Buyer's Guide · 2026 Edition
The IT Services Buyer's Guide
What every small business should know before choosing an IT provider — service types, realistic costs, evaluation criteria, and the questions most buyers forget to ask.
Buying IT services as a small business is confusing. Every provider uses different terminology, bundles things differently, and prices differently. This guide cuts through the jargon and gives you a clear framework for understanding what you need, what it should cost, and how to tell a good provider from a bad one.
This guide is written from our perspective as a London-based MSP working with small businesses of 1–50 staff. We're biased toward the managed services model because we believe it's the best value for most small businesses — but we'll call out when other models make more sense.
IT Services Explained
Every service type, who it's for, and what to expect.
Managed IT Support (MSP)
What it is: Full IT outsourcing — helpdesk, devices, security, cloud, monitoring, onboarding. Your entire IT department handled externally.
Who needs it: Businesses with 1–50 staff, no in-house IT, or an office manager doubling as IT support.
What to expect: Per-user monthly pricing. Response time SLAs. Proactive monitoring and patching. Security included as standard.
IT Support & Helpdesk
What it is: Day-to-day reactive and proactive support. Someone to call when things break, plus monitoring to catch problems early.
Who needs it: Any business that needs reliable technical support without hiring a full-time IT person.
What to expect: Phone/email/chat support with sub-30-minute response. Device management. Microsoft 365 admin. User onboarding/offboarding.
Cybersecurity
What it is: Email security, identity management, endpoint protection, data loss prevention, vulnerability assessment, and incident response.
Who needs it: Every business — but especially those handling personal data, financial data, or client-sensitive information.
What to expect: MFA enforcement, Conditional Access, Microsoft Defender, email authentication (SPF/DKIM/DMARC), and security monitoring.
Cloud Migration
What it is: Moving from on-premise servers, Gmail, or legacy systems to Microsoft 365 or another cloud platform.
Who needs it: Businesses still running local servers, using consumer-grade email, or stuck on an outdated platform.
What to expect: Phased migration with rollback plan. Email, files, calendars, and permissions migrated. Zero data loss target.
Backup & Disaster Recovery
What it is: Independent backup of emails, files, and systems — separate from OneDrive/SharePoint sync. Tested recovery procedures.
Who needs it: Any business where losing data would mean losing clients, revenue, or regulatory compliance.
What to expect: Automated daily backup. Offsite and immutable storage. Regular restore testing. Documented recovery plan.
AI & Automation
What it is: Custom workflows that automate repetitive tasks — lead follow-up, invoice chasing, email triage, reporting, quoting.
Who needs it: Businesses losing hours to manual processes that follow predictable patterns.
What to expect: Bespoke automations connecting your existing tools. No new software to learn. Measurable time savings.
Cyber Essentials Certification
What it is: Preparation and support for UK Cyber Essentials or Cyber Essentials Plus certification.
Who needs it: Businesses bidding for government contracts, working with larger clients who require it, or wanting a verified security baseline.
What to expect: Gap audit, remediation, guided self-assessment, and ongoing compliance maintenance.
Device Management (Intune)
What it is: Enrolment, security policies, app deployment, and remote management for all laptops, phones, and tablets via Microsoft Intune.
Who needs it: Businesses with remote or hybrid teams, BYOD policies, or a need to secure and manage devices centrally.
What to expect: Zero-touch provisioning. Compliance policies. Remote wipe capability. BitLocker/FileVault encryption enforcement.
What “Good” Looks Like
Signs you've found a provider worth paying:
- ✓
They answer the phone in under 30 minutes — consistently, not just on good days
- ✓
Security is included as standard, not sold as a premium add-on
- ✓
They offer rolling monthly agreements, not 12-month lock-ins
- ✓
They give you admin access to all your accounts — it's your data
- ✓
They document everything and provide regular reporting
- ✓
They proactively flag issues before you notice them
- ✓
They explain things in plain English without jargon or condescension
- ✓
They have a clear, documented onboarding and offboarding process
- ✓
They can name specific tools they use and why (not vague "enterprise solutions")
- ✓
Their existing clients actually like them — check reviews, not just case studies
Pricing Reality Check
IT services pricing varies wildly. Here's what the market actually looks like for UK small businesses in 2026:
| Service | Typical UK pricing |
|---|---|
| Fully managed IT (per user/month) | £50–£150 |
| Break-fix support (per hour) | £75–£150 |
| Cybersecurity audit (one-off) | £500–£2,000 |
| Cyber Essentials certification | £300–£500 (assessment fee) |
| Cyber Essentials Plus | £1,500–£3,000 (assessment fee) |
| Cloud migration project | £1,000–£5,000+ (varies by complexity) |
| Website build | £1,500–£10,000+ (varies by scope) |
| AI automation workflow (per workflow) | Project-based — varies |
The cheapest option is rarely the best value. Compare what's included in the monthly fee — a provider charging £80/user with security, backup, and device management included is better value than one charging £50/user where security is a £30/user add-on.
Frequently Asked Questions
For a UK small business, fully managed IT support typically ranges from £50–£150 per user per month. The lower end covers basic helpdesk and monitoring; the higher end includes comprehensive cybersecurity, device management, backup, and automation. Always compare what's included — a cheap headline price that excludes security or backup isn't actually cheaper.
For most small businesses, a provider based near you with remote support capability is ideal. Day-to-day support is delivered remotely, but for hardware issues, office moves, or on-site projects, you want someone who can actually show up. National providers often have slower response for on-site work.
Ask yourself: do they respond within 30 minutes? Do they proactively fix things, or only react when you call? Is your security configured (MFA, email authentication, endpoint protection), or did they just set up email and leave? Do they provide monthly reports? If the answer to any of these is no, you may be paying for a level of service you're not receiving.
At a bare minimum: Microsoft 365 or Google Workspace with MFA on every account, email authentication (SPF, DKIM, DMARC), endpoint protection on every device, regular backup independent of cloud sync, and a documented process for onboarding and offboarding staff. Everything else builds on this foundation.
Rolling monthly agreements are becoming the standard for small business IT support. A provider confident in their service doesn't need to lock you into a 12- or 36-month contract. If a provider insists on a long-term commitment, ask why — and what the exit clause looks like.
Ready to talk to an IT provider?
15-minute call. No commitment. We'll give you an honest assessment of what your business needs.