What good IT support actually looks like for an SME

IT support is one of those services you barely notice when it is working and feel acutely when it is not. For most businesses under 100 people, the choice is between a managed service provider (MSP) on a monthly contract and a break-fix arrangement where you call someone only when something goes wrong. The difference matters more than most people realise.

Break-fix vs managed service: get this right first

Break-fix is cheaper in months when nothing breaks, but that is an illusion. When your server goes down at 8am on a Monday, a break-fix provider has no contractual obligation to respond quickly. An MSP does, because your uptime is built into the contract. For any business where a few hours of downtime costs more than a monthly IT contract, managed service is the right model.

What a good MSP contract should include

• A defined response time SLA: typically 1 hour for critical issues, 4 hours for significant issues, next business day for low-priority
• Proactive monitoring: they should know your server is struggling before you do
• Patch management and updates handled on your behalf
• Cyber security essentials: antivirus, endpoint protection, email filtering
• Microsoft 365 or Google Workspace management included
• A named account manager, not just a generic helpdesk

Questions worth asking before you sign

1. 1What is your average response time to a Priority 1 (total outage) call, and can you show me data from the last 90 days?
2. 2What percentage of your revenue comes from our sector, and do you have reference clients we can call?
3. 3What happens if you are at capacity and we have a critical issue? Who covers?
4. 4Do you carry cyber liability insurance, and can I see the policy summary?
5. 5How do you handle a ransomware attack? Walk me through the last one you dealt with.

Cyber security: no longer optional

Any IT support provider you consider should be able to help you achieve Cyber Essentials certification as a baseline. This is a UK government-backed scheme and many commercial contracts now require it. If a provider cannot explain Cyber Essentials, does not recommend it, or treats it as optional, they are not taking security seriously enough for a business in 2026.

What to expect to pay

For a 10-person business on a fully managed service: £300-600 per month is a reasonable range in East Anglia. For 25 people: £700-1,500 per month. These figures include monitoring, helpdesk, patch management, and basic cyber security. Anything significantly below this range should be scrutinised carefully: there is usually a reason.