What security responsibilities should managed IT support include?
Managed IT support should include continuous security oversight, covering threat monitoring, vulnerability and patch management, access controls, secure configuration, tested backups and incident response planning. It should also help staff follow safer working practices and provide clear reporting so your business can understand risks and the actions taken to reduce them.
Managed IT support should treat security as an ongoing governance responsibility, not simply as the installation of antivirus software or a firewall. The provider should help the business understand its risks, define who is responsible for each control, protect the systems and information that matter most, and provide evidence that agreed security measures are being maintained.
Risk assessment and asset visibility should be the starting point. The provider should maintain a practical record of the organisation’s devices, servers, cloud services, applications, users and important data repositories. This makes it easier to identify unsupported systems, duplicate services, unnecessary exposure and dependencies that could affect operations. Risk assessments should consider the effect of a security incident on confidentiality, accuracy and availability, rather than focusing only on technical weaknesses.
Security policies and accountability should be documented in terms that staff and managers can use. This may include acceptable use, remote working, mobile devices, data handling, encryption, password management, administrator privileges and the reporting of suspected incidents. A managed IT provider should clarify which tasks it performs, which decisions remain with the client, and which actions require approval. Without this division of responsibility, important controls can be assumed to be someone else’s duty.
Data protection and compliance support should also form part of the service. The provider should help identify where personal, commercially sensitive or regulated information is stored and how it moves between systems. It can then advise on appropriate retention, access, encryption and disposal arrangements. Managed IT support does not transfer the business’s legal responsibilities to the provider, but it should supply the technical information and operational evidence needed to support compliance reviews.
Supplier and cloud-service oversight is another important responsibility. Businesses often depend on hosted applications, connectivity suppliers, software providers and external contractors. The managed service should help record these dependencies, review the security information available from suppliers and identify what happens if a service is unavailable or a supplier suffers an incident. Contracts should make clear how security events, data access, account closure and information return are handled.
Security logging and evidence should be sufficient to investigate unusual activity and demonstrate that controls are being managed. Depending on the environment, this can include records of administrator actions, sign-ins, configuration changes, security alerts and completed remedial work. Logs should be protected from unauthorised alteration and retained for a period appropriate to the organisation’s risks and obligations. The useful question is not how much data is collected, but whether it supports a clear investigation and informed decision-making.
Incident preparation should extend beyond having a contact number for the IT provider. The organisation should know how to report a suspected breach, who can authorise technical or business decisions, how evidence will be preserved, and when insurers, legal advisers, regulators or affected parties may need to be involved. The provider should help define these escalation routes and test them through a structured exercise where appropriate. Lessons from incidents and exercises should result in recorded improvements rather than being treated as closed once systems are restored.
Security assurance should include periodic reviews rather than relying on a one-off implementation. A suitable review may examine:
- whether the documented asset and data records remain accurate;
- whether former users, suppliers and devices have been removed from relevant services;
- whether security policies still reflect the way people work;
- whether third-party services and remote connections remain justified;
- whether outstanding risks have an owner, priority and target action; and
- whether controls have been checked independently where the risk warrants it.
The agreement should state the scope of these responsibilities clearly. It should identify the systems covered, the security standards or policies used, the information the provider will supply, how exceptions are approved, and how unresolved risks are escalated. A managed IT support service that combines technical protection with documented ownership, compliance awareness, supplier oversight and regular assurance provides a more complete security function than one that only responds to individual faults.
A managed IT support provider should review the security implications of technology changes before they are introduced. Adding a cloud application, remote access tool or connected device can create new data flows, permissions and integration points that are not covered by existing controls.
This review should confirm who can access the system, what information it handles, how administrator access is protected, whether activity can be investigated and how the service can be removed safely. It should also record any security conditions or exceptions that need the business’s approval. Treating security as part of technology selection and change planning helps prevent new systems from creating avoidable weaknesses.
