Almost every managed IT provider sells three tiers. The names change, the content does not: a monitoring only plan, a full support plan, and a security led plan at the top. The problem is that the same tier name can mean very different things, so the only way to compare is to check which capabilities sit inside each one.
Here is what belongs in each tier, and the specific items that are most often missing.
Tier 1: monitoring and maintenance
The entry plan watches your systems and keeps them patched. Nobody is answering your staff’s questions at this level.
- Monitoring agent on every workstation and server, with alerting
- Operating system and third party patching on a published schedule
- Antivirus or endpoint protection deployed and reporting centrally
- Backup monitoring, meaning somebody notices when a backup fails
- Asset inventory, so you know what you own and how old it is
- Monthly report that a human actually reads before sending
Who it fits: companies with an internal technical person who handles day to day requests and wants the background work covered.
Commonly missing: patch verification. Deploying patches and confirming they installed are two different jobs, and only one of them appears in most entry plans.
Tier 2: full support
This is the tier most small and mid sized businesses actually need. Everything in tier 1, plus people your staff can contact.
- Unlimited remote help desk for staff, with a defined response commitment
- User administration: new starters, leavers, permissions, shared mailboxes
- Microsoft 365 or Google Workspace administration
- Printer, peripheral and application support
- Vendor coordination, so your provider chases the internet or line of business software vendor instead of you
- Backup testing with documented restores, not just backup monitoring
- Quarterly review covering what broke, what is ageing and what is coming
Commonly missing: onboarding and offboarding. Ask directly whether a new hire setup and a secure leaver process are included or billed as project work. On a growing team this is the difference between a predictable bill and a surprising one.
Tier 3: security led
The top tier adds the controls that insurers and larger clients increasingly ask about.
- Endpoint detection and response, with somebody reviewing the alerts
- Multi factor authentication enforced across all accounts, including admin accounts
- Email security: filtering plus SPF, DKIM and DMARC records configured correctly
- Conditional access or equivalent login policy
- Privileged account control, so daily user accounts are not also administrators
- Immutable backups, meaning a copy an attacker cannot delete
- Security awareness training and phishing simulation
- Documented incident response plan, including who is called at 2am
- Vulnerability scanning with a remediation schedule
Commonly missing: alert review. Plenty of providers sell endpoint detection and then nobody looks at the console. Ask who reviews alerts, during which hours, and what they are authorised to do without calling you first.
The comparison table to take into a sales call
| Capability | Tier 1 | Tier 2 | Tier 3 |
|---|---|---|---|
| Monitoring and alerting | Yes | Yes | Yes |
| Patching | Yes | Yes | Yes |
| Staff help desk | No | Yes | Yes |
| User onboarding and offboarding | No | Ask | Yes |
| Backup restores tested | No | Yes | Yes |
| Endpoint detection with alert review | No | Ask | Yes |
| Multi factor enforced everywhere | No | Ask | Yes |
| Immutable backup copy | No | No | Yes |
| Incident response plan | No | No | Yes |
| Security awareness training | No | No | Yes |
Every row marked “Ask” is where quotes differ most. Put the question in writing and keep the answer.
Three questions that reveal the real tier
- When did you last restore one of your clients’ backups, and how long did it take? A provider who tests restores will answer with a date. One who only monitors backups will answer with a description of the software.
- Who gets the endpoint alerts, and what can they do without asking us? Silence here means the tool is sold but not operated.
- What is excluded? Project work, hardware procurement, after hours and compliance evidence are the usual four. You want them named, not discovered later.
Which tier to buy
If you have no internal technical person, tier 1 leaves your staff with nowhere to go and you will pay hourly for every question. Start at tier 2. Move to tier 3 when you handle client data that would hurt you if it leaked, when an insurer or a larger customer starts asking security questions, or when you cannot afford a week of downtime.
What matters more than the tier is the scope document behind it. Compare inclusions, not names.
See how the pricing models work in our managed IT pricing guide, or what each service covers under managed IT services, IT help desk and managed cybersecurity. Not sure where you stand today? An IT assessment gives you the baseline first.