Managed IT policies
and workbooks

Managed services, support requests, service reviews and co-managed arrangements. A signed service schedule identifies included systems, responsibilities, coverage and commercial terms.

• Define the service boundary
• Approve work through named contacts
• Record service expectations
• Keep requests traceable
• Review performance and risk
• Handle concerns consistently

New MSP clients, incoming-provider transitions and additions to an existing managed environment. Access and tooling require client authority before installation or connection.

• Authorise the transition
• Discover without disrupting
• Exchange access securely
• Check the baseline
• Introduce management tooling
• Accept the service start

Termination, partial service transfer and transition to another provider. Contract terms determine notice, deliverables, fees and retention; this framework adds no new termination charge.

• Agree the exit plan
• Prepare a useful handover
• Confirm recovery ownership
• Remove all access paths
• Transfer through approved channels
• Close retention and responsibility

Client and provider identities, administrative roles, service accounts, joiners, movers, leavers and emergency access within agreed managed scope.

• Use verified identities
• Apply least privilege
• Protect authentication
• Control non-human access
• Complete joiner, mover and leaver changes
• Protect emergency access

Supported desktops, laptops, phones and tablets, including personally owned devices expressly approved for business access. Client scope defines device types and management capabilities.

• Know the device
• Configure a baseline
• Separate administration
• Explain BYOD boundaries
• Respond to loss or compromise
• Manage retirement

Managed routers, switching, Wi-Fi, firewalls, remote support, VPNs and network administration. Physical works and unmanaged connections require separate scope where applicable.

• Document the boundary
• Separate trust zones
• Control remote administration
• Review firewall changes
• Protect configuration
• Record support sessions

Risk assessments and security improvement plans for managed client environments. Regulatory requirements, threat context and any desired maturity target are established for the engagement.

• Define the assessment
• Maintain a risk register
• Plan a security baseline
• Validate controls
• Manage exceptions
• Report proportionately

Suspected compromise, ransomware, unauthorised access, accidental disclosure and service-impacting security incidents. The response schedule defines contacts, authority and specialist support.

• Report and triage
• Assign incident roles
• Contain with evidence in mind
• Assess notification obligations
• Recover deliberately
• Communicate and learn

NovaSoft Orbit, agentic assistance, third-party AI tools and integrations used in a client engagement. A deployment-specific assessment determines approved uses, data flows and action permissions.

• Approve the use case
• Control AI inputs
• Limit agent authority
• Require human review
• Test and monitor
• Provide a safe stop

Personal information and confidential business data in support, administration and managed services. Client notices and applicable jurisdictional requirements must be identified for the engagement.

• Identify the information
• Confirm authority and notice
• Restrict use and disclosure
• Protect transfers and storage
• Support privacy requests
• Handle a suspected exposure

Support records, client documentation, logs, exports, device storage and backup copies held within the engagement. Requirements vary by record type, legal obligation and supplier capability.

• Agree a retention schedule
• Apply legal holds
• Control copies and exports
• Address backups honestly
• Sanitise media
• Keep a disposal record

Client users of managed devices, accounts, cloud services and approved AI tools. The client employer adopts workplace rules and gives appropriate notices about any monitoring.

• Use authorised services
• Protect account access
• Handle messages carefully
• Respect information boundaries
• Report without delay
• Make training practical

Managed hardware, applications, subscriptions, certificates, domains and technology dependencies. Procurement and renewal authority are specified in the engagement.

• Maintain the inventory
• Track licence rights
• Plan support expiry
• Approve procurement
• Reconcile changes
• Retire safely

Supported applications, operating systems, firmware and managed services in scope. A remediation schedule defines severity criteria, target timeframes and emergency authority.

• Identify exposure
• Prioritise with context
• Set remediation targets
• Test and deploy
• Track failed or deferred work
• Verify completion

Configuration, software releases, infrastructure modifications and emergency changes to managed systems. Standard change categories and approvers are recorded for each engagement.

• Describe the proposed change
• Assign an approval route
• Prepare validation and rollback
• Communicate the window
• Implement and record
• Close with evidence

Managed backup jobs, restoration and technology recovery. Client business continuity arrangements also cover people, premises, suppliers and manual processes beyond technical recovery.

• Define recovery needs
• Protect backup access
• Monitor the jobs in scope
• Test restoration
• Plan recovery order
• Maintain continuity

Managed cloud tenants, business email, SaaS, hosting and suppliers with client data or administrative access. Supplier selection and commercial commitments require client authority.

• Assess before connection
• Keep ownership clear
• Configure collaboration
• Protect business email
• Understand availability and retention
• Review and exit

Security and operational telemetry from managed systems, remote tools and automated assistance. The monitoring schedule specifies sources, collection, retention and human response coverage.

• Define monitoring coverage
• Collect proportionately
• Protect the records
• Give alerts a route
• Check the collection itself
• Report with context