You have two or three IT support packages on the desk and none of them line up. One is priced per user, one per device, one comes in named tiers and one has a page of exclusions in small print. Business IT support packages come in so many shapes that the cheaper quote is not always the cheaper deal. This guide covers what every package should include, how tiers and plans differ by content, the common extras, and a line by line checklist for comparing two quotes. There are no prices in it on purpose: scope comes first. For typical UK prices and what drives them, see our guide to how much managed IT support costs.
What every IT support package should include
Whatever a provider calls its plans, these are the essentials. If a quote leaves one out, ask why.
- A helpdesk you can reach. Phone and email, with every request logged as a ticket you can see.
- 24/7 monitoring, and clarity on who acts. Software watches devices, servers and backups around the clock. Ask when a person looks at an alert.
- Patching and updates. Operating systems and common business software kept current on a schedule the provider can show you.
- Malware protection on every device. Installed, updated and checked centrally.
- Backup with tested restores. Microsoft 365 or Google Workspace data, plus any servers. Microsoft's shared responsibility guidance says "you own your data and identities", so the platform staying up is not the same as your data being backed up. The NCSC's Small organisations guide to cyber security adds that once you have a backup, "it's important you know how to restore it".
- User and access management. Joiners, leavers and permissions handled properly, with multi factor authentication (MFA) switched on.
- Network and firewall management. Router and firewall configured, updated and reviewed.
- Documentation you can see. A record of your systems and accounts that belongs to you.
- A named point of contact for reviews. Someone who looks at the whole picture with you regularly, not only when something breaks.
Four of those line up with the five technical controls of the NCSC's Cyber Essentials scheme: firewalls, secure configuration, security update management, user access control and malware protection. That makes the Cyber Essentials controls a good test of a basic package: if a quote leaves all five to you, you are buying a helpdesk, not security. The bar has risen, too. Under version 3.3 of the requirements, used for assessments from late April 2026, failing to use MFA on cloud services is now an automatic fail, and high risk or critical updates must be installed within 14 days of release.
How IT support tiers and plans differ
Tier names vary by provider. Bronze, Silver and Gold is the label most people meet, and our contracts guide explains the contract models behind the tier names. Here, what matters is what sits inside. Most IT support plans take one of three shapes.
Helpdesk only
You call or email when something goes wrong and an engineer fixes it remotely, with little or no monitoring, patching or security management in between. It can suit a very small team with a simple setup. The risk is that nobody is watching: a failed update, a stopped backup or a leaver's open account only comes to light when it causes a problem.
Monitored and maintained
This adds monitoring, patching, malware protection and backup checks, so more problems are caught before you notice them. Look at what it leaves out: security tooling beyond antivirus, Microsoft 365 administration, on site work and planning are often outside it. Machines stay healthy, but decisions about your systems stay with you.
Fully managed
The provider takes on the whole job: helpdesk, monitoring, patching, security controls, backup, Microsoft 365 administration, planning and reviews, with on site work when needed. One team is accountable for your IT. If you are still weighing up break fix or fully managed, start there. For our own service, see exactly what our fully managed service includes.
These are typical market shapes, not a standard. Providers draw the lines in different places, which is why the next two sections matter.
What is usually an extra
The NCSC's guidance on choosing a managed service provider warns that "some of these features may incur additional charges". These are the items most often outside the package.
- On site visits. Included, capped or charged per visit. Ask which, and where the provider covers in person.
- Out of hours work. Evening changes and emergency call outs are often billed separately, even when monitoring runs around the clock.
- Projects and hardware. Office moves, new servers, migrations and new equipment are usually quoted separately. Ask where support ends and a project begins.
- Licences. Microsoft 365 and other software licences are often billed alongside support. Ask for them on a separate line; see our guide to software licence management.
- Onboarding. Some providers charge to take on a new client. Ask what it covers and what the first 90 days look like.
- Third party software. Line of business software is usually supported by its vendor, with the IT provider liaising.
- Backup beyond the basics. Some packages back up Microsoft 365 but not servers, or sell backup as an add on. Check the scope; we explain our approach to managed cloud backup separately.
- Cyber Essentials certification. On the self led route you register and pay through IASME, the NCSC's delivery partner; on the supported route you hire a Certification Body licensed by IASME. Either way the fee is separate from your support.
- Training and advanced security. Phishing simulations, staff security awareness training and tools such as endpoint detection and response often carry their own charge.
None of these is wrong to charge for. The problem is finding out after you sign.
How to compare two IT support quotes, line by line
Put both proposals side by side and mark each line below included, extra or missing. The NCSC's guidance says "the contract should clearly specify what is and what is not included" and calls a matrix of responsibilities, showing what the provider does and what is expected of you, good practice. This checklist builds one.
- Same unit. Per user or per device, and what counts? Are shared mailboxes, part time staff and leavers charged? Convert both quotes to your own headcount and equipment before comparing.
- Same scope. Run the essentials list against both. If one says "unlimited remote support", ask what sits outside it: unlimited usually covers remote helpdesk requests within the agreed scope, while projects, on site visits and out of hours work can still be chargeable.
- Monitoring versus response. Does "24/7" mean software watching or people acting? Ask when a human picks up an overnight alert.
- On site. Included, capped or chargeable, and which areas are covered in person?
- Projects. Where does support end, and how are projects quoted and approved?
- Security baseline. Which Cyber Essentials controls does the provider run, and which are left to you? The NCSC lists "timely patch management for all systems and software" and "use of 2SV across all access points" (two step verification) among the services to request, and advises using providers "with recognised certifications such as Cyber Essentials Plus", so ask to see the certificate.
- Backup. What is backed up, who checks it completed, and how often is a restore tested? The NCSC asks for "regular testing of restore processes".
- Licences. Shown separately, on what terms, and who holds them? A Microsoft Cloud Solution Provider (CSP) partner can supply and bill Microsoft licences on Microsoft's behalf; if that is the plan, the quote should say so. Ask about Microsoft 365 licences from a CSP partner.
- Ownership and exit. Who owns the admin accounts and documentation? Under Cyber Essentials v3.3, accounts a managed service provider uses to support your systems are in scope, so know which accounts the provider holds and how they come back to you. Our guide covers contract length, notice and exit terms.
- Data protection. An IT support company is usually a processor of your personal data, and the ICO says "there must be a written contract that binds the processor to the controller". Ask to see the UK GDPR processor terms.
- Response commitments. How are they written down, and what happens if they are missed? See how to read an SLA.
Few businesses do this. The government's Cyber security breaches survey 2025/2026 found that 15% of businesses reviewed the risks posed by their immediate suppliers. After running the list, the cheaper quote is often missing two or three lines, or it really is cheaper and you now know why.
What we do
HGC offers fully managed IT support for small businesses across the UK: remote first, with on site visits across Dorset when needed, and we are based nearby in Dorchester. We are a Microsoft Cloud Solution Provider (CSP) partner, we hold Cyber Essentials Plus, the independently audited level of the scheme, and we provide 24/7 monitoring with human response in UK business hours. There are no long-term contracts. Our service page explains how we cost managed IT support.
If you have proposals on the desk and want a second opinion, book a free IT review and we will go through them with you.
Frequently asked questions
What is included in an IT support package?
At minimum: a helpdesk with tracked tickets, monitoring, patching and updates, malware protection, backup with tested restores, user and access management including multi factor authentication, basic firewall management and documentation you can see. Fuller packages add security controls, Microsoft 365 administration and planning.
What is the difference between IT support tiers?
Lower tiers usually cover reactive helpdesk support only. Middle tiers add monitoring, patching and backup checks. Fully managed tiers add security controls, Microsoft 365 administration, planning and on site work when needed. Names vary by provider, so compare contents rather than labels.
What is usually not included in an IT support package?
Commonly extra: on site visits beyond an allowance, out of hours work, projects such as office moves and migrations, hardware, software licences, onboarding fees, third party software support and certification fees. Ask each provider to list exclusions in writing.
How do I compare IT support quotes?
Put both quotes on the same unit, per user or per device, then check each against the same list: helpdesk, monitoring, patching, security, backup, licences, on site visits, projects, account ownership and exit terms. Mark each line included, extra or missing.
