How much do managed IT services cost? Price the operating agreement

Translate a provider rate into a business budget

Inventory the environment before seeking prices

List employees, contractors, shared workstations, laptops, mobile devices, servers, network equipment, locations, and business applications. Include remote workers and any systems that must operate outside normal office hours. Identify the applications whose downtime would immediately interrupt revenue or essential work. Record existing software subscriptions and support arrangements so bidders can distinguish what they would replace from what you already pay for.

Add the people side of the inventory. Who approves access, owns vendor accounts, handles new hires, and decides when a security incident requires outside help? Small businesses often rely on informal arrangements that a managed provider cannot infer from a device count. Describe the actual workflow: a new employee needs an account, a departing worker loses access, or a laptop fails during a busy day. These examples help providers quote the service you need and expose assumptions that a generic package description leaves unresolved.

Understand the pricing unit and its limits

Ask whether the proposal is priced per user, per device, per site, or as a fixed package. Define what counts. A shared computer may create a different charge from a named employee; a contractor may or may not be included; servers and network equipment may be separate. Ask about minimum monthly charges and how counts are updated when the business changes. A quote for twenty users should state what happens when you hire the twenty-first.

Then identify exclusions. Projects, hardware, cabling, major migrations, after-hours work, travel, vendor liaison, and disaster recovery may be outside the recurring fee. Do not treat the term unlimited support as unlimited scope. Ask for examples of included requests and separately billable work. A lower monthly price may be sensible if your business rarely needs the excluded service, but only if the exclusion is visible. Request an annualized estimate using your expected needs rather than accepting the cheapest package as the full operating budget.

Write a responsibility matrix

For each service, assign an owner and an expected output. Cover patching, endpoint protection, identity administration, backups, restore testing, monitoring, incident response, software licensing, documentation, and employee support. Distinguish performing a task from merely alerting you that it is needed. If a provider monitors backups but you must arrange recovery, that boundary should be clear before an outage.

CISA's managed-service-provider risk guidance emphasizes assessing the risks associated with a provider's access and defining the relationship carefully. In your procurement process, ask how privileged access is controlled, how activity is logged, and how your organization receives information during an incident. Those questions do not establish that a provider is secure; they identify evidence to review. Obtain the answers in the agreement or supporting documentation, with specialist advice when the environment warrants it.

Compare service levels using business situations

Response time and resolution time are different. Ask when the response clock starts, which channels qualify, what hours are covered, and how priorities are assigned. A promise to acknowledge a ticket quickly does not necessarily mean a failed business application will be restored within the same period. Use realistic scenarios to test the wording: one employee cannot print, the whole office loses access, or an account appears compromised after hours.

Ask who can declare an urgent incident and how escalation works if the first technician cannot resolve it. Clarify the role of third-party software vendors and whether the provider coordinates them or tells you to call separately. Document maintenance windows and notification expectations. You are looking for a service arrangement that matches the business's tolerance for interruption. Paying for round-the-clock coverage can be worthwhile for some operations, while a business that closes every evening may prioritize stronger daytime support and a clear emergency process.

Build a complete hypothetical annual budget

Suppose a fictional twenty-user business receives a recurring quote of $130 per user per month. That line would be $2,600 monthly or $31,200 annually. Add an invented $3,000 onboarding project and $2,000 in separately budgeted migration work, and the first-year total becomes $36,200 before any hardware or additional subscriptions. These are arithmetic examples only. Their purpose is to show why a per-user number should be expanded into a complete year-one and ongoing budget.

Ask bidders to state assumptions about growth, device replacement, software licensing, and project hours. Compare the second year separately because onboarding may disappear while annual increases apply. Include internal staff time needed to approve requests, maintain records, and coordinate changes. Outsourcing does not eliminate every management task. A proposal that reduces invoices but requires extensive owner involvement may have a different practical cost from one with more complete coordination. Keep cash expenses and internal time visible without pretending that every saved minute immediately becomes revenue.

Test the relationship before a broad rollout

Run a limited, agreed pilot where practical. Choose representative support requests, a new-user workflow, a device setup, and a documented recovery exercise appropriate to the environment. Use synthetic or approved data when needed. Define success before testing: communication quality, completion, documentation, and whether the provider follows the authorization process. Do not grant broad access merely to make a sales demonstration convenient.

Ask to see sample monthly reporting and discuss what you would do with each metric. Ticket volume alone says little about business outcomes. A useful report might show recurring causes, unresolved risks, asset changes, and recommended decisions with costs. Request references from organizations with similar operational needs, while recognizing that references are selected examples rather than independent proof. The pilot should answer whether the working relationship is understandable and manageable, not simply whether the provider can produce a polished dashboard.

Plan the exit while negotiating the start

Clarify ownership of accounts, domains, licenses, documentation, and backup data. Ask how you receive records during the contract and how they are transferred at termination. Define notice periods, early termination charges, transition assistance, and the removal of provider access. An affordable service that is difficult to leave can become expensive when your needs change. Keep critical business accounts under appropriate organizational ownership.

Choose the proposal that makes responsibilities, service levels, security access, exclusions, and total annual spending explicit. If the budget is too high, reduce scope deliberately with a written account of what remains internal rather than accepting vague assurances. The best cost answer is a full operating agreement connected to your actual environment. Once you know who does what, when support is available, and how exceptions are billed, the monthly figure becomes useful and the business can judge value on outcomes it can observe.

Location and scope of the provider benchmark

Ironguard's September 2026 page identifies New York metro, the San Francisco Bay Area and San Diego as home markets while describing broader service. It separately scopes onsite coverage, hardware, travel and major projects. The figures above were checked October 6, 2026 and should be used as one provider example, not a representative nationwide survey. Published service scope.