Many small and medium-sized companies have no IT department of their own, or only a few people who look after IT alongside other tasks. At the same time, the ongoing workload is growing: updates, backups, security alerts, user accounts and cloud services need regular attention, not only when something fails. Managed IT, often also called managed services, transfers such recurring tasks in whole or in part to an external service provider, a so-called managed service provider (MSP).
The difference from on-call support lies in the approach. Instead of being called only when there is a fault and billed by effort, the service provider takes ongoing responsibility for agreed services and works preventively.
How does managed IT work?
The basis is a contract that describes the scope of services: which systems are supported, which tasks are included, who is responsible for what and which service hours and response targets apply. These targets are often set out in a service level agreement.
In day-to-day work, the service provider uses central tools. IT monitoring reports faults and bottlenecks, management tools distribute updates and settings, and a ticketing system documents requests and incidents. Regular reports show what has been done and where action is needed. Often some of the tasks remain within the company, for example a contact person on site. This split is also called co-managed IT.
What managed IT is used for
Typical service components are:
- monitoring servers, network and endpoints,
- patch management for operating systems and applications,
- backup, including checking backup jobs and restore tests,
- security controls such as endpoint protection and the evaluation of alerts,
- a service desk for employee requests,
- user management, for example when employees join and leave.
What companies should keep in mind
- Clarify the scope of services in writing: What is included, and what is commissioned separately? Unclear boundaries lead to misunderstandings, especially in an emergency.
- Explicitly agree on service hours and response targets: Availability, escalation paths and deputies should be defined instead of being tacitly assumed.
- Do not hand over responsibility completely: Responsibility for information security and data protection cannot be fully outsourced. If the service provider has access to personal data, a data processing agreement (DPA) is usually required.
- Secure documentation and access: IT documentation and administrative access should be available to the company at all times, including when changing service providers.
- Demand transparency: Traceable tickets and regular reports make visible whether the agreed services are being delivered.
How TOMORIS relates
At TOMORIS, GRID bundles networked IT operations with building blocks for monitoring, backup, security and updates. Service hours and response targets are explicitly agreed.
View networked IT operations with GRID