Austin Managed IT Services

describe it as taking contractual responsibility for endpoints, servers, network, identity, cloud tenants, backups and help desk for a recurring monthly fee -- and note that the category now blends into security, so most MSPs sell a security stack alongside support

break-fix bills hours after something fails, managed services bills a flat fee to keep it from failing -- explain that the incentives are opposite, which is the actual argument for the model

the provider supplies tooling, after-hours coverage, security operations and specialist depth alongside an existing internal IT person or team rather than replacing them -- explain that it removes the internal team's incentive to resist the deal

per-user covers a person on all their devices, per-device counts endpoints -- explain that per-user usually costs the client more when people carry two devices and less when they carry three, so the honest comparison is effective cost per user either way

RMM is the remote monitoring and management agent on client machines; PSA is the provider's ticketing, contracts and billing system -- and note that RMM's privileged access is exactly why MSP platforms became an attacker target

antivirus matches known bad, EDR records endpoint behavior and enables response, MDR adds humans watching it around the clock -- the distinction that matters commercially is whether anyone is actually monitoring at 2am

define a security operations centre as continuous monitoring and response capability, usually bought as a service at SMB scale -- whether they need it depends on their regulatory exposure and what their cyber insurer requires

three copies, two media, one off-site -- and immutability means the backup cannot be altered or deleted within a retention window, which is the specific control that defeats ransomware attacking the backups

recovery time objective is how long you can be down, recovery point objective is how much data you can afford to lose -- explain that these are business decisions that then set the cost of the backup design, not the other way round

describe the real function -- technology roadmap, budget planning and a structured business review -- and be honest that its value depends entirely on whether the provider brings decisions or a slide deck; ask to see a sample review

stop trusting the network location and verify every request by identity, device health and context -- for a small business it means MFA everywhere, conditional access and least privilege, not a product purchase

explain the program established by the Department of Defense rule effective December 2024, and the levels -- self-assessment at Level 1, generally third-party certification at Level 2 against NIST SP 800-171 -- and say the required level comes from the contract clauses, not a general rule

explain that the amended rule extended information-security-program obligations to non-bank 'financial institutions' including auto dealers, mortgage brokers, tax preparers and collection agencies -- whether a specific business is covered is a definitional question worth checking with counsel

explain SPF, DKIM and DMARC as the authentication chain that proves you sent the mail, and that misconfiguration is a common cause of deliverability problems -- but spam placement has other causes, so diagnose before asserting

pricing depends on the stack included, the environment's condition, compliance requirements and coverage hours -- explain what drives the number and what should be in scope, and say a real figure requires an assessment; do not publish a per-seat price

give the method: count actual devices per person and compare the two structures at their real ratio, then check what happens as headcount changes -- the right structure follows from their device density, not a rule