and independent vendor evaluation.

It starts with onboarding, which takes 30 days at NRVPC: every computer comes up to the security baseline, your environment is documented, and your team is introduced to the help desk.

At NRVPC, the quarterly meeting is a sit-down with a C-level owner or executive. We report the quarter's numbers, which across our client base run at 95%+ issue-free operation and 99.99% uptime, review the security audit, and update the roadmap. The roadmap shows which servers, firewalls, and laptops reach the end of their warranty in each of the next three years, so refresh spending is planned. When you are weighing a purchase, we evaluate the options as your engineer. The IT consulting page describes the roadmap process in detail.

Check another provider's scope list by asking whether it names the same six minimum items, the same nine security standards, and the same exclusions, in writing. A scope list that says "unlimited support" but caps hours, or "security" without naming the endpoint tool, is not the same service at a different price.

In our 2024 guide we gave a five-point test that still works as the closing check for any proposal:

1. Do they keep all your systems patched and keep an eye on the news for security threats?
2. Do they prevent issues and respond swiftly when problems arise?
3. Do they maintain and test your backups?
4. Do they deliver quality customer interactions, with a person your team can reach?
5. Do they understand your systems and support your organization's growth?

Then add three questions this guide raises. Which firewall, endpoint security, and email platform will you manage for us, by name? What is your written threshold for a project? Which of our line-of-business systems do you own, and which do you coordinate? Our how to choose an MSP checklist carries our answers.