For a business under about twenty people, IT support usually means one of three arrangements: call someone when it breaks, a fixed monthly contract, or a friend of the owner who is good with computers. The third one is free until the day it costs you a week of trading.
The three models
Break-fix. You pay an hourly rate, typically $90 to $180 (£70 to £140), when something goes wrong. Cheap while nothing breaks. No incentive for the provider to prevent problems.
Managed support. A fixed monthly fee per user covering helpdesk, monitoring, patching, antivirus and backups. Usually $60 to $150 per user per month (£50 to £120). Predictable and the provider is now motivated to stop things breaking.
Hybrid. Monitoring and backups on a monthly fee, project work billed separately. Common for businesses with simple setups.
What the contract should include
What is normally excluded: hardware, software licences, cabling, and any project over a few hours. Get that list in writing so the first invoice is not a surprise.
Response times that mean something
"Four hour response" usually means someone acknowledges the ticket, not that it is fixed. Ask for both numbers, and ask what happens when they are missed. A contract with no consequence for a missed target is not really a service level agreement.
Security minimums in 2026
Multi-factor authentication on email and any remote access. Encrypted laptops. A password manager. Separate admin accounts. Documented offboarding so a leaver loses access the same day.
In the UK, Cyber Essentials certification is a reasonable benchmark and is required for many public sector contracts. In the US, ask whether the provider aligns to the CIS Controls, and if you handle health or card data, whether they have worked to HIPAA or PCI DSS requirements before.
Backups: the question that matters
Not "do you back up" but "when did you last restore a file and how long did it take". A backup nobody has tested is a hope, not a backup. Ask for a test restore during onboarding and once a year after that.
Exit terms
Notice period, who owns the documentation and admin credentials, and what a handover to another provider includes. The correct answer is that you own everything and they hand it over in full. Anything else locks you in.
Sizing the budget
A rough guide: two to four per cent of turnover for a business with normal IT needs, higher if you handle regulated data or run bespoke software. For a ten-person company on Microsoft 365 with laptops, expect $700 to $1,500 a month (£550 to £1,200) all in, including licences.