What security controls should fully managed IT support include?

Fully managed IT support should include more than technical tools; it should provide a documented security framework that defines responsibilities, limits access to business information, protects data throughout its lifecycle and produces evidence that controls are working. The provider should manage these controls as part of the service, while your organisation retains appropriate oversight of risk, policy and business decisions.

Security governance and accountability

The service should begin with a clear security policy set covering acceptable use, remote working, mobile devices, access to business data, removable media, administrator privileges and the reporting of suspected incidents. Policies should be tailored to the organisation’s operations rather than copied from a generic template.

Your agreement should also state who is responsible for each activity. For example, the provider may administer technical settings and investigate alerts, while your designated representatives approve access, classify sensitive information and decide whether a business process can accept a particular risk. This avoids gaps in responsibility between the managed service provider and the client.

A useful service should maintain a risk register, record agreed exceptions and review them periodically. If a control cannot be applied because of a legacy application, operational requirement or compatibility issue, the exception should be documented with an owner, a reason and a review date.

Asset and configuration control

The provider should maintain an accurate inventory of devices, servers, cloud resources, applications, user accounts and important data stores. Security decisions are unreliable if unknown or unauthorised assets can connect to the environment.

Configuration standards should define the approved security settings for relevant systems. Changes to those settings should be authorised, recorded and checked. This includes newly deployed equipment, equipment moved between sites and systems hosted in a mixture of cloud and on-premises environments. An inventory should also identify unsupported or obsolete technology, because it may need replacement or additional safeguards.

Least privilege and privileged activity

Access should be based on job requirements rather than convenience. Users should receive only the permissions needed for their role, and administrative access should be limited to approved personnel. Privileged accounts should be separate from ordinary user accounts where practical, with their use logged and reviewed.

Leavers, contractors and people changing roles should have their access amended or removed through a defined process. Shared accounts should be avoided because they make it difficult to establish who performed an action. Where a shared technical account is unavoidable, its use should be controlled and its credentials protected and rotated.

Data protection and information handling

A managed service should help identify which information is confidential, commercially sensitive, personal or operationally critical. Different categories may require different storage, sharing, retention and disposal rules.

Encryption should be considered for data held on portable devices, transmitted between systems and stored in cloud services. The control is only effective when encryption keys, recovery procedures and administrative access to them are managed appropriately. The provider should also support secure disposal of storage media and devices so that information cannot be recovered when equipment is retired.

Where appropriate, controls should restrict the unauthorised movement of sensitive information through email, file-sharing services, removable media or unmanaged devices. These measures should be balanced against legitimate business processes and reviewed when those processes change.

Logging, monitoring and evidence

Security-relevant events should be recorded in sufficient detail to support investigation. Examples include changes to privileged permissions, unusual sign-in activity, administrative actions, access to important systems and alterations to security settings.

Logs should be protected from unauthorised modification, retained for an agreed period and reviewed according to the organisation’s risk. It should be clear which events are monitored automatically, which require human analysis and how significant findings are escalated. Reporting should distinguish genuine security concerns from routine technical alerts, giving the organisation information it can act upon.

Security awareness and human controls

People remain an important part of the control environment, so a fully managed arrangement should include practical guidance for recognising suspicious messages, handling sensitive information, using business devices and reporting mistakes. Training should reflect the organisation’s systems and working practices rather than focus only on general theory.

There should be a simple route for reporting suspected fraud, lost equipment, accidental disclosure or unusual account activity. Training records and policy acknowledgements can provide evidence that expectations have been communicated, while recurring issues can indicate where processes or technical safeguards need improvement.

Third-party and cloud service assurance

Security responsibility does not end when a system is hosted by another supplier. The managed service should help document which party controls identity, data, configuration, availability and incident handling for each important service.

Supplier reviews should consider the information being shared, the provider’s security measures, contract terms, sub-processors, data location, retention and arrangements for returning or deleting data. Contracts should explain how security incidents are communicated and how access is removed when a service is no longer required.

Testing and continuous improvement

Controls should be tested rather than treated as effective simply because they have been configured. Testing may include access reviews, restoration exercises, configuration checks, vulnerability assessments, simulated incident scenarios and reviews of administrative activity. The exact approach should reflect the organisation’s risk and technical environment.

Findings should be recorded with a priority, responsible owner and target date. A meaningful review considers whether controls detected the issue, whether staff followed the relevant process and whether corrective action addressed the underlying cause. This creates a cycle of measurement and improvement rather than a one-off security check.

When comparing fully managed IT support plans, ask for a description of the control framework, the evidence supplied to clients, the division of responsibilities and the process for handling exceptions. A strong plan combines technology with governance, disciplined administration, staff awareness and regular assurance, giving the organisation a clear view of how its security is managed.