Fully managed, co-managed or security only?
| Model | What the provider does | What you keep | Best for |
|---|---|---|---|
| Fully managed IT | Help desk, devices, network, Microsoft 365, security and backups | Decisions and budget | Businesses with no IT staff |
| Co-managed IT | Monitoring, security, after hours coverage and extra help | Your IT staff and their projects | Businesses with one or a few IT people |
| Managed security only | 24/7 threat detection and response, email security and testing | Day to day IT | Businesses with IT covered but gaps in security |
| Break fix | Repairs when something breaks, billed by the hour | Everything else | Very small offices with simple needs |
The security basics every business needs
- Multifactor authentication on email, remote access and admin accounts.
- Endpoint detection and response on every computer and server, watched around the clock.
- Backups that are encrypted, stored off site and tested.
- Email filtering, plus phishing training for every employee.
- Updates and patches on a schedule, and a plan for systems that are out of support.
- A written incident response plan, so everyone knows who to call.
These are among the controls cyber insurers ask about. If your renewal questionnaire asks about one of them and the honest answer is no, start there.
Rules that may apply to you
- Medical and dental practices: HIPAA security requirements for patient information.
- Businesses that take cards: the PCI Data Security Standard.
- Tax preparers, mortgage brokers, auto dealers and other non bank financial businesses: the FTC Safeguards Rule, which requires a written security program and, since May 2024, reporting certain breaches to the FTC.
- Defense suppliers: CMMC requirements in Department of Defense contracts.
- Every business that keeps customer data: Missouri and Kansas data breach notification laws.
We do not resell one IT company. We compare several providers on the same scope and stay involved after you sign, so you have someone in your corner if service slips.
