IT Support Archives | ATS Connection

Hotel WiFi: A Practical Guide for UK Hotels (2026)

Posted on 11 October 202615 October 2026 by Jake Boase

The short answer: Good hotel WiFi needs three things: a survey-led design with enough access points for your building, a fast and resilient internet connection behind it, and separate networks so guests never share a network with your reception, payments or property management system. Get those right and WiFi stops being a complaint. Get the separation wrong and you can also fall foul of PCI DSS, the card industry’s security standard.

In this guide:

Why hotel WiFi lets guests down
What good hotel WiFi looks like
Keep guest WiFi away from your payments and systems
Hotel WiFi and PCI DSS
Collecting guest details through WiFi
The Booking.com phishing threat
Hotel WiFi checklist
Frequently asked questions
Sources

Why hotel WiFi lets guests down

Most hotel WiFi problems come from a handful of causes:

The building. Thick stone or brick walls, fire doors, long corridors and several floors all block wireless signals. Gardens, terraces and outbuildings are often left out entirely.
Too few access points. A router behind reception and a few plug-in extenders cannot cover a hotel. Extenders also cut speed and make devices drop out as guests move around.
Not enough internet capacity. On a busy evening dozens of guests stream, video call and back up photos at once. A connection sized for the office will not cope.
One flat network. Guests, staff, card terminals and cameras all on the same network is slow to troubleshoot and a security risk.
No one looking after it. Consumer equipment with no monitoring means problems are found by guests, not by you.

Historic buildings are the hardest case. When we upgraded the network at the Norfolk Arms Hotel in Arundel, a 37-room listed property, thick stone walls blocked wireless signals and listed status restricted where equipment could go. The answer was a leased line and access points placed discreetly throughout the hotel and gardens, with separate guest WiFi networks.

What good hotel WiFi looks like

A site survey first. Measuring signal room by room, including bars, function rooms and outdoor areas, tells you how many access points you need and where. It is the difference between planned coverage and guesswork.
Business-grade access points, centrally managed. A managed system lets guests roam from room to restaurant without dropping off, and lets your IT provider see and fix problems remotely.
Cabled access points where possible. Wiring each access point back to a network switch gives far more reliable speeds than wireless repeaters.
An internet connection sized for your busiest night. Busy hotels often need a leased line, which gives the same speed in both directions and a business service level agreement.
A backup connection. A second line or 4G or 5G backup keeps guests and card payments online if the main line fails.
Monitoring. Your IT provider should be alerted when an access point or the internet line goes down, ideally before a guest notices.

Our business WiFi and wireless network service covers surveys, design and installation, and our IT support for hotels keeps the whole setup monitored and supported.

Keep guest WiFi away from your payments and systems

The most important design decision is separation. A typical hotel should run at least these networks, kept apart from each other:

Network	Who or what uses it	Key settings
Guest WiFi	Guests’ phones, laptops and TVs	Internet only, client isolation so guest devices cannot see each other, speed limits per device if needed
Staff network	Reception PCs, office laptops, the property management system	Strong WPA2 or WPA3 security, password changed when staff leave
Payments	Card terminals and any device that handles card data	Never on guest WiFi, with security controls between it and every wireless network, as PCI DSS requires
Building systems	CCTV, door locks, heating controls, smart TVs	Kept apart from both guests and staff, with default passwords changed

Separation stops a guest’s infected laptop from reaching your reception PC, keeps cameras and smart devices out of reach, and makes problems far easier to trace.

Hotel WiFi and PCI DSS

If you take card payments, the Payment Card Industry Data Security Standard (PCI DSS) applies, and it has specific rules for wireless networks. In PCI DSS v4.0.1:

Requirement 1.3.3: network security controls must be installed between all wireless networks and the cardholder data environment, and all wireless traffic into that environment must be denied by default.
Requirement 11.2.1: you must test for wireless access points, detect and identify both authorised and unauthorised ones, at least once every three months.
Requirements 2.3.1 and 2.3.2: for any wireless network connected to card systems, vendor defaults such as default encryption keys must be changed, and keys must be changed when someone who knows them leaves.

The simplest way to meet these is to keep card terminals on their own isolated network, or on their own mobile data connection, never on guest WiFi, and to have your IT provider document the setup. Your card provider or acquiring bank will tell you which self-assessment questionnaire applies to you.

Collecting guest details through WiFi

Many hotels use a WiFi login page to collect email addresses. That is allowed, but email marketing has to follow PECR, and the ICO’s guidance is clear on the main points:

You normally need consent before sending marketing emails to individuals.
Consent must be freely given. Making agreement to marketing a condition of a service is unlikely to be valid consent.
You must not use pre-ticked boxes, silence or inactivity as consent.
The soft opt-in, which lets you market similar products without consent, only applies to details you collected during a sale or negotiations for a sale, and you must offer an opt-out when you collect the details and in every message.

The simplest approach is to let guests connect without signing up to marketing, and offer the newsletter as a separate, unticked choice. Your privacy notice should explain what the login page collects and why. This is general information, not legal advice.

Some hotels also filter guest WiFi. Friendly WiFi is a voluntary, government-supported accreditation that confirms a venue’s public WiFi blocks pornography and child abuse content, which is worth considering if families stay with you.

The Booking.com phishing threat

Hotels are a deliberate target. In March 2025 Microsoft reported a phishing campaign, running since December 2024, that impersonated Booking.com and targeted people at hospitality organisations across Europe and other regions. The emails posed as guest complaints, booking requests or account checks, then led staff to a fake verification page that tricked them into running a command which installed malware designed to steal passwords and financial data.

Phishing is the most common attack UK businesses face. The government’s Cyber Security Breaches Survey 2025/26 found that 43% of businesses reported a breach or attack in the previous 12 months, and phishing affected 38%.

A few steps make a big difference for hotel teams:

Turn on multi-factor authentication for email, your booking platform extranets and the property management system.
Check guest messages and account alerts by logging in to the booking platform directly, never through a link in an email.
Treat any page that asks you to paste or run a command as an attack.
Keep reception and back office PCs off the guest WiFi, with up-to-date security software.

Our cyber security services help hotels protect email and Microsoft 365 and monitor for threats around the clock.

Hotel WiFi checklist

Coverage has been surveyed in every room, public area and outdoor space.
Access points are business grade, centrally managed and cabled where possible.
The internet connection copes with your busiest evening, with a backup line.
Guests, staff, card payments and building systems are on separate networks.
Guest devices are isolated from each other.
Default passwords and encryption keys have been changed, and staff passwords change when people leave.
Wireless access points are checked at least every three months if card systems are in scope.
The WiFi login page does not force guests to accept marketing.
Someone is alerted when the WiFi or internet line goes down.

If you would like a second opinion on your hotel’s WiFi, our team in Arundel and Chichester can survey your property, review how your networks are separated and recommend practical fixes. We have supported businesses since 2015, and we also look after phones and telecoms for hospitality.

Frequently asked questions

Should hotel guest WiFi be separate from the hotel’s own network?

Yes. Guests should be on their own network, kept apart from reception PCs, the property management system, card terminals and CCTV. If you take card payments, PCI DSS requires network security controls between all wireless networks and the cardholder data environment, with wireless traffic into it denied by default.

How many WiFi access points does a hotel need?

It depends on the building rather than the number of rooms alone. Thick walls, long corridors, several floors and outdoor areas all change the answer. A site survey that measures signal room by room is the reliable way to plan coverage, and it avoids paying for access points you do not need.

Can a hotel collect guest email addresses through the WiFi login page?

Yes, but marketing emails need valid consent unless the soft opt-in applies. The ICO says consent must be freely given, that making marketing a condition of a service is unlikely to be valid consent, and that pre-ticked boxes must not be used. Keep the WiFi login and the marketing choice separate.

Is open guest WiFi without a password safe?

Open WiFi lets anyone nearby join and offers guests less protection. A password shared at check-in or a login page, combined with client isolation so guest devices cannot see each other, is a safer setup. Your own staff and payment systems should never share a network with guests.

What internet connection does a hotel need for guest WiFi?

Enough to cope with your busiest evening, when many guests are streaming and calling at once. Busy hotels often need a leased line, which gives the same speed in both directions with a business service level agreement, plus a backup connection so WiFi stays up if the main line fails.

Does hotel guest WiFi need content filtering?

Some venues filter guest WiFi to block harmful content. Friendly WiFi is a voluntary accreditation, supported by the government, which confirms that a venue’s public WiFi blocks pornography and child abuse content. It is worth considering if families stay with you.

Sources

PCI Security Standards Council: PCI DSS v4.0.1, requirements 1.3.3, 2.3.1, 2.3.2 and 11.2.1
ICO: How do we comply with the PECR electronic mail marketing rules?
Microsoft Threat Intelligence: Phishing campaign impersonates Booking.com, March 2025
DSIT: Cyber Security Breaches Survey 2025/26, published 30 April 2026
UK Safer Internet Centre: What is the Friendly WiFi scheme?

This guide is general information, not legal or compliance advice. Check your PCI DSS obligations with your card provider.

Onsite vs Remote IT Support: What Gets Fixed Where, and What It Costs

Posted on 7 October 202614 October 2026 by Jake Boase

The short answer: Remote IT support fixes problems over a secure connection without anyone travelling, and in our experience it handles most day-to-day issues: accounts, email, software and slow computers. Onsite IT support means an engineer comes to your premises, which you need for physical jobs such as swapping a failed part, installing a network or moving office. Most small businesses do best with both: remote support first, because it is faster, and an engineer on site when a job needs hands on. The question to ask a provider is not which one they do, but how on-site visits are covered and charged.

Last updated: 7 October 2026. ONS hybrid working figures and NCSC guidance checked on the same date.

In this guide

What is onsite IT support?
What is remote IT support?
Onsite vs remote IT support: the difference
Which IT jobs need an engineer on site?
What about staff who work from home?
Is remote IT support secure?
How much does onsite IT support cost?
Do you need a local IT company?
Onsite and remote IT support from ATS Connection
Frequently asked questions

What is onsite IT support?

Onsite IT support is when an IT engineer comes to your office, shop or site to do the work in person. It is the traditional model: something breaks, someone visits, and the engineer fixes it at the desk or in the comms cupboard.

Today it is mostly used for work that cannot be done any other way, because it involves touching equipment:

Replacing failed hardware, such as a laptop screen, a hard drive or a network switch.
Installing and cabling networks, WiFi access points, firewalls and comms cabinets.
Setting up phone systems, broadband and new offices, and handling office moves.
Tracing physical faults, such as a cable unplugged under a desk or a failing power supply.

Some businesses also like regular scheduled visits, for example a day a month, so staff can raise things face to face. That can suit larger offices, but for many small teams it is hard to justify, because problems rarely wait for the visit.

What is remote IT support?

Remote IT support is when an engineer fixes a problem without being in the room. Your staff contact the helpdesk, and the engineer connects securely to the computer or the system involved, sees what the user sees and fixes it while they talk. Nobody travels, so the fix can start within minutes.

Good remote support also works when nobody has called. Monitoring software on each device reports problems such as a failing disk, a stopped backup or missing security updates, so many faults are fixed before anyone notices them. Our post on remote monitoring and management explains how those tools work, and our guide to proactive IT support covers the routine work they make possible.

Because so much business software now lives in Microsoft 365 and other cloud services, many IT problems are not in the building at all. A Teams issue, a shared mailbox or a OneDrive sync fault gets fixed the same way whether the user is at their desk, at home or in a hotel.

Onsite vs remote IT support: what is the difference?

The difference is where the engineer is. That one fact changes how fast help arrives, what it costs and which problems it can solve.

	Remote IT support	Onsite IT support
How it works	An engineer connects securely to the device or system	An engineer comes to your premises
How fast help starts	Can start within minutes of the call	When an engineer can travel to you
Best for	Accounts, email, Microsoft 365, software, settings and security alerts	Hardware, cabling, networks, installs and office moves
Home and hybrid workers	Same service wherever they are	Only practical at the office
Typical charging	Usually included in a monthly fee	Included, capped or charged per visit, depending on the contract
Limits	Cannot touch hardware	Slower, and travel time costs money

How remote and onsite IT support compare.

So it is rarely a choice of one or the other. Remote support should be the first response for almost everything, because it is faster and works for everyone. Onsite support is the backstop for physical work. The best arrangements diagnose remotely first, so when an engineer does visit, they already know the fault and bring the right part.

Remote-first, on site when needed

How a problem gets fixed with remote-first support

A software or account problem

Step 1

You report it

By phone or email, to a helpdesk that knows your setup.

Step 2

Engineer connects

A secure remote session, with the user’s permission.

Done

Fixed on the call

No travel, no waiting for a visit.

A physical fault

Step 1

You report it

The same call, the same helpdesk.

Step 2

Remote diagnosis

The engineer confirms what has failed before anyone travels.

Step 3

Visit booked

An engineer comes on site, with the right part.

Done

Fixed and recorded

The device record is updated afterwards.

Which IT jobs need an engineer on site?

In our experience, most day-to-day requests never need a visit. The jobs that do are physical, and many of them are planned projects rather than emergencies. This is how the requests we see at ATS Connection usually split:

Where each job gets fixed

Remote, on site, or both? Common IT jobs sorted

Fixed remotely

Usually sorted on the first call, wherever the person is working.

Password resets and locked accounts
Multi-factor authentication problems
Outlook, Teams, OneDrive and SharePoint
Software installs, updates and licences
New starters and leavers
Security alerts and suspicious emails

Starts remote, may need a visit

Diagnosed remotely first, so any visit is for a known fault.

Slow or misbehaving laptops and PCs
Printers and scanners
WiFi dropping in one part of the office
Internet down for the whole office
A device that will not start

Needs an engineer on site

Hands-on jobs, often planned and priced in advance.

Swapping a failed part
New network, WiFi and cabling installs
Servers, comms cabinets and firewalls
Phone system and broadband installs
Office moves and new office set-ups

Based on how we handle requests at ATS Connection. Your own split depends on your premises and how much of your IT is in the cloud.

The middle column is where a provider proves its worth. A printer that will not print, WiFi that drops in the meeting room or an office that has lost its internet connection can usually be diagnosed remotely, and often fixed remotely too. When they cannot, a remote diagnosis means the visit is short and the fault is already known. For connection problems, our business broadband and WiFi service covers the lines and the network inside the office.

Planned onsite work is different again. Office moves, new networks, server cabinets and phone system installs should be scoped and priced before anyone travels, so there are no surprises on the invoice.

What about staff who work from home?

For home and hybrid workers, remote support is the main option. More than a quarter (28%) of working adults in Great Britain were hybrid working between January and March 2025, according to the Office for National Statistics, and the share has gradually risen since March 2022. An engineer cannot visit every kitchen table, so the support model has to work over the internet.

That changes what good support looks like. Laptops need to be managed and updated wherever they are, files need to live in the cloud rather than on an office server, and the helpdesk has to be able to fix a home worker’s problem as easily as one in the office. If your business has moved to hybrid working but your IT support still assumes everyone sits in the same building, that gap shows up as slow fixes and frustrated staff. Our guide to phone systems for remote and hybrid teams covers the calling side of the same problem.

Is remote IT support secure?

It can be, but the provider’s access to your systems needs as much protection as your own staff’s. Anyone who can connect remotely to your computers holds a powerful key, so the NCSC’s guidance on choosing a managed service provider tells smaller organisations to check how the provider manages and secures its connections into your systems.

The NCSC’s points come down to a few plain questions you can put to any provider:

How do your engineers connect to our systems, and how are those connections secured?
Do your engineers use two-step verification (multi-factor authentication) on their access to our systems, and how do you protect login details, particularly administrative ones?
Do you only have the access you need? The NCSC calls this the principle of least privilege.
Are logs kept, for how long, and can we see them if something goes wrong?
What does the contract say about ending it, and how are old accounts and access dealt with?

A provider that answers those clearly, and in writing, is one you can trust with remote access. Vague answers are a reason to look elsewhere, whatever the price.

How much does onsite IT support cost?

It depends less on the hourly rate than on how visits are covered in the contract. Contracts commonly handle on-site visits in one of three broad ways, and some mix them. The difference matters more than the headline monthly price:

How visits are covered	What it means	What to check
Included	Visits are part of the monthly fee	Whether there is a fair use limit, and which locations are covered
Capped	A set number of visits or hours each month or year	What happens when the cap runs out, and the rate after that
Charged per visit	Remote support is included, and visits are billed at an hourly or day rate	The rate, any minimum charge, and whether travel time is billed

Common ways IT support contracts handle on-site visits.

For comparison, our own prices are published. Day-to-day support is a fixed monthly fee of £30 to £48 per user on Core and £55 to £90 per user on Complete, plus VAT, with an unlimited remote helpdesk. Whether on-site visits are included depends on how close you are to our offices and which package you are on, and we set that out in your quote. Project work such as an office move is quoted separately, or charged at our ad hoc rate of £100 an hour, £340 a half day or £650 a day, plus VAT.

The IT support packages and pricing page has the full breakdown, and our guide to how much IT support costs compares the pricing models used across the UK.

Do you need a local IT company for onsite support?

Local matters for onsite work and matters much less for everything else. Remote support works the same from ten miles away as from a hundred, so for day-to-day help the things to judge are response times, how well the provider knows your setup and whether it is proactive.

Distance starts to count when something physical fails, or when you are planning a project that needs engineers in the building for a day or two. A provider that is a short drive away can be on site the same day without a large travel bill. If you are searching for IT support near you, a sensible test is to ask where the engineer who would visit you is based, and how on-site visits to your address are charged.

A good example of planned onsite work is the refit of Timothy Roe, a jeweller in Chichester. During a shop revamp, our engineers installed a modern server cabinet, replaced ageing workstations and servers, and built a mesh network with new access points. As the Timothy Roe case study records, the business now runs on a stable platform where crashes and sluggish performance are a thing of the past. None of that could have been done remotely, and it was done during the revamp without disrupting the business.

Onsite and remote IT support from ATS Connection

We provide onsite and remote IT support from offices in Arundel and Chichester, and have looked after businesses since 2015. More than 100 businesses rely on us today. Most issues are fixed remotely by named engineers who know your setup: our average response time is under 15 minutes and 98% of issues are resolved at first contact. When a job needs hands on, our engineers come on site across Sussex and into Hampshire, and remote support works the same for your staff wherever they are in the UK.

Our helpdesk is open from 9am to 5.30pm on working days, with urgent out-of-hours support when you need it, and monitoring runs 24/7 in the background. Day-to-day support sits within our fixed monthly business IT support packages, and anything outside them, such as a project or a visit your package does not cover, is quoted before we start.

If you are not sure whether your current setup is getting the right mix, book a free IT review. A senior engineer will review your current setup, security, backups and Microsoft 365, and tell you plainly what can be handled remotely and what needs attention on site.

Frequently asked questions

What is onsite IT support?

Onsite IT support is when an IT engineer visits your premises to do the work in person. It is mainly needed for physical jobs such as replacing failed hardware, installing networks, WiFi and cabling, setting up phone systems and moving office.

Can all IT problems be fixed remotely?

No, but in our experience most day-to-day ones can, including account and password problems, email and Microsoft 365 issues, software installs and security alerts. Hardware failures, cabling and installs need an engineer on site, ideally after a remote diagnosis so the visit is short.

Is remote IT support faster than onsite support?

Usually, yes. A remote session can start within minutes of a call because nobody has to travel. Onsite support depends on when an engineer can get to you, which is why it makes sense to fix what can be fixed remotely first.

Is remote IT support safe?

It is safe when the provider protects its own access to your systems. The NCSC advises checking how the provider secures its remote connections, that its engineers use two-step verification, that it only has the access it needs, and whether it keeps logs and lets you see them.

How much does onsite IT support cost?

It depends on whether your contract includes visits, caps them or charges per visit. Our monthly support is £30 to £90 per user plus VAT; whether on-site visits are included depends on your location and package and is set out in your quote, and project work is quoted separately or charged at our ad hoc rates of £100 an hour, £340 a half day or £650 a day, plus VAT.

Do you offer onsite and remote IT support together?

Yes. Most issues are fixed remotely, and our engineers come on site across Sussex and into Hampshire for jobs that need hands on, such as hardware faults, network installs and office moves.

Sources

Proactive IT Support: What It Is, What It Costs and How to Tell If You Have It

Posted on 7 October 202613 October 2026 by Jake Boase

The short answer: Proactive IT support means your IT provider looks after your systems before anything goes wrong: monitoring devices and backups around the clock, installing security updates on a schedule, replacing ageing hardware before it fails and reviewing your IT with you regularly. Reactive (break-fix) support only acts once something has broken and you have called. For a UK small business, proactive support is usually a fixed monthly fee per user; ours is £30 to £90 per user per month, plus VAT.

Last updated: 7 October 2026. Survey figures checked against the government’s Cyber Security Breaches Survey 2025/2026, with NCSC, IASME and Microsoft guidance checked on the same date.

In this guide

What is proactive IT support?
Reactive vs proactive IT support
What does proactive IT support involve?
Why does it matter for a UK small business?
How much does proactive IT support cost?
How to tell if your IT support is proactive
Is proactive IT support worth it for a small business?
Proactive IT support from ATS Connection
Frequently asked questions

What is proactive IT support?

Proactive IT support is IT support that works to stop problems happening, rather than waiting to be told about them. The provider watches your systems continuously, fixes faults it spots before your staff notice them, keeps everything patched and planned, and still answers the phone when someone needs help.

In practice, a proactive service usually covers:

Monitoring and alerts on computers, servers, backups, security software and the network, so a failing disk, a full drive or a stopped backup raises an alert. Our post on how remote monitoring and management works explains the tools.
Patch management: installing security updates for Windows, applications and firewalls on a schedule, and checking they actually installed.
Security baselines: multi-factor authentication, endpoint protection, email filtering and admin accounts kept to the people who need them.
Backups that are tested, not just running. A backup nobody has restored from is a hope, not a plan. See backup and disaster recovery.
Lifecycle planning: knowing every device, its age and when it needs replacing, so replacements are budgeted rather than emergencies.
Regular reviews where the provider tells you what is coming: risks, renewals, ageing kit and changes in the rules.

None of this replaces the helpdesk. People still get stuck, forget passwords and need a new starter set up. The difference is that the helpdesk deals with genuine requests, not the same preventable faults over and over.

What is the difference between reactive and proactive IT support?

The difference is who notices the problem first. With reactive support you notice, usually when something stops working, and then you pay for the fix. With proactive support the provider is meant to notice first, often before it affects anyone.

	Reactive (break-fix)	Proactive (managed)
Who spots problems	Your staff, when something stops working	Monitoring, often before staff notice
Security updates	When someone remembers or a machine nags	On a schedule, with reports showing what installed
Backups	Assumed to be working	Checked, with test restores
Hardware	Replaced when it fails	Replaced on a plan, before it fails
How you pay	By the hour or by the job	A fixed monthly fee, usually per user
Provider’s incentive	Earns more when things break	Earns the same, so better off when things do not break
Planning	None, unless you ask	Regular reviews of risks, devices and budget

How reactive and proactive IT support compare.

The incentive row matters most. On an hourly model, an unreliable network is good business for the provider. On a fixed monthly fee, every avoidable fault costs the provider time it is not paid extra for, so its interests line up with yours.

Illustrative example

The same failing laptop drive, handled two ways

Reactive support

Weeks 1 to 3The drive logs errors. Nobody is watching, so nobody sees them.
Monday, 8.45amThe laptop will not start and a member of staff cannot work.
MondayA ticket is raised and joins the queue. The laptop goes off for repair.
Later that weekA replacement is bought at short notice. Files come back only if a recent backup exists.

Lost working time, possibly lost files and an unplanned bill.

Proactive support

Week 1Monitoring flags a drive health warning to the support team.
Same dayAn engineer confirms the backup is current and contacts the user.
That weekThe drive or laptop is replaced at a time that suits the user.
AfterwardsThe device record is updated, so the replacement plan stays accurate.

No lost working day, no lost files and a cost that was planned.

What does proactive IT support involve day to day?

Proactive support runs on a regular rhythm: constant monitoring in the background, monthly security updates, routine housekeeping and a periodic review. Most of it is invisible to your staff, which is the point.

What proactive IT looks like

The rhythm behind proactive IT support

Around the clock

Monitoring and alerts

Devices, disk health, backups, security software and the network are watched, and problems raise an alert.

Second Tuesday

Microsoft releases updates

Microsoft publishes its monthly security updates on the second Tuesday of each month.

Within 14 days

Critical updates installed

High-risk and critical updates go on within 14 days, as Cyber Essentials and the NCSC expect.

Every month

Housekeeping

Backups are checked, leavers’ access is confirmed as removed and unused licences are cleared.

At least yearly

Review and plan

Ageing devices, risks, contracts and budget are reviewed, so next year has no surprises.

Two of those dates are set by others. Microsoft publishes its monthly security updates on the second Tuesday of each month, often called Patch Tuesday (Microsoft Learn). And the 14-day window is now a hard rule for anyone with Cyber Essentials: for assessment accounts created after 26 April 2026, failing to install high-risk or critical security updates within 14 days of release is an automatic fail, as is missing multi-factor authentication on cloud services where it is available (IASME). The NCSC gives the same 14-day guidance when advising small businesses on choosing a managed service provider (NCSC).

Windows itself is part of the plan too. Windows 10 reached end of support on 14 October 2025, and since then security updates have only been available through Microsoft’s paid Extended Security Updates programme. A proactive provider will already have a date for replacing or upgrading any machine still running it. Our Windows 10 end of life guide explains the options.

Why does proactive IT support matter for a UK small business?

Because nearly half of small businesses identify a cyber breach or attack each year, and the basic controls that stop attacks are exactly the routine work proactive support does. The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found:

Finding	UK businesses
Identified a cyber breach or attack in the last 12 months	43% of all businesses (46% of small and 42% of micro businesses)
Experienced phishing, the most common attack	38%
Have a policy to apply software security updates within 14 days	34%
Have a formal incident response plan	25%

Source: Cyber Security Breaches Survey 2025/2026, Department for Science, Innovation and Technology.

Put those together and the gap is plain: around two in five businesses identified a breach or attack, but only about a third had committed to patching within the 14 days that Cyber Essentials and the NCSC expect. Patching, backups and access control are not exciting, which is why they slip when nobody owns them. Owning them is what a proactive provider is paid to do.

There is a cost to the reactive approach beyond security. Every fault your staff find for themselves is time they are not working, and the failures that do the most damage (a dead server, a ransomware infection, a lost laptop with no backup) are the ones that give little warning to anyone who is not watching.

How much does proactive IT support cost?

Proactive IT support is normally a fixed monthly fee per user, with the monitoring, patching and helpdesk included. Our own plans run from £30 to £90 per user per month, depending on how much security and compliance work is included, and we publish the details:

	Core support	Complete IT and security
Per user, per month	£30 to £48	£55 to £90
Typical team of 15	£500 to £700 a month	£850 to £1,350 a month
Monitoring, patching and helpdesk	Included	Included
Managed cyber security, Microsoft 365 management, backup and disaster recovery	Not included	Included
Cyber Essentials guidance and regular IT strategy reviews	Not included	Included

ATS Connection prices, excluding VAT. Licences are billed at cost. Full details on our IT support pricing page.

Reactive support looks cheaper because you only pay when something breaks. Our own ad hoc rate is £100 an hour, £340 a half day or £650 a day, plus VAT, and that is the right choice for some very small businesses. The catch is that you pay for every fault, nobody is doing the preventive work in between, and the bill is impossible to budget. The IT support packages and pricing page has the full breakdown, and our guide to how much IT support costs compares the pricing models used across the UK.

How can you tell if your IT support is actually proactive?

Ask for evidence. A proactive provider can show you what it did last month, not just promise what it would do. Every provider says it is proactive; these eight questions separate the ones that are from the ones that only react.

Checklist

Eight questions that show whether your IT support is proactive

Ask your provider

A proactive provider can answer with

When did you last test restoring our backup?

A recent date, and what was restored.

Can you show me which devices are missing security updates?

A current report, not a promise to look into it.

Which of our devices are out of support or due for replacement?

A list with ages and dates, ideally already budgeted.

Who has administrator access to our systems?

Named accounts, protected by multi-factor authentication.

Were all our leavers’ accounts closed on their last day?

Yes, with a written starter and leaver process.

What did your monitoring catch last month?

Real examples of problems fixed before anyone noticed.

When is our next review?

A date in the diary, with an agenda.

What would happen if our main system went down tomorrow?

A clear answer: who acts, how fast and how you recover.

If most of the answers are vague, slow or “we would need to check”, your support is reactive whatever the contract calls it. Our post on the 10 signs it is time to change your IT support provider covers the other warning signs, and the free business IT benchmark gives you a quick score in about five minutes.

Is proactive IT support worth it for a small business?

For most businesses with more than a handful of staff, yes. Once people rely on shared systems, customer data and Microsoft 365 every day, the cost of a lost day or a breach quickly outweighs a monthly fee. It is less clear-cut for a two-person business working entirely in the cloud with few devices; ad hoc help may genuinely be enough there.

Signs you have outgrown reactive support:

The same problems keep coming back and nobody knows why.
Nobody can say for certain when the backup was last tested.
A customer, insurer or tender has asked about Cyber Essentials or your security controls.
One person is “the IT person” on top of their real job.
You do not know which devices are old, unsupported or out of warranty.

If two or three of those sound familiar, a proactive service is often worth it for the time saved alone. Our guide to what an IT support provider does explains the other models, including co-managed support if you already have someone in-house.

Proactive IT support from ATS Connection

We have provided proactive business IT support since 2015 from offices in Arundel and Chichester, and look after more than 100 businesses. Monitoring runs 24/7, our helpdesk is open from 9am to 5.30pm on working days with urgent out-of-hours support when you need it, our average response time is under 15 minutes and 98% of issues are resolved at first contact. We are Cyber Essentials certified, and our Complete package includes regular IT strategy reviews.

When Repaircraft, a defence supplier with two sites and 13 users, moved to us from a provider that was slow to respond, we modernised its systems and put proactive managed IT and security in place. As the Repaircraft case study records, downtime has effectively disappeared, there have been no successful attacks or breaches, and the business holds Cyber Essentials Plus.

If you want to know how proactive your current setup really is, book a free IT review. A senior engineer will look at your devices, security, backups and Microsoft 365 and tell you plainly what is worth fixing first. Most of the work can be done remotely through our remote IT support, with engineers on site when a job needs hands on. Our guide to onsite vs remote IT support explains which jobs need a visit.

Frequently asked questions

What is proactive IT support?

IT support that prevents problems rather than only fixing them, through continuous monitoring, scheduled security updates, tested backups, planned hardware replacement and regular reviews, alongside a helpdesk for day-to-day requests.

What is reactive IT support?

Reactive, or break-fix, IT support only acts when you report a problem, and is usually charged by the hour or by the job. Nobody does preventive work in between, so faults are found by your staff when something stops working.

Is proactive IT support more expensive than reactive support?

The monthly fee is higher than doing nothing, but the total can be lower once lost working time, emergency call-outs and unplanned replacements are counted. Ours is £30 to £48 per user per month on Core and £55 to £90 on Complete, plus VAT.

What does proactive monitoring check?

Typically device health such as disk and memory warnings, free storage, whether backups completed, whether security software is running and up to date, missing updates, and devices or network equipment going offline. Problems raise an alert for the support team.

How quickly should security updates be installed?

High-risk and critical security updates should be installed within 14 days of release. That is NCSC guidance, and for Cyber Essentials assessment accounts created after 26 April 2026 missing the 14-day window is an automatic fail.

Can a small business have proactive IT support?

Yes. Proactive support is priced per user, so it scales down to small teams. It makes most sense once several people rely on shared systems, customer data or Microsoft 365 every day.

Sources

Cyber Security for Accountants: What UK Practices Need in Place in 2026

Posted on 1 October 202613 October 2026 by Jake Boase

The short answer: Accountancy practices hold exactly what criminals want: client financial data, identity documents and access to HMRC agent accounts. The essentials are multi-factor authentication on every account (HMRC is switching it on for all remaining agent accounts between 28 September and 15 October 2026), protected and patched devices, defences against email impersonation, tested backups, and a breach plan that meets the UK GDPR 72-hour reporting deadline. Cyber Essentials is the usual way to prove the basics are in place.

Last updated: 1 October 2026. Checked against HMRC’s Tax Agents Handbook and Agent Update, ICO guidance, the Money Laundering Regulations and ICAEW’s 2026 Practice Assurance monitoring report on that date.

In this guide

Why are accountancy firms targeted?
What is changing with HMRC agent accounts?
What do the rules require?
Which controls should a practice have?
Does a practice need Cyber Essentials?
What to do if you are breached
Frequently asked questions

Why are accountancy firms targeted?

Accountancy firms are targeted because one compromised mailbox or login can unlock many clients at once. As ACCA puts it, “Cybercriminals know that accounting firms hold the kind of high value data that they can sell, use to commit crimes or use as a springboard to launch further attacks.” A practice typically holds bank details, payroll data, passports and utility bills from client due diligence, and the credentials to file on behalf of hundreds of taxpayers.

HMRC has warned agents directly. Its Agent Update of September 2025 said: “Criminals are using increasingly sophisticated methods to target tax agents, including phishing emails claiming to be from realistic companies, clients and HMRC.” An earlier update described criminals “often tricking tax agents into downloading legitimate commercial software that gives them remote access to their devices”, and warned that HMRC may suspend a compromised account without notice. For a practice, a suspended agent account in January is a serious problem in its own right.

Phishing is still the most common attack UK businesses report. The Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses had a cyber security breach or attack in the last 12 months, and that phishing was by far the most common type, experienced by 38% of businesses.

What is changing with HMRC agent accounts?

HMRC is adding multi-factor authentication (MFA) to agent online services accounts. After entering your Government Gateway user ID and password, you are asked for a one-time access code, and HMRC says “This extra step helps protect your account, even if your sign in details have been compromised.” According to the Tax Agents Handbook, “All remaining accounts will automatically be activated between 28 September 2026 and 15 October 2026”, and HMRC cannot give a specific date for each account.

Three practical points for practices:

Decide where the codes go. Shared logins and a single partner’s phone become a bottleneck the first week MFA is live. Each person who files should have their own access.
Remove leavers. HMRC’s guidance is that “you should remove access for any staff who leave your organisation or no longer need access to your HMRC online services.” The same applies to Microsoft 365 and your practice software.
Use the security console. HMRC says agents can now report suspicious activity using the security console in their agent online account, as long as MFA is activated. Suspected phishing that mentions HMRC can be forwarded to phishing@hmrc.gov.uk.

HMRC’s Standard for Agents already expects agents to keep “online access and HMRC account credentials safe from unauthorised use at all times” and to “maintain the security of client information they hold”. MFA makes that much easier to show.

What do the rules require of an accountancy practice?

No single rule sets out an IT standard for accountants, but several obligations land on your systems. The main ones are:

Obligation	What it means for your IT	Source
UK GDPR breach reporting	A notifiable breach must be reported to the ICO “without undue delay, but not later than 72 hours after becoming aware of it”. You need logging and alerting good enough to know what happened, fast.	ICO
Money Laundering Regulations record keeping	Customer due diligence records must be kept for at least five years after the business relationship ends. That means secure, backed-up storage for ID documents with access limited to the people who need it.	MLR 2017, reg 40
HMRC Standard for Agents	Keep HMRC credentials safe from unauthorised use and keep client information secure.	HMRC
Professional body monitoring	ICAEW’s Practice Assurance reviews now cover cyber security and data protection. Its 2025 report found 34 firms that had not registered with the ICO.	ICAEW 2025, ICAEW 2026
Making Tax Digital for Income Tax	Sole traders and landlords with qualifying income over £50,000 should have started from 6 April 2026, with £30,000 from April 2027 and £20,000 from April 2028. More clients, more software connections and more data to protect.	HMRC

Obligations that affect IT in a UK accountancy practice.

On anti-money laundering supervision: accountancy service providers are currently supervised by their professional body or, if they have none, by HMRC. The government decided in October 2025 that the FCA will take over supervision of the professional services sector, with the start date “heavily dependent on the availability of parliamentary time”. The record-keeping duty does not change either way.

Which cyber security controls should an accountancy practice have?

Most of the risk is covered by a short list of controls, applied consistently to every account and device. ICAEW’s 2026 monitoring report recommends firms develop an incident response plan and test it at least annually, sign up to the NCSC’s Early Warning service and run staff training and awareness. In practice, a well-run practice has:

MFA everywhere. Microsoft 365, HMRC agent services, practice management and cloud accounting software, banking and remote access. The NCSC says turning on two-step verification “is one of the most effective ways to protect online accounts when passwords are still in use”.
Email that resists impersonation. SPF, DKIM and DMARC on your domain, impersonation protection for partners’ names, and alerts when someone creates a mailbox forwarding rule.
Managed, encrypted devices. Every laptop encrypted, patched and running endpoint protection, including home-working machines. No client data on unmanaged personal devices.
Controlled remote access. Remote access software only where you have chosen it, given HMRC’s warning about criminals persuading agents to install it.
Least-privilege access and a leaver process. Staff see the client files and systems their role needs. Leavers lose access on their last day, across every system.
A secure way to receive documents. A client portal or secure upload rather than passports and bank statements arriving as email attachments.
Independent, tested backup. Microsoft 365 and practice data backed up outside Microsoft’s own retention, with restores tested, not assumed.
A written incident plan. Who to call, how to contain an incident, and how you would meet the ICO’s 72-hour deadline. Tested once a year.

These map closely onto the five Cyber Essentials controls, which is why most practices start there. Our IT support for accountants service puts these controls in place and keeps them running.

Does an accountancy practice need Cyber Essentials?

Cyber Essentials is not a regulatory requirement for accountants, but it is the recognised baseline and the easiest way to show clients, insurers and your professional body that the basics are in place. ICAEW’s 2026 report describes certificates like it as helpful but often only a starting point, to be underpinned by strong cyber governance. Of the 121 larger firms ICAEW discussed cyber security with during its 2025 monitoring, 99% were aware of the scheme, 54% had completed the basic Cyber Essentials self-assessment and 29% had completed Cyber Essentials Plus (ICAEW Practice Assurance monitoring report 2026).

Our guide to Cyber Essentials cost sets out the fees, and the Cyber Essentials requirements checklist explains what you need in place first. ATS is Cyber Essentials certified and helps practices prepare for it.

What should a practice do if it is breached?

Act quickly, and in this order:

Contain it. Call your IT provider, reset the affected passwords, revoke sessions and remove any forwarding rules or unknown remote access software.
Protect your HMRC access. HMRC says that if you notice suspicious activity on your agent account you should not try to correct anything yourself and report it to its online services team straight away.
Assess whether the ICO needs to know. A notifiable breach must be reported without undue delay and no later than 72 hours after becoming aware of it, and affected individuals must be told directly and without undue delay if it is likely to result in a high risk to them (ICO).
Report fraud. Fraud and cyber crime in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud.
Tell your insurer straight away if you have cyber cover. Many policies require notice before you incur recovery costs.
Learn from it. Record what happened and what changed, which is what your professional body will want to see.

Frequently asked questions

Do accountants need Cyber Essentials?

No regulator requires it, but it is the recognised baseline and some clients and insurers ask for it. ICAEW’s 2026 Practice Assurance report found that 54% of the larger firms it discussed cyber security with had completed the basic Cyber Essentials self-assessment, and 29% Cyber Essentials Plus. See our guide to Cyber Essentials cost.

Is MFA mandatory for HMRC agent accounts?

HMRC is adding multi-factor authentication to agent online services accounts, and says all remaining accounts will be activated automatically between 28 September 2026 and 15 October 2026 (Tax Agents Handbook).

How long must accountants keep anti-money laundering records?

Under regulation 40 of the Money Laundering Regulations 2017, customer due diligence records must be kept for five years from the end of the business relationship, or from completion of an occasional transaction (legislation.gov.uk).

Do accountancy firms have to report a data breach?

If a personal data breach is notifiable, it must be reported to the ICO without undue delay and within 72 hours of becoming aware of it. If it is likely to result in a high risk to the people whose data is involved, they must be told directly and without undue delay too (ICO).

How much does cyber security cost for a small accountancy practice?

With ATS, practices handling client financial data typically sit on Complete IT and security at £55 to £90 per user per month, excluding VAT, which includes managed cyber security, Microsoft 365 management and independent backup. The full breakdown is on our IT support pricing page.

Sources

DSPT for Care Homes: A Plain-English Guide to the Data Security and Protection Toolkit

Posted on 30 September 202613 October 2026 by Jake Boase

The short answer: The DSPT (Data Security and Protection Toolkit) is NHS England’s online self-assessment of how well an organisation protects personal data. Care providers complete a version with 45 mandatory questions to reach Standards Met, and must republish it every year by 30 June; the current 2026-27 toolkit is due by 30 June 2027. It is a contractual requirement if you deliver NHS-funded care, it is needed to use NHS systems such as NHS.net Connect and GP Connect, and it is expected of every CQC-registered care provider.

Last updated: 30 September 2026. Checked against the DSPT website, NHS England guidance and the Better Security, Better Care programme on that date.

In this guide

What is the DSPT?
Do care homes have to complete it?
Deadlines and versions
The status levels
What the 45 questions cover
The IT questions, and who does the work
How Cyber Essentials fits in
Free help for care providers
Frequently asked questions

What is the DSPT?

The Data Security and Protection Toolkit is, in NHS England’s words, “an online self-assessment tool that enables organisations to measure and publish their performance against the National Data Guardian’s ten data security standards”. You answer questions about how your organisation handles personal information and protects its IT, upload or describe your evidence, and publish the result. Published statuses can be looked up on the DSPT website, so commissioners and NHS partners can check yours.

Health organisations such as NHS trusts now complete a longer version aligned to the NCSC’s Cyber Assessment Framework. Adult social care is not part of that change: NHS England says the change affects a specific group of large health and care organisations, and social care providers, GPs, dentists and pharmacies still complete the assertion and evidence version of the toolkit.

Do care homes have to complete the DSPT?

It depends on how you work with the NHS, but in practice almost every care provider should complete it. The position is:

Your situation	What applies
You deliver care under the NHS Standard Contract, for example continuing healthcare	A contractual requirement to complete and publish the DSPT every year
You want NHS.net Connect (formerly NHSmail)	You need at least Approaching Standards
You want GP Connect, a shared care record or proxy access to GP records	You need Standards Met
You want to be counted as fully digitised under the government’s Digitising Social Care programme	You need Standards Met plus an assured digital social care record
You hold local authority contracts	Some councils require it in their contracts, so check yours
None of the above	Strongly recommended, and increasingly expected by CQC

Sources: NHS Standard Contract 2026/27, the DSPT access to shared systems guidance, GOV.UK and Better Security, Better Care.

The NHS Standard Contract is explicit: “The Provider must complete and publish an annual information governance assessment in accordance with, and comply with the mandatory requirements of, the NHS Data Security and Protection Toolkit” (General Condition 21.2, 2026/27). Official sources differ on whether every other care provider is obliged to complete it: the Digitising Social Care programme says all CQC-regulated adult social care providers must, while Better Security, Better Care describes it as strongly recommended. Either way, the safe assumption is that it is expected.

CQC links it directly to leadership. Its Well-led quality statement on governance lists “Cyber security and data security and protection toolkit (DSPT)” as a topic inspectors look at (CQC assessment framework). CQC is piloting new sector-specific assessment frameworks in 2026, so the exact wording may change.

When is the DSPT deadline?

The deadline is 30 June every year. A new version of the toolkit is released each year, usually in September: the 2026-27 version (version 9) was released in September 2026, and NHS England confirms that the deadline is 30 June 2027.

Publishing once is not enough. Your assessment must be reviewed, updated and republished at least once a year, otherwise it goes out of date and no longer counts, as Digital Care Hub explains. Many providers leave it until June; starting in the autumn gives time to fix the IT gaps properly rather than writing an action plan for them.

What are the DSPT status levels?

When you publish, the toolkit gives you one of these statuses, set out in the DSPT help pages:

Status	What it takes	Notes for care providers
Approaching Standards	The 26 questions mandatory at this level, plus an uploaded action plan	Available to social care as a one-off, for your first publication only; you cannot republish at this level
Standards Met	All 45 mandatory questions answered	The level to aim for, and the one needed for GP Connect and shared care records
Standards Exceeded	Standards Met plus a current Cyber Essentials Plus certificate recorded in your profile	Shows the strongest assurance to commissioners

Question counts for 2026-27 from Digital Care Hub; status definitions from the DSPT help pages.

What do the 45 mandatory questions cover?

Digital Care Hub groups the care provider questions into four areas. These are the main things you will need to show for 2026-27, with the question numbers used in the toolkit. Always check the exact wording in the toolkit itself, because it changes each year.

Staffing and roles

Security owned and directed by senior leaders, with regular discussion at that level (1.1.5).
Data security requirements in every employment contract and volunteer agreement (2.2.1).
Data security and cyber security covered at induction (2.1.1).
At least 95% of staff, directors, trustees and volunteers trained in data security and protection in the last twelve months (3.2.1).

Policies and procedures

Your ICO registration number (1.1.1).
An up-to-date information asset register and record of processing activities (1.1.2).
A privacy notice, data protection policies and a records retention and destruction process.
A list of your suppliers, and assurance that your IT suppliers take cyber security seriously (10.1.2 and 10.2.1).

Data security

A system for reporting data breaches (6.1.1). Incidents are reported through the toolkit, and a notifiable breach must reach the ICO without undue delay, normally within 72 hours.
A business continuity plan that covers data and cyber security (7.1.2), which has been tested (7.2.1).
Emergency contact details kept somewhere you can reach them if your systems are down (7.3.2).

IT systems and devices

This is often the section where care providers need help, because it depends on how your IT is set up. It is covered in detail below.

Which DSPT questions are about IT, and who does the work?

Many of the mandatory questions are about devices, accounts, backups and software. Someone in your organisation completes the toolkit, but the evidence for these usually has to come from whoever runs your IT:

Question	What it asks	What your IT provider should give you
4.2.4	Access removed or changed when staff leave or change role	A leavers process and a record that accounts are disabled promptly
4.5.3	Multi-factor authentication on all remotely accessible accounts	MFA enforced on Microsoft 365, email and remote access, with a report to prove it
4.3.1	Administrators sign an accountability agreement	Separate admin accounts, and a signed agreement for anyone who has one
6.2.1	Up-to-date antivirus on all devices	Managed endpoint protection with a device report
7.1.1	A register of your digital assets	An up-to-date list of every laptop, PC, tablet, phone and system
7.3.1 and 7.3.4	Secure backups of important data, and tested restores	Independent backups, including Microsoft 365, and a record of a test restore
8.1.4	All IT systems and software still supported by the manufacturer, or the risks understood and managed	Evidence that nothing is out of support, such as old Windows versions
8.3.5	Updates installed promptly	Patching reports showing security updates are applied
9.1.1	Default router and network passwords changed	Confirmation for every router, firewall and Wi-Fi access point
9.5.2	Laptops, tablets and removable devices encrypted	BitLocker or equivalent enforced, with a report

Question numbers and summaries from Digital Care Hub’s 2026-27 guidance.

Question 8.1.4 is worth checking now. Windows 10 stopped receiving free security updates in October 2025, so any care office PC still running it needs upgrading or paid extended updates. See our Windows 10 end of life guide.

Email matters too. Emails exchanged with health and social care organisations must meet the secure email standard (DCB1596). NHS.net Connect meets it, and NHS England names Microsoft 365 and Google Workspace as able to meet it when they are configured correctly.

How does Cyber Essentials fit with the DSPT?

Cyber Essentials is not mandatory for the DSPT, but it helps. According to the DSPT FAQs, organisations that hold Cyber Essentials Plus are exempt from some toolkit questions, and the DSPT status rules give Standards Exceeded to organisations with Standards Met and a current Cyber Essentials Plus certificate. The exemptions apply to Cyber Essentials Plus only, as Digital Care Hub explains.

The two overlap heavily: multi-factor authentication, supported software, patching, antivirus and account control appear in both. If you are working towards one, the same IT work counts towards the other. Our Cyber Essentials requirements guide explains the 2026 rules.

Where can care providers get free DSPT help?

The government funds free support through Better Security, Better Care. DHSC has confirmed £21 million to March 2029 to continue it, delivered by Digital Care Hub and the National Care Association. It offers a helpline on 0808 196 4848, templates, e-learning and local support organisations. In our area, the local partner for East and West Sussex and Brighton and Hove is West Sussex Partners in Care.

Take-up is high and rising. By 30 June 2026, almost 76.5% of CQC-registered adult social care services in England had an up-to-date DSPT: 22,429 services, including 12,887 care homes. A DHSC-commissioned survey found that a third of care providers had experienced a cyber incident or unsuccessful attack in the previous three years, and phishing was involved in three quarters of those.

ATS Connection looks after IT, Microsoft 365 and cyber security for care providers across Sussex. For the DSPT, we handle the IT side: multi-factor authentication, patching, encryption, backups and device records, and we give your DSPT lead the evidence they need for those questions. See our IT support for care homes and IT support for healthcare, or book a free IT review to find out where you stand.

Frequently asked questions

What is the DSPT?

The Data Security and Protection Toolkit is NHS England’s online self-assessment against the National Data Guardian’s ten data security standards. Organisations answer questions about how they protect personal data and IT, provide evidence and publish the result each year.

Is the DSPT mandatory for care homes?

It is a contractual requirement for providers delivering care under the NHS Standard Contract, and it is needed to use NHS systems such as NHS.net Connect and GP Connect. For other CQC-registered providers, the government’s Digitising Social Care programme says it is required, while Better Security, Better Care describes it as strongly recommended. Either way, CQC expects to see it.

When is the DSPT deadline?

30 June every year. The deadline for the 2026-27 toolkit is 30 June 2027. Your assessment must be republished at least annually or it goes out of date.

How many mandatory questions are there for care providers?

For 2026-27, care providers answer 45 mandatory questions to reach Standards Met, and 26 of them are mandatory for Approaching Standards.

What is the difference between Approaching Standards and Standards Met?

Approaching Standards is a one-off status for a care provider’s first publication, needing 26 questions and an action plan. Standards Met needs all 45 mandatory questions, and is required for GP Connect and shared care records.

Does Cyber Essentials count towards the DSPT?

Cyber Essentials Plus exempts you from some DSPT questions, and combined with Standards Met it gives Standards Exceeded. The exemptions are for Cyber Essentials Plus only, but the IT controls in basic Cyber Essentials help with both.

Who can help with the DSPT for free?

Better Security, Better Care offers free help to adult social care providers, including a helpline on 0808 196 4848, templates and local support partners. In Sussex, the local partner is West Sussex Partners in Care.

Sources

10 Signs It Is Time to Change Your IT Support Provider

Posted on 14 July 202613 October 2026 by Jake Boase

Most businesses wait far too long to change their IT support provider. Not because they are happy, but because switching sounds like a hassle, and the devil you know feels safer than the devil you do not.

That instinct is usually wrong. Poor IT support does not stay the same. It quietly gets worse, and the cost of putting up with it compounds.

Here are the signs it is time to move, and what a good provider should look like instead.

1. You only hear from them when something breaks

This is the biggest one. If your IT company only appears when you raise a problem, they are not managing your IT. They are reacting to it.

A proper managed IT service monitors your systems around the clock and fixes most issues before you know they exist. Failing hard drives, backups that have quietly stopped running, machines missing security updates. All of it should be caught in the background. If every problem you have is one you found yourself, you are paying for a service you are not receiving.

2. Nobody knows your business

You explain your setup from scratch every time you call. You speak to a different person each time. Nobody knows which server matters, which member of staff is travelling, or why the Tuesday morning report is critical.

Good support is not just technical. It is knowing the business well enough to prioritise correctly.

3. Response times are vague, or promised but not delivered

“We will look at it as soon as we can” is not a response time. If there is no guaranteed timeframe in your contract, there is no commitment.

Worse is a provider who promised a response time and quietly stopped meeting it. If nobody is measuring, nobody is accountable.

4. The same problems keep coming back

A printer that fails every month. A machine that needs rebooting every week. An email issue that gets patched and then returns.

Recurring problems mean symptoms are being treated, not causes. A good provider fixes it properly the first time and tells you when the real answer is replacing something rather than nursing it along.

5. Your staff have stopped raising issues

This is the most expensive sign, and the hardest to spot, because it looks like everything is fine.

When support is slow, unfriendly or billed by the hour, people simply stop asking. They struggle on with the slow laptop. They work around the broken process. They lose an hour a week each and nobody ever logs a ticket. The support bill looks healthy while productivity quietly bleeds away.

If your team rolls their eyes at the mention of IT, that is your answer.

6. You are not sure your backups actually work

Ask your provider a simple question: when did you last test that our backup restores?

Having a backup and having a backup that works are different things. Plenty of businesses discover, at the worst possible moment, that the backup has been silently failing for months. Proper backup and disaster recovery is tested regularly, and you should be told the result.

7. Nobody has mentioned security in a year

Cyber threats aimed at small businesses have grown sharply, and the tools to defend against them have moved on. If your provider has not talked to you about multi factor authentication, staff training, email security or Cyber Essentials, they are not thinking about your risk.

Silence on security is not a sign that you are safe. It is a sign that nobody is looking. If you are unsure where you stand, a free cyber security audit will tell you.

8. Every invoice is a surprise

You do not know what next month will cost. Small jobs appear as line items you did not expect. You feel a flicker of anxiety before opening the bill.

IT should be a predictable monthly cost you can budget for, not a series of unwelcome surprises. Our guide to how much IT support costs sets out what you should expect to pay and what should be included.

9. They cannot tell you what you have

Ask for an inventory of your devices, your licences, your warranties and your network setup. A good provider produces it within a day, because they maintain it as a matter of course.

If nobody can tell you what you own or how it is configured, nobody is really in control of your IT, and a serious incident will be far harder to recover from.

10. They never suggest anything

You have never had a conversation about where your IT is heading. Nobody has flagged the ageing server, suggested a better way of working, or planned ahead with you.

A provider should bring you ideas, not just fix what you report. If they are purely reactive, you are the one doing the thinking, and you already have a business to run.

What good actually looks like

Good business IT support should offer all of the following as standard:

Proactive monitoring around the clock, so most problems never reach you
A guaranteed response time, written into the contract
Unlimited support, so nobody hesitates to ask for help
Backups tested regularly, with the results reported to you
An active security conversation, not silence
A predictable monthly cost with no surprises
A named team who know your business
Regular reviews where they tell you what is coming, not just what broke

But is switching not a nightmare?

This is the fear that keeps businesses stuck, and it is largely unfounded. A competent handover is designed to be invisible to your staff. We have written more about how switching IT provider works in practice.

Here is how it should work:

Audit. Your new provider documents everything you have: devices, licences, servers, network, backups and accounts.
Plan. They agree a switchover date with you and identify anything that needs fixing first.
Deploy. Monitoring, security and support tools are rolled out quietly in the background, usually with no disruption at all.
Handover. Access is transferred from your old provider. A good new provider handles that conversation so you do not have to.
Go live. Your team gets one email telling them who to call. That is usually the only change they notice.

Most businesses are fully switched within two to four weeks, without downtime. The disruption you are imagining is almost always smaller than the disruption you are already living with.

Frequently asked questions

How do I know if my IT support is bad?

The clearest test is whether your provider is proactive or reactive. If they only contact you when you raise a problem, if the same issues keep recurring, if backups are never tested and security is never discussed, the service is falling short regardless of how pleasant the people are. For a quick, objective read, our free IT and cyber benchmark scores your setup in a few minutes.

How difficult is it to change IT support provider?

Less difficult than most people expect. A proper handover takes two to four weeks and should cause no downtime. Your new provider audits your systems, deploys their tools in the background, handles the transfer of access from the outgoing provider, and switches you over. For most staff, the only change is who they contact.

Am I tied into a contract with my current IT provider?

Many IT contracts run on rolling monthly or annual terms with a notice period, commonly 30 to 90 days. Check your agreement for the notice clause. A new provider can usually begin the audit and preparation during your notice period, so no time is wasted.

Will my current provider make the handover difficult?

Occasionally, but rarely. Most behave professionally. Where they do not, a good incoming provider knows how to work around it and will manage that conversation on your behalf rather than leaving you in the middle of it.

When is the right time to change IT support provider?

Sooner than most businesses do. If several of the signs above sound familiar, the cost of staying is already higher than the cost of moving, and it grows every month. There is no advantage to waiting for a serious incident to force the decision.

Thinking about a change?

We have supported businesses across Chichester, Worthing, Arundel and West Sussex since 2015. We are Cyber Essentials certified and a Microsoft Partner, and we look after architects, engineers, hotels, veterinary practices and property firms across the region.

If any of the above sounds like your current setup, book a free IT review. We will look at what you have, tell you honestly what is wrong with it, and you can decide what to do next. No obligation and no hard sell.

How Much Does Outsourced IT Support Cost in the UK?

Posted on 7 July 202613 October 2026 by Jake Boase

How much does outsourced IT support cost in the UK? For most businesses it is charged as a fixed monthly fee, usually per user, and commonly ranges from around £30 to £100 per user per month depending on the level of cover and security you need. That predictable, per-user model is one of the main reasons businesses move away from ad-hoc fixes and expensive in-house hires. In this guide we break down what drives the outsourced IT support cost, what should be included, and how to work out a realistic budget for your business.

What does outsourced IT support cost?

Outsourced IT support, sometimes called managed IT support, is almost always priced as a recurring monthly fee rather than a one-off charge. The most common model is per user, per month, which covers everything a member of staff needs: their devices, accounts, security and support. As a rough guide, UK businesses typically pay somewhere between £30 and £100 per user per month, with the figure depending mainly on how much cover and security is included. A basic helpdesk-only package sits at the lower end, while a fully managed service with layered cyber security, Microsoft 365 management and strategic guidance sits higher. Because it scales with your headcount, the cost stays predictable as you grow. For a wider view of pricing, see our guide on how much IT support costs.

What is included in the cost?

A good outsourced IT support package should be genuinely all-inclusive, so you are not hit with extra charges every time you need help. Typically the monthly fee covers:

An unlimited UK helpdesk with fast response times
Proactive monitoring and maintenance that prevents issues
Managed cyber security and Cyber Essentials support
Microsoft 365 management and security
Backup and disaster recovery
Onboarding and offboarding of staff
Strategic guidance, reporting and budgeting

Always check what is and is not included, particularly project work, new hardware and out-of-hours support, which some providers charge for separately.

What affects the price?

Two businesses of the same size can pay quite different amounts. The main factors are:

Number of users. The per-user model means cost scales with your team.
Level of cover. Helpdesk-only is cheaper than a fully managed, proactive service.
Security requirements. Cyber Essentials, compliance and layered protection add value and cost.
Response time guarantees. Tighter service level agreements typically cost more.
On-site visits. Remote-only support is cheaper than regular on-site cover.
Contract length. Longer agreements often come with better monthly rates.

Common pricing models

Outsourced IT support is usually offered in one of a few ways. Per user, per month is the most common and the easiest to budget. Per device suits businesses with shared machines or a high device-to-user ratio. Some providers still sell pay-as-you-go or block hours, which can look cheaper upfront but is unpredictable and reactive by nature, you only get help once something has already gone wrong. For most businesses, an all-inclusive per-user model gives the best value and the fewest surprises.

Is outsourced IT support cheaper than hiring in-house?

Usually, yes. A single in-house IT hire can cost £35,000 to £50,000 a year once you add salary, National Insurance, training and holiday cover, and one person cannot span every discipline. Fully outsourced IT support gives you a whole team across helpdesk, security, cloud and strategy for a fraction of that, with cover built in and no single point of failure. For most small and medium businesses, outsourcing delivers broader expertise and better resilience at a lower total cost. For a full comparison, see our guide to in-house vs outsourced IT support.

How to get an accurate quote

The honest answer is that the only way to get a precise figure is a short review of your current setup, because it depends on your users, systems and security. Book a free IT review or get a quote and we will give you a clear, costed plan with no obligation. You can also see our own IT support packages and pricing, which set out what each level of cover includes and what it costs, or learn more about our fully outsourced IT support service. If you are planning next year’s spending as a whole, our guide to planning your IT budget covers the other costs to include, from Microsoft 365 to the 2027 phone line switch-off.

Frequently asked questions

How much does outsourced IT support cost per user?

As a guide, UK businesses typically pay between £30 and £100 per user per month, depending on the level of cover and security included. A short review is the best way to get an accurate figure for your business.

Is outsourced IT support charged monthly?

Yes. It is almost always a fixed monthly fee, usually per user, which makes it easy to budget and scales up or down as your team changes.

What is included in outsourced IT support?

Typically an unlimited helpdesk, proactive monitoring, cyber security, Microsoft 365 management, backup and strategic guidance. Always check whether project work, hardware and out-of-hours support are included or charged separately.

Is outsourced IT support cheaper than in-house?

For most businesses, yes. You get a whole team of specialists for a fraction of the cost of a single senior hire, with holiday and sickness cover built in and no single point of failure.

Are there setup or onboarding costs?

Some providers charge a one-off onboarding fee to document and take over your systems, while others roll it into the monthly cost. It is always worth asking what onboarding involves and whether it is chargeable.

Can I scale the cost up or down?

Yes. Because most outsourced IT support is priced per user, the cost scales naturally as you add or remove staff, so you only pay for what you use.

Windows 10 End of Life: What UK Businesses Must Do Before 14 October 2026

Posted on 1 July 202613 October 2026 by Jake Boase

The short answer: Windows 10 stopped receiving free security updates on 14 October 2025. Businesses can pay Microsoft for Extended Security Updates (ESU), but the first year of cover ends on 13 October 2026, the price doubles for year two, and joining late means paying for every year you missed. For almost every business the cheaper and safer answer is to upgrade eligible PCs to Windows 11, which is still free, and replace the rest.

Last updated: 30 September 2026. ESU dates and pricing checked against Microsoft’s Extended Security Updates documentation and partner coverage dates on that date.

In this guide

What Windows 10 end of life means
What changes on 14 October 2026
What Extended Security Updates cost
Your three options
Can your PCs run Windows 11?
The risks of staying on Windows 10
How to plan the move
Frequently asked questions

What does Windows 10 end of life mean?

Windows 10 reached its end of support on 14 October 2025. Since then Microsoft has stopped releasing free security updates, bug fixes and technical support for it. The PCs still switch on and work, but every vulnerability discovered since that date stays open unless the device is enrolled in paid Extended Security Updates.

That matters because attackers look for exactly this. Unpatched operating systems are one of the easiest ways into a business network, and the list of known, unfixed Windows 10 flaws grows every month.

What changes on 14 October 2026?

Two deadlines land together in October 2026, and both affect businesses:

Date	What happens	Who it affects
13 October 2026	Year one of Windows 10 Extended Security Updates ends	Businesses paying for ESU on Windows 10 PCs
14 October 2026	Year two of ESU begins, at double the year-one price	Anyone who wants Windows 10 security updates to continue
13 October 2026	Windows 11 version 24H2 stops receiving security updates on Home and Pro	Businesses that upgraded to Windows 11 but have not updated since

ESU coverage dates from Microsoft’s partner documentation; Windows 11 dates from Microsoft’s release information.

The last row catches out businesses that think they are finished. Upgrading to Windows 11 is not a one-off: each annual version has its own support end date. Our Windows 11 for business guide lists every version and date.

How much do Windows 10 Extended Security Updates cost?

For businesses, Microsoft charges $61 per device for year one, and the price doubles every year for a maximum of three years. Microsoft publishes business ESU pricing in US dollars only; if you buy through a UK Microsoft partner you will be invoiced in pounds at the partner’s price.

ESU year	Cover runs	Price per device (Microsoft list)	Cumulative cost if you join this year
Year one	15 October 2025 to 13 October 2026	$61	$61
Year two	14 October 2026 to 12 October 2027	$122	$183 (years one and two)
Year three	13 October 2027 to 10 October 2028	$244	$427 (all three years)

Sources: Microsoft Learn, Extended Security Updates for Windows 10, and Partner Center ESU coverage dates.

The column on the right is the part most businesses miss. Microsoft states that ESUs are cumulative: “If you decide to purchase the program in Year Two, you have to pay for Year One too.” So a PC that joins ESU in October 2026 costs three times the year-one price, just to stay patched until October 2027. Devices must also be running Windows 10 version 22H2 to receive ESU updates.

For comparison, the Windows 11 upgrade itself costs nothing on an eligible PC. On most machines, ESU only makes sense for a device that genuinely cannot be moved yet, such as one running software that has no Windows 11 version.

There is one exception worth knowing: Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop get ESU at no extra cost, and Windows 10 PCs connecting to Windows 365 Cloud PCs are covered while the subscription is active.

What are your options?

Every Windows 10 PC in your business falls into one of three groups:

Option	When it fits	Cost	Watch out for
Upgrade to Windows 11	The PC meets Microsoft’s requirements	Free licence; time to plan and test	Check business applications and printers first
Replace the PC	The PC fails the requirements or is near the end of its life	New hardware	Buy to a sensible spec so it lasts five years
Pay for ESU	The PC cannot move yet for a specific reason	Doubles each year and is cumulative	A bridge, not a plan; ends in October 2028

Microsoft confirms the upgrade from Windows 10 to Windows 11 is free on eligible PCs. Your data, applications and settings normally carry across, although we always recommend testing business-critical software on a pilot machine first.

Can your PCs run Windows 11?

A PC needs to meet all of Microsoft’s Windows 11 requirements:

A compatible 64-bit processor on Microsoft’s supported list. For the current versions of Windows 11 that broadly means Intel 8th generation Core or AMD Ryzen 3000 series and newer.
At least 4GB of RAM and 64GB of storage.
UEFI firmware with Secure Boot capability.
Trusted Platform Module (TPM) 2.0.
A DirectX 12 compatible graphics card with a WDDM 2.0 driver.

Many business PCs bought since around 2018 pass, and sometimes the only blocker is TPM or Secure Boot switched off in the firmware settings, which is a quick fix. Microsoft’s free PC Health Check app will tell you for a single machine. For a whole office, your IT provider can pull a report across every device at once.

Treat the minimums as a floor. For business use we recommend at least 16GB of RAM and a solid-state drive, so a PC that only just passes may still be worth replacing.

What are the risks of staying on Windows 10?

Staying on Windows 10 without ESU creates problems well beyond the PC itself:

Unpatched vulnerabilities. Every security flaw found since October 2025 stays open, and attackers actively scan for unsupported systems.
Cyber Essentials. The current requirements say unsupported software must be removed or isolated from the internet in a separate sub-set. A Windows 10 PC without ESU is unsupported software, so it will fail the assessment if it is in scope. See our Cyber Essentials requirements guide.
Cyber insurance. Insurers commonly ask whether your systems are supported and patched. An unsupported operating system can make a claim harder, so check your policy wording.
Software support. Microsoft 365 Apps still receive security updates on Windows 10 until 10 October 2028, but Microsoft treats Windows 10 as unsupported for them and feature updates end with Version 2608. Other vendors are withdrawing support too.

How should a business plan the move?

With the ESU price about to double, the aim is to have as few Windows 10 PCs as possible left by 13 October 2026, and a firm date for the rest. A practical plan:

Audit every device: its age, processor, TPM, RAM, disk and whether it is still on Windows 10.
Sort into upgrade, replace or bridge. Only put a device on ESU if there is a specific reason it cannot move yet, and write that reason down.
Test first: line-of-business software, printers, scanners and VPN on one or two pilot machines.
Back up anything stored locally, and make sure OneDrive is syncing desktops and documents.
Roll out in waves, out of hours where possible, so nobody loses a working day.
Harden as you go: turn on BitLocker, check multi-factor authentication and bring devices under central management.
Keep Windows 11 current, so PCs move to each new version before the old one loses support.

ATS Connection handles Windows 10 to 11 migrations for businesses across Sussex and the UK, from the device audit to the rollout, as part of our managed IT services or as a one-off IT consultancy project. If you are not sure where you stand, our free IT review covers your devices, network and Microsoft 365, and tells you plainly what to fix first. You can also call us on 01903 255 159.

Frequently asked questions

Is Windows 10 still supported?

No. Windows 10 reached end of support on 14 October 2025. It only receives security updates on devices enrolled in Microsoft’s paid Extended Security Updates programme.

When does Windows 10 ESU year one end?

Year one of Extended Security Updates covers 15 October 2025 to 13 October 2026. Year two runs from 14 October 2026 to 12 October 2027, and year three ends on 10 October 2028.

How much does Windows 10 ESU cost for a business?

Microsoft lists business ESU at $61 per device for year one, doubling each year to $122 and then $244. It is cumulative, so a device that joins in year two costs $183 in total. Microsoft publishes these prices in US dollars; UK partners invoice in pounds.

Can I still upgrade from Windows 10 to Windows 11 for free?

Yes. Microsoft states that the upgrade from Windows 10 to Windows 11 is free on eligible PCs.

Will Windows 10 pass Cyber Essentials?

Not without Extended Security Updates. Cyber Essentials requires software in scope to be supported by its vendor, so an unsupported Windows 10 PC must be upgraded, covered by ESU, removed, or isolated from the internet in a separate sub-set.

What happens if I do nothing?

The PCs keep working, but they receive no security fixes, which makes them an easy target, can cause a Cyber Essentials failure and may complicate an insurance claim. The longer you wait, the more ESU costs if you need it.

Does Microsoft 365 still work on Windows 10?

Yes, for now. Microsoft 365 Apps receive security updates on Windows 10 until 10 October 2028, but Microsoft treats Windows 10 as unsupported for them and feature updates end with Version 2608.

Sources

Why Outsource Your IT Support? Benefits for UK Businesses

Posted on 1 July 202613 October 2026 by Jake Boase

Why outsource your IT support? In short, because it gives your business a whole team of IT specialists, stronger cyber security and predictable costs, without the expense and risk of building an in-house team. For most growing UK businesses, outsourcing means better IT and less hassle for less money. In this guide we look at exactly what outsourcing means, the main benefits, and how to know when it is the right move.

What does it mean to outsource your IT support?

Outsourcing your IT support means handing the running of your technology to a specialist provider, or managed service provider, instead of relying on an internal hire or an unofficial “office IT person”. The provider looks after your helpdesk, security, monitoring, Microsoft 365 and strategy for a fixed monthly fee. It is the model most small and medium businesses now use, because it gives them enterprise-grade IT without an enterprise budget. Our guide to outsourced IT support explains how the service works in full.

Why do businesses outsource IT support?

The reasons vary, but the benefits are consistent. The main ones are:

Lower, predictable costs. One monthly fee replaces salaries, training and the cost of downtime, and it is easy to budget.
A whole team of specialists. Instead of one person who cannot know everything, you get expertise across helpdesk, security, cloud and strategy.
Stronger cyber security. Managed protection, cyber security, Cyber Essentials and staff awareness are built in as standard.
Proactive support and less downtime. Problems are prevented and fixed early, rather than after they have already cost you time and money.
Scalability. The service grows with you, adding or removing users as your team changes.
Focus on your core business. Your team spends time on the work that matters, not wrestling with IT.
Resilience. Holiday and sickness cover are built in, with no single point of failure if a key person leaves.

When should you outsource your IT?

Most businesses start thinking about outsourcing when their current arrangement starts to hold them back. Common triggers include the same IT problems recurring without ever being fixed, relying on one person who has become a risk, cyber security and Microsoft 365 not being actively managed, slow staff onboarding, or simply having no clear IT strategy or budget. If any of those sound familiar, it is usually a sign that a proactive, managed approach would pay for itself.

Is outsourcing right for your business?

Outsourcing suits businesses of almost any size, but it is especially valuable for small and medium firms that cannot justify a full in-house IT team. Larger organisations often use a hybrid model, keeping someone in-house for day-to-day needs and outsourcing the specialist, security and out-of-hours work. The right answer depends on your size, sector and how much you rely on technology, which is exactly what a short review will tell you. If cost is your main question, see our guide on how much outsourced IT support costs, and if you are weighing up hiring instead, read our comparison of in-house vs outsourced IT support.

How to choose an outsourced IT provider

Look for a provider that is proactive rather than reactive, security-led and genuinely accountable, with named engineers and clear reporting. Local matters too: a provider on your doorstep can be on site when needed and understands your area. As an example, our IT support in Chichester and across West Sussex is delivered by a local team, backed by Cyber Essentials certification and Microsoft Partner status.

Ready to outsource your IT?

Start with a free, no-obligation review of your current setup, security and support. We will show you exactly where the gaps and opportunities are, with a clear plan. Book a free IT review or get a quote to see what outsourcing could do for your business.

Frequently asked questions

Why do businesses outsource IT support?

To get a whole team of specialists, stronger security and predictable costs without the expense and risk of hiring and managing an in-house IT team.

Is outsourcing IT support cheaper than in-house?

Usually, yes. You get a whole team for less than the cost of a single senior hire, with holiday and sickness cover built in and no single point of failure.

Will I lose control of my IT if I outsource?

No. You keep ownership of your systems, data and decisions. The provider runs the day-to-day work and gives you clear reporting and strategic guidance.

Is outsourced IT support more secure?

A good provider makes your business more secure, not less, with managed protection, Cyber Essentials support and monitoring built in as standard.

When is the right time to outsource IT?

When IT problems keep recurring, you rely on one person, security is not actively managed, staff onboarding is slow, or you have no clear IT strategy or budget.

What size business should outsource IT support?

Any size can benefit, but it is especially valuable for small and medium businesses that cannot justify a full in-house IT team. Larger teams often use a hybrid model.

In-House vs Outsourced IT Support: Which Is Right for You?

Posted on 22 June 202613 October 2026 by Jake Boase

In-house vs outsourced IT support is one of the first big decisions a growing business faces. Do you hire someone to look after your IT internally, or hand it to a specialist provider? Both models have their place, but for most small and medium businesses, outsourced IT support wins on cost, expertise and resilience, while larger teams often use a hybrid of the two. This guide compares the two approaches so you can choose the right one for your business.

What is in-house IT support?

In-house IT support means employing one or more people to manage your technology directly. The upside is someone on site who knows your business intimately and is always on your team. The downsides are significant, though: a single hire is expensive once you add salary, National Insurance, training and holiday cover, one person cannot be an expert in everything from networking to cyber security, and if they are off sick or leave, you have a single point of failure with no cover.

What is outsourced IT support?

Outsourced IT support means a specialist provider runs your IT for a fixed monthly fee, covering the helpdesk, security, monitoring, Microsoft 365 and strategy. Instead of one person you get a whole team, with cover built in and broader expertise, usually for less than the cost of a single senior hire. Our guide to outsourced IT support explains how the service works in detail. If you are still deciding, our guide on why outsource your IT support covers the benefits in full.

In-house vs outsourced: the cost comparison

Cost is often the deciding factor. A single in-house IT hire typically costs £35,000 to £50,000 a year once you include salary, National Insurance, training and cover, and you still need to buy tools and monitoring on top. Outsourced IT support is charged as a predictable monthly fee, usually per user, and gives you a whole team for a fraction of that. For a full breakdown, see our guide on how much outsourced IT support costs.

Expertise and cover

This is where outsourcing really pulls ahead. Modern IT spans helpdesk support, cyber security, cloud, Microsoft 365, networking and strategy, and no single person can master all of it. An outsourced provider brings specialists across every discipline, plus holiday and sickness cover so support never stops. An in-house hire, by contrast, is one person with one set of skills and no backup.

Security

Cyber security is now too important and too specialised to leave to one generalist. A good outsourced provider builds managed cyber security, Cyber Essentials and monitoring into the service as standard, with dedicated tools and up-to-date expertise. In-house teams can do this well, but usually need external specialists to fill the gaps, which adds cost.

The hybrid model

It is not always either or. Many larger organisations use a hybrid, or co-managed, model: they keep someone in-house for day-to-day, hands-on needs and outsource the specialist, security and out-of-hours work to a provider. This gives you the best of both, an on-site presence backed by a full external team, and it is often the right answer once you get past a few hundred users.

Which is right for your business?

For most small and medium businesses, outsourced IT support delivers broader expertise, better security and greater resilience at a lower total cost than an in-house hire. Very large organisations, or those with highly specialist needs, may prefer a hybrid model. The best way to decide is to weigh up your size, sector and how much you rely on technology, which a short review will make clear.

Not sure which model fits?

We can help you weigh it up. Book a free IT review or get a quote, and we will give you an honest, costed recommendation for your business, whether that is fully outsourced or a hybrid approach.

Frequently asked questions

Is in-house or outsourced IT support better?

For most small and medium businesses, outsourced IT support is better on cost, expertise and resilience. Larger organisations often use a hybrid of in-house and outsourced.

Is outsourced IT cheaper than in-house?

Usually, yes. You get a whole team for less than the cost of a single senior in-house hire, with cover built in and no single point of failure.

What are the downsides of in-house IT?

Cost, limited breadth from a single person, and a single point of failure with no cover if they are off sick or leave.

Can I combine in-house and outsourced IT?

Yes. A hybrid or co-managed model keeps someone in-house for day-to-day needs and outsources the specialist, security and out-of-hours work to a provider.

Does outsourcing mean losing control of my IT?

No. You keep ownership of your systems, data and decisions. The provider handles the day-to-day work and reports back to you.

Which is more secure, in-house or outsourced?

A good outsourced provider usually offers stronger, more consistent security, with dedicated tools, monitoring and up-to-date expertise built into the service.