Category: IT Support

The short answer: A managed service provider (MSP) is a company that takes ongoing responsibility for running some or all of your IT, for a fixed monthly fee under a written service agreement. Instead of calling someone when things break, the MSP monitors, maintains and secures your systems continuously, answers your team’s support requests, and plans ahead. Most UK MSPs charge per user per month, and the service level agreement sets out exactly what they are responsible for and how quickly they respond.

Last updated: 29 September 2026. Written by the ATS Connection team from how we run our own managed service, with UK government and NCSC sources linked below.

In this guide

• What is a managed service provider?
• How does an MSP work, step by step?
• The tools behind a managed service
• Service levels and contracts
• How MSPs charge
• MSP vs break-fix, MSSP and in-house IT
• How MSPs are being regulated in the UK
• Questions to ask an MSP
• Frequently asked questions

What is a managed service provider?

The UK government’s working definition is useful because it is precise. In its factsheet on the Cyber Security and Resilience Bill, a managed service is one provided under contract for the “ongoing management of information technology systems” of a customer, which can include support and maintenance, monitoring and active administration, and which involves the provider connecting to the customer’s systems, on site or remotely.

Three words in that definition separate an MSP from other IT companies: ongoing (not one-off jobs), management (responsibility, not just advice) and access (the MSP works inside your systems). For a small or medium business, the MSP is effectively the IT department.

Most MSPs cover the core of business IT: user support, devices, Microsoft 365, networks, security and backups. Many also manage phones and broadband. Some specialise, for example a managed security service provider (MSSP) that only runs cyber security.

How does an MSP work, step by step?

A managed service follows the same lifecycle with every client. This is how it works at ATS Connection, and a good MSP should be able to describe its own version just as clearly.

1. Discovery and audit

Before taking over, the MSP audits what you have: every device, user, licence, application, network component and supplier, plus how data is backed up and who has admin access. This produces the documentation your business may never have had, and a list of risks to fix first.

2. Secure handover

Admin access is transferred from the previous provider or internal person, passwords are changed and stored in a secure vault, monitoring and security agents are installed on every device, and old access is removed. This is the most sensitive stage, because for a short period two parties may hold the keys.

3. Remediation

The urgent findings from the audit get fixed: multi-factor authentication switched on, missing updates installed, unsupported devices replaced or isolated, backups tested. Our onboarding typically takes around three weeks from discovery to fully live, depending on size.

4. Business as usual

From then on, two streams of work run in parallel. The reactive stream is the helpdesk: staff raise requests by phone, email or portal, and engineers resolve them, remotely where possible. The proactive stream is the scheduled work: patching, monitoring alerts, backup checks, security reviews, licence tidy-ups and replacing hardware before it fails.

5. Review and planning

A good MSP reports back regularly on tickets, security status and risks, and meets you to plan the next year’s budget and priorities. This is what turns IT from a cost you tolerate into something that is actually managed.

What tools does an MSP use?

MSPs run on a standard set of platforms. Knowing what they are helps you ask sensible questions:

Tool	What it does	Why it matters to you
RMM (remote monitoring and management)	Monitors every device and deploys updates and scripts remotely	Problems get spotted before users notice, and patching is provable
PSA or ticketing system	Logs every request, response time and resolution	You can see what was asked, when, and how quickly it was fixed
Endpoint detection and response (EDR)	Detects and stops malicious behaviour on devices	Goes beyond traditional antivirus against ransomware
Backup platform	Backs up devices, servers and Microsoft 365	Independent copies you can restore from
Password vault and documentation	Stores admin credentials and system records securely	Your IT knowledge is not in one person’s head
Microsoft 365 admin tools (Intune, Entra ID)	Manages devices, identities and access policies	Lets the MSP enforce MFA and secure lost devices

Because these tools give the MSP powerful access to every client, the MSP’s own security is critical. That is exactly why the government is now regulating MSPs, covered below.

What should an MSP’s service level agreement cover?

The service level agreement (SLA) is where the service is defined. A clear SLA covers:

• Scope: which users, devices, systems and locations are covered, and what is excluded.
• Response times by priority, and ideally resolution targets. Response means a human engineer starts working on it, not an automatic email.
• Support hours and what happens out of hours.
• Responsibilities on both sides, including who owns admin accounts and who approves changes.
• Security obligations: patching timescales, backups, how the MSP protects its own access, and how quickly it tells you about an incident.
• Reporting and reviews: how often you get reports and meetings.
• Term and exit: notice period, and the documentation and handover you receive if you leave.

Our own service is unlimited during business hours with no per-ticket charges, and the response time is guaranteed in writing in every agreement. Our average response time is under 15 minutes.

How do MSPs charge?

There are three common pricing models:

• Per user, per month. The most common model for small businesses, because it scales with headcount and covers each person’s laptop, phone and accounts.
• Per device, per month. Used where devices outnumber people, such as shared workstations or kiosks.
• Tiered packages. A basic support tier and higher tiers that add security, backup and compliance.

In the UK, managed IT support usually costs £30 to £90 per user per month. We publish ours: Core support from £30 per user per month and Complete IT and security from £55, with licences and hardware billed at cost. See our IT support pricing and our guide to outsourced IT support costs.

How does an MSP compare with break-fix, an MSSP or in-house IT?

Option	What you get	Strengths	Watch out for
MSP	Ongoing management of your IT for a fixed fee	Predictable cost, proactive, team of skills	Quality varies; check the SLA and security
Break-fix provider	Help when something breaks, paid hourly	No commitment	No prevention, unpredictable bills
MSSP	Specialist managed security, often 24/7 monitoring	Deep security expertise	Does not fix everyday IT issues
In-house IT	Your own employee or team	On site, knows the business	Cost, single point of failure, narrow skills
Co-managed	An MSP working alongside in-house IT	Cover and tools for your IT person	Needs a clear split of responsibilities

We compare these in more depth in in-house vs outsourced IT support and IT outsourcing models explained.

How are MSPs being regulated in the UK?

The Cyber Security and Resilience (Network and Information Systems) Bill will bring medium and large MSPs under UK cyber security regulation for the first time. As of September 2026 it is still going through the House of Lords and is not yet law. The government’s reasoning is that MSPs have “widespread and trusted access” to their customers’ systems, so one compromised MSP can affect many businesses at once.

Under the Bill as published, relevant MSPs would have to register with the regulator, take proportionate measures to manage cyber risk, and report significant incidents within 24 hours with a full report within 72 hours. Small and micro MSPs are exempt, although they can still be designated as critical suppliers. Our guide to the Cyber Security and Resilience Bill explains who is in scope and what it means for small businesses.

Whatever the final rules, the lesson for buyers is the same: the security of your MSP is part of your security. Ask how it protects its own access to your systems.

What questions should you ask an MSP before signing?

The NCSC’s guide to choosing a managed service provider, published in November 2025 for small businesses, covers certifications, security, contracts and incident notification. Drawing on it, ask:

1. Are you certified to Cyber Essentials or Cyber Essentials Plus? The NCSC recommends providers with recognised certifications.
2. How do you secure your own access to our systems, including MFA, least privilege and logging?
3. How quickly will you tell us about a security incident that affects us?
4. Who owns our Microsoft 365 tenant, domain and admin accounts?
5. How are our backups done, and when were restores last tested?
6. What is the guaranteed response time, and what counts as a response?
7. What is included in the fee, and what is billed on top?
8. What happens to our data, documentation and access if we leave?
9. Can we speak to a current client of a similar size?

ATS Connection has been a managed service provider since 2015, supporting more than 100 businesses from Arundel and Chichester, and is Cyber Essentials certified. Find out more about our managed IT services or, if you are considering a move, how switching IT support provider works.

Frequently asked questions

What is a managed service provider (MSP)?

A company that takes ongoing responsibility for running some or all of a business’s IT, such as support, devices, Microsoft 365, networks, security and backups, for a fixed monthly fee under a service agreement.

How does an MSP work?

An MSP audits your IT, takes over admin access securely, fixes urgent risks, then runs a helpdesk for your staff alongside scheduled proactive work such as monitoring, patching and backup checks, with regular reporting and planning reviews.

What does MSP stand for in IT?

Managed service provider. In IT it means a company that manages a business’s technology on an ongoing basis, rather than fixing things only when they break.

How much does an MSP cost?

In the UK, managed IT support typically costs £30 to £90 per user per month, depending on how much security and compliance work is included. Licences and hardware are usually extra.

What is the difference between an MSP and an MSSP?

An MSP manages your IT generally, including everyday support. An MSSP, or managed security service provider, specialises in cyber security, such as round-the-clock threat monitoring, and does not usually fix everyday IT problems.

Will MSPs be regulated in the UK?

The Cyber Security and Resilience Bill proposes bringing medium and large MSPs into regulation, with registration, risk management and incident reporting duties. As of September 2026 the Bill is still in Parliament and not yet law.

Sources

• GOV.UK: Cyber Security and Resilience Bill factsheet, relevant managed service providers
• UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill
• NCSC: Choosing a managed service provider (MSP)
• NCSC: Supplier assurance questions

The short answer: IT outsourcing means paying an external provider to run some or all of your IT. There are three main models. Fully managed hands the whole job to a provider. Co-managed keeps your in-house IT person or team and adds a provider for cover, tools and specialist skills. Selective outsources specific services, most often cyber security, backup or telephony. Most businesses without their own IT staff choose fully managed; businesses with one or two IT people usually get more from co-managed.

Last updated: 29 September 2026. Written by the ATS Connection team from the outsourcing arrangements we run for clients, with government sources linked below.

In this guide

• What is IT outsourcing?
• The three IT outsourcing models compared
• Fully managed IT
• Co-managed IT
• Selective outsourcing
• What you should never outsource
• Which model is right for you?
• Frequently asked questions

What is IT outsourcing?

IT outsourcing is using an external company to deliver IT work that would otherwise be done by your own staff. That can range from the entire IT function, including helpdesk, security, devices and planning, down to a single service such as backups or the phone system.

It is common, particularly for security. The government’s Cyber Security Breaches Survey 2025/2026 found that 44% of micro businesses now use an external cyber security provider, up from 39% a year earlier.

If you are still deciding whether to outsource at all, start with why outsource your IT support and in-house vs outsourced IT support. This guide is about the next question: once you outsource, which model should you use?

How do the three IT outsourcing models compare?

	Fully managed	Co-managed	Selective
Who runs day-to-day IT	The provider	Shared: in-house team and provider	Your team, or nobody
Who your staff call	The provider’s helpdesk	Usually in-house first, provider as backup or second line	Your team, with the provider for its service only
Typical fit	No in-house IT staff	One to a few in-house IT people	Specific gap, such as security or telephony
Cost pattern	Fixed monthly fee per user	Smaller monthly fee for the agreed share	Fee per service
Biggest risk	Choosing a weak provider	Unclear split of responsibilities	Gaps between services that nobody owns

What is fully managed IT?

Fully managed IT means a provider acts as your complete IT department. It answers your staff’s support requests, monitors and patches every device, runs Microsoft 365 and security, manages backups, deals with suppliers and plans your IT budget. You keep ownership and decision-making; the provider does the work and is accountable for it.

This suits most businesses of 5 to 250 people that do not employ IT staff. The price is predictable, typically £30 to £90 per user per month in the UK. See our outsourced IT support service and published pricing.

A local example: at the Norfolk Arms Hotel in Arundel, a listed 37-room hotel, we took on the IT, security and telecoms together, installing a leased line, Wi-Fi across the building and gardens, a VoIP phone system with a handset in every room, and remote monitoring of every device, with the work planned around a hotel that runs at high occupancy all year.

What is co-managed IT?

Co-managed IT is an arrangement where an external provider works alongside your own IT staff, with the responsibilities split between them. The in-house person keeps the local knowledge and the relationships; the provider adds cover, tooling and specialist skills that one or two people cannot realistically hold.

It usually makes sense when:

• Your IT manager is the single point of failure, and holidays or sickness leave the business exposed.
• Your team is buried in support tickets and never gets to projects.
• You need security skills, such as Cyber Essentials, Conditional Access or incident response, that nobody in-house has.
• You want professional monitoring, patching and backup tools without buying and running them yourself.

The single most important part of a co-managed arrangement is a written split of who does what. A typical split looks like this:

Task	In-house IT	Provider
First-line user support	Leads	Overflow and holiday cover
Monitoring, patching and endpoint security	Informed	Leads
Microsoft 365 security policies	Approves	Designs and maintains
Backups and restore testing	Informed	Leads
Line-of-business applications	Leads	Escalation support
IT strategy and budget	Leads	Advises
Security incidents	Informed and involved	Leads the technical response

What is selective IT outsourcing?

Selective outsourcing hands over one or more specific services while the rest stays in-house or unmanaged. The services businesses most often outsource on their own are:

• Cyber security, such as managed endpoint protection, monitoring and Cyber Essentials. See managed cyber security.
• Backup and disaster recovery. See backup and disaster recovery.
• Microsoft 365 administration. See Microsoft 365 services.
• Phones and connectivity, including VoIP and business broadband ahead of the 2027 landline switch-off. See VoIP phone systems.
• Projects, such as office moves, migrations and network upgrades. See IT consultancy.

Selective outsourcing can sit neatly alongside an in-house team. Brighton College has its own network manager; we supplied and rolled out its endpoint antivirus across the whole network, and it now largely runs itself, with alerts sent to the network manager only when action is needed.

Selective outsourcing works well when there is a clear owner for everything else. It goes wrong when the pieces sit with different suppliers and nobody owns the gaps between them: the backup provider assumes the Microsoft 365 provider handles retention, and the Microsoft 365 provider assumes the reverse.

What should you never outsource?

Whichever model you choose, some things should stay with the business:

• Ownership of your accounts. Your Microsoft 365 tenant, domain names and admin credentials should be registered to your business, with the provider given access. Never the other way round.
• Decisions about risk and spend. A provider should advise; the business decides.
• Knowledge of where things are. Insist on documentation you can read and keep, so you can change provider without starting again.
• A right to leave. Check notice periods and what handover you get before you sign.

The NCSC’s guidance on choosing a managed service provider covers the contract and security points in more detail, including certifications, incident notification and exit terms.

Which IT outsourcing model is right for you?

A quick way to decide:

• No IT staff, and IT matters to how you work: fully managed.
• One or two IT people who are stretched or isolated: co-managed.
• A capable IT team with one specific gap: selective, for that gap.
• Very small team with simple needs: fully managed on a lower tier often costs little more than ad hoc support and removes the risk.

ATS Connection provides fully managed IT support, and individual services such as cyber security, Microsoft 365, backup and business phones, for businesses across Sussex and the UK. We have been doing it since 2015 and look after more than 100 businesses. If you are unsure which model fits, a free IT review with one of our senior engineers is a good place to start.

Frequently asked questions

What is IT outsourcing?

Using an external provider to deliver IT work that would otherwise be done by your own staff, from the whole IT function to a single service such as backups or security.

What is co-managed IT?

An arrangement where an external IT provider works alongside a business’s in-house IT staff, with a written split of responsibilities. The provider typically handles monitoring, security, patching and cover, while the in-house team keeps local knowledge and first-line support.

What is the difference between fully managed and co-managed IT?

Fully managed means the provider acts as your complete IT department. Co-managed means the provider shares the work with your own IT staff.

What IT services are most commonly outsourced?

Cyber security, backup and disaster recovery, Microsoft 365 administration, telephony and connectivity, and projects such as migrations. The government’s 2025/2026 breaches survey found 44% of micro businesses use an external cyber security provider, up from 39% the year before.

How much does outsourced IT cost?

Fully managed IT support in the UK typically costs £30 to £90 per user per month. Co-managed and selective arrangements usually cost less because the provider only covers part of the work.

What should stay in-house when you outsource IT?

Ownership of your Microsoft 365 tenant, domains and admin accounts, decisions about risk and budget, and documentation of your systems. These keep you in control and let you change provider if you need to.

Sources

• GOV.UK: Cyber Security Breaches Survey 2025/2026
• NCSC: Choosing a managed service provider (MSP)