Managed IT services small business: what you actually need

Here's the short version: managed IT services small business owners actually need come down to four things, and almost everything else on the quote is optional. Tested backups, automatic patching, multi-factor authentication on email and money, and a human who answers when something breaks. That's the spine. The rest — the dashboards, the security operations centre, the AI add-on, the per-device monitoring you'll never open — is sold to fatten the invoice, not to keep you running. I run the whole stack myself: servers, networks, phones, backups, the lot. So this is the shopping list I'd hand a mate starting out, and the upsells I'd tell them to walk away from.

The four things that actually matter

Strip a managed IT plan back to what keeps a small business alive through a bad day and you're left with four jobs. Get these right and you've covered the failures that actually shut businesses down. Miss one and the fancy stuff won't save you.

1. Backups that are tested and off-site. Not "we back you up." Where does the backup live, when was it last successfully restored, and could a thief or a crypto-locker reach it from your network? A backup nobody has ever restored is a hope, not a backup. This is the single most important line on the whole plan and the one most often waved away with a brand name.
2. Patching and updates, applied automatically. Most breaches walk in through a known hole that a patch already fixed months ago. Operating systems, browsers, the line-of-business app, the firewall firmware. If updates depend on someone remembering, they won't happen. This should just run.
3. Multi-factor authentication on email and anything money touches. Email is the master key. Reset the password on everything else from a hijacked inbox and you own the business. MFA on email, banking, and your accounting login stops the overwhelming majority of account takeovers cold. It's close to free. There is no excuse for it being optional.
4. Someone who answers. A real response when the internet's down or a laptop won't boot, with a clear idea of how fast. The most expensive plan in the country is worthless if the call goes to voicemail at 9am on a Monday.

Endpoint protection (decent anti-malware on every machine) and basic network monitoring sit just behind those four. Worth having, not worth leading with. If a provider's pitch is heavy on the optional extras and thin on the four basics, you've learned what they actually care about.

The upsells to walk away from

This is where small businesses get fleeced, because the jargon is designed to make you feel like the one who doesn't get it. You're not. Here's what I'd cross off the quote.

Long lock-in with no exit. Three-year contracts dressed up as "partnership." Good IT keeps your business; it doesn't need to trap it. Month-to-month, or a short term with a clean exit, is a sign of a provider who's confident you'll stay because the work is good.

Security sold by acronym. If someone's quoting you SIEM, SOC, XDR and EDR for a six-person business and can't explain in one plain sentence what each one stops, that's product they want to resell, not protection you need. Enterprise security tooling is real and it matters at scale. A small office needs MFA, patching, a sensible firewall and good backups far more than it needs a security operations centre it'll never look at.

Per-device monitoring you'll never read. A dashboard with a green light next to every printer feels reassuring and changes nothing if nobody acts on it. Monitoring is only worth paying for when it triggers a response: an alert that reaches a human who fixes the thing. Otherwise it's a line item.

Cloud-everything, on principle. The reflex to lift every last thing into a monthly subscription is often the provider's convenience, not your saving. Some of it genuinely belongs in the cloud. Some of it would run cheaper, faster and more privately on a box in your own cupboard. A provider who only ever recommends cloud is telling you about their billing model, not your needs.

The test for any line on the quote is the same: can they explain, in plain English, why you need it, without the explanation quietly pointing back at their margin? If not, it comes off.

Cloud, on-premise, or both: decided per service

The cloud-versus-own-it question gets argued like a footy rivalry. It shouldn't be. It's a per-service cost-and-risk call, and the honest answer for most small businesses is a bit of both.

Email, document collaboration and your phones belong in the cloud for nearly everyone. The uptime and the zero-maintenance trade is worth the monthly fee, and you do not want a mail server in a cupboard going down on a long weekend. But a file share, a backup target, or a heavy line-of-business app can be cheaper, faster and more private on hardware you own and control. I run my own servers precisely because for some workloads, owning beats renting on every measure that matters: cost, speed, and not handing your data to someone else's roadmap. The skill isn't picking a side. It's deciding service by service, and a provider worth paying will do exactly that instead of selling you the one that's easiest for them to bill. If you want the longer argument, here's when the cloud is the right call for a small business, and when it isn't.

The Australian reality nobody puts on the brochure

A few things are specific to running a small business here, and they change the shopping list.

Your internet is less reliable than the pitch assumes. NBN drops, congestion at night, and plenty of regional businesses running on 5G or Starlink with no fixed line at all. If your phones and files are all in the cloud, your internet going down means your whole business goes down with it. That's an argument for a second connection that fails over automatically, and for keeping a critical thing or two running locally. Cloud-everything quietly assumes an always-on line you might not have.

Power isn't a given either. A short outage shouldn't corrupt a database or kill a sale mid-transaction. A modest UPS on the gear that matters is cheap insurance that rarely makes it onto a managed quote because it isn't recurring revenue.

You'll be a phishing target precisely because you're small. Attackers know a small business is less likely to have MFA and a tested backup than a big one. That's not a reason to buy enterprise security. It's a reason to nail the cheap basics that stop the common attacks, which loops straight back to the four things.

How to actually choose a provider

You don't need to become technical to pick well. You need to ask the questions that make a salesperson uncomfortable and a good operator relaxed. Ask where your backups live and when one was last restored. Ask what's in-scope versus billed on top. Ask how fast they answer and who actually picks up. Ask them to justify any line you don't understand in one plain sentence. The answers, and how willing they are to give them straight, tell you more than any glossy plan tier ever will. If you want the full set of questions, I wrote them up in the buyer's guide to choosing a managed IT provider, and the day-to-day support side lives on the managed IT support page.

What "enough" looks like

Good managed IT for a small business isn't an expensive plan, it's a right-sized one. The four basics done properly and verified, not assumed. The optional gear added only when there's a real reason. Cloud where it earns its keep, owned hardware where that's the smarter buy. No lock-in you'd regret, no acronyms you can't explain, no dashboard you'll never read. Set up like that, IT stops being the thing that worries you and goes back to being the thing that quietly works, which is the entire point of paying someone to manage it.

FAQ

Not sure whether your current setup covers the four basics, or whether you're paying for upsells you don't need? That's a conversation worth having before you renew anything. We'll tell you straight what a business your size actually needs, even when the answer is "less than you're paying for now." Tell us what your setup looks like and we'll point you in the right direction.