IT support is the service that keeps a business's technology working and safe to use. It fixes what breaks, handles everyday requests such as a new starter's account, and does the routine work that stops problems coming back: updates, backups, monitoring and records. It covers devices, accounts, email and files, the network, and the vendors behind them.
This guide sets out what IT support covers for a small or growing business, the security basics it should never skip, how it is delivered, the three ways to staff it (in-house, a managed service provider or co-managed), what a service level agreement should say, and how to judge the level of support you need. If you are already weighing up outsourcing, the help desk outsourcing guide covers the business case, pricing and choosing a provider. How a help desk works inside, from support tiers to tickets and metrics, is covered in what an IT help desk is, and the job itself, from duties to pay, in what an IT support specialist does.
What IT support means for a business
"IT support" is used loosely, and offers are hard to compare until you split it into the three kinds of work it contains:
| Kind of work | What it means | Examples |
|---|---|---|
| Incidents | Something stopped working or got worse; restore service fast | Outlook will not open, the Wi-Fi keeps dropping, a laptop will not start |
| Service requests | A routine, predefined ask, handled the same way every time | A new starter's account, access to a shared mailbox, a software install |
| Preventive work | The routine that makes the first two rarer | Updates, monitoring, backup checks, access reviews, fixing repeat faults |
The ITIL 4 framework treats these as separate practices. Incident management restores normal service quickly after a disruption. Service request management handles predefined, user-initiated requests for a service, information or access. Problem management finds the root causes of incidents so they stop recurring.
Break-fix support covers only the first row: you call when something breaks and pay by the hour or by the job. Everything that makes the next incident less likely sits in the third row, which is why two quotes for "IT support" can describe very different services. Two related terms: the help desk (or service desk) is the front door where people report problems and ask for things, and managed IT services means an outside provider takes the whole job on under a contract.
What IT support covers
For a business of up to a few hundred people, the scope usually looks like this. Read it as a checklist: an area nobody owns is a gap.
| Area | What support does |
|---|---|
| Devices | Sets up laptops, desktops, phones and tablets; enrols, encrypts and updates them; repairs and retires them |
| Accounts and identity | One account per person, multi-factor authentication (MFA), password resets, admin rights, single sign-on |
| Microsoft 365 or Google Workspace | Mailboxes, shared drives, licences, sharing settings, retention and mail authentication |
| Network and Wi-Fi | Router and firewall, staff and guest Wi-Fi, remote access, and the internet provider when the line fails |
| Printers and peripherals | Printers and scanners, docking stations, monitors, headsets, meeting-room equipment |
| Business applications | First-line help and access for accounting, CRM or line-of-business software, and escalation to its vendor |
| Security basics | Updates, MFA, malware protection, backups and least-privilege access (next section) |
| Starters and leavers | Accounts, devices and access ready before day one, and removed on the last day |
| Vendors and records | Internet, phone and software vendors, warranties, licences and an asset register |
Devices, from set-up to retirement
Device work follows a lifecycle: buy, enrol, configure, update, repair, retire. Enrolling a laptop or phone in a mobile device management (MDM) platform such as Microsoft Intune, Jamf or Google endpoint management lets support push settings, require encryption, install updates and lock or wipe a lost device without touching it. Microsoft 365 Business Premium, designed for businesses with up to 300 users, includes device management for Windows, Mac, iOS and Android.
Retirement is where lifecycles slip. Windows 10 reached end of support on October 14, 2025, and as of September 2026 Microsoft lists Extended Security Updates for organizations at US$61 per device for the first year, doubling each year, for three years at most. Support tracks which devices are approaching end of support so their replacement is a budget line rather than a surprise. For a single new PC, see how to set up Windows 11 on a new computer.
Accounts, identity, and Microsoft 365 or Google Workspace
For most small businesses, the identity system is the Microsoft 365 or Google Workspace tenant: one account opens email, files and chat and, through single sign-on, other business apps. That makes it the most valuable thing support looks after, and the first to lock down.
- In Microsoft Entra ID, security defaults switch on a preset baseline at no extra cost: every user registers for MFA, administrators must use it, and legacy authentication protocols are blocked. Microsoft points organizations with Entra ID P1 or P2 licences to Conditional Access policies instead.
- In Google Workspace, an administrator rolls out 2-Step Verification and can then enforce it; Google itself is enforcing it for administrator accounts.
- Mail authentication records (SPF, DKIM and DMARC) make your domain harder to spoof, and sharing policies decide whether files can go to anyone with a link.
As of September 2026, both platforms cap their business plans at 300 users: Microsoft 365 Business Premium is designed for up to 300, and Google Workspace Business Starter, Standard and Plus can be bought for at most 300. Past that, enterprise plans apply, and the support work grows with them.
Networks, Wi-Fi, printers and the office
The office network is usually a router and firewall, a Wi-Fi system and a switch. Support keeps their firmware current, keeps guest Wi-Fi apart from staff devices, and applies the firewall rules in the UK's Cyber Essentials requirements: change the default admin password, keep the admin interface off the internet unless there is a documented need and it is protected by MFA or an IP allow list, and block unauthenticated inbound connections by default. When the line fails, support calls the internet provider with the tests already done.
Printers, docks, monitors and headsets produce a steady trickle of small tickets, and they mark where remote support stops: a jammed printer or a dead dock needs hands on site, or a replacement shipped.
Starters, leavers and vendors
Onboarding and offboarding are where IT support meets HR, and where small businesses leak access. A checklist per role covers the account, licences, groups, device, MFA enrolment and app access for a starter, and the reverse for a leaver: disable the account, sign out its sessions, recover or wipe the device, hand over files and mail, remove admin rights. Cyber Essentials requires accounts to be removed or disabled when they are no longer needed, for example when someone leaves, and CISA's guidance for small businesses notes that MFA gaps tend to appear among recently onboarded staff and people who have moved to a new phone. When apps sign in through the Microsoft 365 or Google account, disabling that one account closes most doors at once; every app with its own password needs its own step.
Vendor coordination is the other half. Support keeps the list of who supplies what (internet line, phones, printers, line-of-business software, hardware warranties), holds the contract numbers and support contacts, and deals with those vendors so staff do not have to. ITIL's IT asset management practice covers the same ground: every asset managed through purchase, use and disposal to control cost and risk.
The security basics every support arrangement should include
Government baselines for small organizations agree on a short list, and it belongs inside IT support rather than in a separate project. The same habits from each user's side, from passkeys to spotting phishing, are in our cyber security tips. The UK's Cyber Essentials scheme, which the government recommends as the minimum standard for organizations of all sizes, rests on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Canada's baseline cyber security controls, written for organizations with fewer than 500 employees, and CISA's guidance for small businesses cover the same ground and add backups and a written incident response plan.
| Basic | What it means in practice |
|---|---|
| Security updates | Automatic updates on; fixes for critical or high-risk vulnerabilities installed within 14 days; unsupported software removed |
| MFA | Enforced by policy rather than left to each user; always on for cloud services and administrator accounts |
| Admin rights | Removed from everyday laptops; separate admin accounts used only for admin work |
| Malware and encryption | Built-in malware protection and firewall active on every device; disk encryption on every laptop |
| Backups | Essential data backed up automatically, one copy kept apart, restores tested |
| Account removal | Accounts and special privileges removed when someone leaves or changes role |
The 14-day rule and MFA on every cloud service come from Cyber Essentials v3.3, published in April 2026. CISA adds an order of work: fix what is in its Known Exploited Vulnerabilities (KEV) Catalog first, because attackers are using those flaws in real attacks. It also tells IT teams to enforce MFA with technical controls rather than trust everyone to enrol, and to take admin rights off user laptops, so that a user tricked into running malicious software cannot install it.
MFA is the gap most often left open. In the UK government's Cyber security breaches survey 2025/2026, 74% of businesses backed up data to a cloud service and 73% restricted admin rights, but only 47% had two-factor authentication in place.
Copying files to the cloud is a start, but a backup needs two more properties. One copy has to be out of reach of whatever encrypts or deletes the originals: the NCSC advises keeping an external backup drive disconnected when it is not in use, and Canada's baseline asks for long-term backups to be stored offline. And it has to restore: CISA notes that many ransomware victims had no backups or incomplete ones, and calls regular partial and full restore tests critical.
Important
Ask whoever supports you when a file was last restored from backup as a test, and from which copy. A backup job that reports success has not yet proved anything.
How IT support is delivered
Support reaches people in four ways, and a sound arrangement uses all of them:
| Channel | Best for | Limits |
|---|---|---|
| Help desk | Reporting problems and asking for things by phone, email, portal or chat, logged as tickets | Only as good as its records and the people behind it |
| Remote support | Account, email, software and settings problems, fixed on the user's screen with consent | Cannot fix hardware, cabling or a device that will not connect |
| On-site support | Hardware faults, network and Wi-Fi work, printers, office moves and new desks | Slower and dearer; check whether visits are included, billed or subcontracted |
| Proactive monitoring and maintenance | Updates, disk space, backup results and security alerts watched by software | Needs an agent on every device and someone who acts on the alerts |
For a small business, the help desk mostly needs to be one channel people actually use, with a ticket for every request so nothing depends on memory. The tools behind remote support (remote access, RMM, ticketing, device management and documentation) are compared in the remote IT support tools guide, and supporting people who work from home or across time zones is covered in the guide to help desk support for remote teams.
Proactive monitoring is what separates support from repair. Remote monitoring and management (RMM) agents on each device report health and patch status, run scheduled maintenance and raise an alert when a disk fills, a backup fails or security software flags something, so the ticket exists before anyone calls. ITIL treats this as its own practice, monitoring and event management, which detects events early to keep services stable. In the qualitative interviews of the UK breaches survey, organizations with small teams named their provider's ability to monitor and act outside working hours as a significant advantage.
Projects such as a Microsoft 365 migration, an office move or a laptop refresh are related but different work. Check whether an agreement includes them or quotes them separately, so the monthly fee means what you think it means.
In-house, managed service provider or co-managed
Who does the work is a separate decision from what the work is. There are three models, and businesses often move between them as they grow.
In-house
Your own employees provide support. They know the business, the people and the quirks of your systems, and they are on site. The limits are breadth and cover: one or two people cannot be experts in identity, networking, security and every application, and nobody covers their holidays or nights unless you pay for it. The quiet risk is one person who holds every password and the whole picture in their head.
Managed service provider (MSP)
A provider delivers, operates or manages your IT under a contract, usually with a service level agreement. You get a wider bench of skills, tools you would not buy for yourself, and cover outside office hours if the contract includes it. What you give up is context: the provider learns your business from documentation, so the documentation has to exist.
An MSP also holds privileged access. A joint advisory from the cybersecurity agencies of the US, UK, Canada, Australia and New Zealand on threats to managed service providers warns that a vulnerable provider can be a way into many customer networks, and says contracts should require MFA on every MSP account used to access a customer's environment. Cyber Essentials counts accounts used by an MSP as part of your own scope, and expects you to be able to confirm that externally managed services meet its controls.
Co-managed
An internal IT person or team keeps ownership of systems, priorities and decisions, and a provider takes defined work: first-line tickets, after-hours cover, overflow, monitoring or projects. It combines context with breadth, and fails in one predictable way: tickets and systems nobody is sure they own. It works when every type of work has a named owner and both teams use the same queue and records.
What stays with the business
Break-fix, calling a technician only when something breaks, is what you have when nobody has chosen a model. It can be cheap in a quiet year, but nobody is paid to patch, check backups or remove a leaver's access.
Whichever model you choose, some things stay with you. CISA's small business guidance says security culture cannot be delegated and warns against treating security as the IT team's job alone; it asks the chief executive to back MFA in person, and to name someone, who need not be technical, to run the security program. In practice, keep an administrator account in the business's own name, own the documentation and the asset register, and approve who holds admin rights.
What a service level agreement covers
A service level agreement (SLA) is the written version of what support covers and how well. ITIL's service level management practice sets clear, business-based targets for utility, warranty and experience: roughly, whether the service does what the business needs, whether it is dependable enough, and what using it is like. For IT support, an SLA should state:
- Scope. The people, devices, sites and applications covered, and what is excluded.
- Hours and channels. Service hours with the time zone and holidays, any after-hours cover, and how to raise a request.
- Priorities. How impact and urgency set a priority, with examples from your own business.
- Targets for each priority. Time to a first response from a person, and time to a fix or workaround, in business or calendar hours.
- Escalation. Whom to call when a target is missed or a problem is bigger than a ticket.
- Security responsibilities. Who patches, how admin access is granted and removed, and who tells whom about a security incident, how fast.
- Reporting and review. What the regular report shows and who meets to discuss it.
- Exit. What is handed back (admin accounts, documentation, data) when the agreement ends.
Response and resolution are different clocks. Response is a person acknowledging the request and starting work; an automatic "we got your email" should not count. Resolution is the service working again, or a workaround in place. A typical priority scheme:
| Priority | Meaning | Example |
|---|---|---|
| P1 | The business has stopped | Nobody can send email, or the office network is down |
| P2 | A team is blocked | Accounts cannot reach the finance system before a pay run |
| P3 | One person is slowed down | One laptop's docking station stopped working |
| P4 | A request or question | Set up a starter who joins next month |
As a reference point, the default targets for a first reply from an engineer in our IT support agreement are 1 hour for P1, 4 hours for P2, 8 business hours for P3 and 24 hours for P4, and an agreement can tighten them. How to write targets that measure outcomes rather than speed alone is covered in the outsourcing guide.
How much IT support does your business need?
There is no staffing ratio that fits every business, but the need grows with size, and so does the exposure. The UK government's Cyber security breaches survey 2025/2026, published on April 30, 2026, found that 43% of businesses had identified a cyber breach or attack in the previous 12 months: 42% of micro businesses (1 to 9 employees), 46% of small ones (10 to 49), 65% of medium ones (50 to 249) and 69% of large ones (250 or more). Formal incident response plans follow the same curve: 21% of micro businesses had one, against 57% of medium and 76% of large businesses.
Use the survey's size bands as a starting point, not a rule:
| Size | Typical set-up | Have in place at minimum |
|---|---|---|
| 1 to 9 staff | No IT staff: one named owner, plus a provider on call or a small managed plan | MFA enforced, automatic updates, tested backups, a list of devices and accounts |
| 10 to 49 | A managed service provider, or one IT generalist with a provider behind them | Device management, starter and leaver checklists, an asset register, a written SLA |
| 50 to 249 | An internal IT lead working with a provider (co-managed), or a small team | Access reviews, a change log, an incident response plan, after-hours cover where it matters |
| 250 or more | An IT team, with specialist providers for security, networks or projects | Enterprise licensing beyond the 300-user business plans, formal service management |
Size is only the first input. Move up a row if any of these apply:
- more than one site, or staff working remotely across time zones;
- regulated or sensitive data, such as health records, card payments or client money;
- work that runs outside office hours, such as shifts, online sales or clients abroad;
- a line-of-business system the business cannot run without;
- a high cost for each hour of downtime.
Then look at the symptoms. You have outgrown your current support if new hires wait days for a working laptop, former staff might still have access, passwords live in a spreadsheet, the same fault comes back every month, or nobody can say who holds admin rights.
Where to start if nobody owns IT today
If support has so far meant whoever knows most about computers, this order closes the biggest gaps first and produces what any provider will ask for:
- Name an owner: one person accountable for IT decisions. CISA is explicit that this person need not be technical.
- Write down what you have: devices, accounts, licences, vendors and who has admin rights. Every later step, and any quote, starts from this list.
- Secure the admin accounts: separate, used only for admin work, protected by MFA. Remove any that belong to former staff or to nobody.
- Enforce MFA for everyone with security defaults in Microsoft Entra ID or enforced 2-Step Verification in Google Workspace, then find who has not enrolled.
- Turn on automatic updates, and list what no longer receives them, such as Windows 10 without Extended Security Updates.
- Test a restore from your backups, and keep one copy apart from the network.
- Write starter and leaver checklists, so access is granted and removed the same way every time.
- Choose a model (in-house, managed or co-managed) and put the scope and targets in writing.
If you would rather hand this over, our IT support service works either as your help desk and administrators or alongside your own IT team, and starts with an IT environment assessment: an inventory of devices, accounts and licences, who has admin access and who should not, security gaps ranked across MFA, patching, backups and mail, and a support plan with a quote. More guides for running IT in a small team are in the IT support topic.
