What an IT support subscription for businesses includes and what it usually leaves out

A dispute over an IT subscription rarely starts with a failure. It starts with the first invoice for additional work, when someone in the company says: "but that was supposed to be in the subscription". There is usually no bad faith on either side. There is a contract in which the scope was described in one sentence about "full support", and two different ideas of what that sentence means.

An IT subscription is a fixed monthly fee for maintaining the IT environment: computers, accounts, email, the server, the network and backups. Its value shows in the work done before a user notices a problem, and in the fact that after a quarter you can check what has been done.

Below we break an IT subscription down into the elements that should be described in the offer and the contract. At the end we compare the packages of our IT outsourcing for companies, so you can see how these elements translate into a specific scope and price.

What an IT subscription includes in a good offer

In its guidance on choosing a managed service provider, the UK's National Cyber Security Centre (NCSC) lists several things the contract should cover: timely updates, automatic backups stored off-site, security monitoring with event logging and two-step verification at access points. It also recommends a responsibility matrix, meaning a list of what the provider does and what is expected of the customer. This is a good starting point for reading Polish offers, although it is not a standard that applies in Poland.

From our perspective, a full subscription consists of eight layers. Each should have a description of its scope in the contract.

A helpdesk with a single ticket channel

A helpdesk is where staff report problems and where the company can see their history. The channel matters: a ticket sent by text message to a technician you know doesn't start any response time clock and leaves no trace. Check in the offer whether there is a ticket limit, during which hours support is available and how priorities are defined.

Response time means picking up the ticket and starting diagnosis, not fixing the failure. We described the difference between response, workaround and fix in detail in our article on SLAs and response time.

Monitoring with a list of what is monitored

The phrase "24/7 monitoring" on its own says nothing. The contract should specify which devices and services are monitored (workstations, server, backups, internet connection, network devices), which events generate an alert and who reads that alert. Monitoring whose notifications go to a mailbox nobody owns is a cost with no effect.

System and application updates

In SP 800-40 Rev. 4, NIST describes patch management as part of preventive maintenance: identifying, prioritising, installing and verifying the installation of updates. In a subscription, this means an agreed update cycle for workstations and servers, maintenance windows agreed with the company and information about devices that can no longer be updated.

Backups and restore testing

A backup that nobody has tried to restore is an assumption. A subscription should separate three things: checking that the backup ran, responding to a backup error and a periodic restore test ending with a dated record. The NCSC recommends asking the provider how often backups are tested and whether that meets the company's requirements. We write more about backup architecture itself in our guide on data backup in the company.

Security as part of ongoing IT support

The minimum is managed workstation protection, two-factor authentication on administrative accounts and email, a review of permissions and handling of alerts. The provider should have only the permissions it needs to do the work and use named accounts that can be revoked when the relationship ends. Endpoint protection licences are sometimes a separate line item, which is fine, provided the offer says so plainly.

Documentation that stays with the company

An inventory of devices, a list of administrative accounts, a network diagram, licences with renewal dates and a description of the dependencies between systems. This documentation belongs to the company and should remain available to it even if you change provider. If the contract says nothing about documentation, you will start from scratch when you change IT company. We described what such a handover looks like in the article on taking over administration.

Monthly report and periodic review

A report that is a list of closed tickets says little. A useful report shows the status of backups, updates and protection, tickets by priority, recurring issues and decisions that require budget: hardware without manufacturer support, expiring licences, identified risks. The NCSC lists reports on the state of the infrastructure, including patch compliance, backup metrics and security alerts, as part of a regular service review.

Supplier coordination

A company usually has several suppliers: the internet provider, the accounting software vendor, the printer service company, the website agency. It is worth writing into the subscription that the IT provider reports and follows up failures with these parties within the limits described in the contract. It won't repair a fibre cable that has been dug up, but it can take over contact with the provider so that you don't have to act as the go-between.

What is usually outside an IT subscription

Exclusions are not a flaw in an offer if they are written down honestly and up front. The items most often billed separately are:

• implementation projects: email migration, building or rebuilding a network, ERP system implementation;
• purchase of hardware and software licences;
• endpoint protection billed per device;
• on-site visits and travel, if the package does not include them;
• work outside the support window, usually at a surcharged rate;
• data recovery from damaged media, which is a laboratory service;
• support for industry-specific software for which the vendor provides no ticket channel.

The problem arises when a basic task related to maintaining the environment is only called a project on the invoice. That is why, in addition to the list of exclusions, ask for a catalogue of tasks covered by the subscription and for the rule on approving additional work before it starts.

Red flags in IT subscription offers

Several signals keep recurring in offers after which a company is looking for a new provider within six months.

A scope described in one sentence. "Full IT support" without a list of tasks means the scope will only be settled at the first dispute.

No definition of priorities and support hours. A figure such as "response within 2 hours" without a service window and without a description of when the clock starts cannot be verified.

Backups without a restore test. If the offer talks about backup but not about restoring, ask when someone last checked that the data can be recovered.

Administrative accounts in the technician's name. Owner accounts for the domain, email and cloud should be registered to the company. The provider gets named permissions that can be revoked.

No sample report. A provider that has a process will show you an anonymised report before you sign the contract.

Unclear rules for additional work. It is not clear what the rate is, who approves the job and whether unused hours carry over to the next month.

No provisions on ending the relationship. The NCSC points out that the contract should describe renewal, renegotiation and termination. In practice, this is about what the provider will hand over and by when it will remove its access.

NexaIT packages in one table

Below are our ongoing IT support packages. Prices are net monthly amounts, "from", excluding licences and endpoint protection. Response time applies to critical P1 tickets and means picking up the ticket and starting diagnosis within the package's support window.

Element	START IT	BUSINESS IT	PROFESSIONAL IT
Price	from PLN 1,190	from PLN 2,490	from PLN 5,490
Number of stations	1-5	6-20	21-50
Working hours per month	4 h	8 h	16 h
Support window	Mon-Fri 9:00-17:00	Mon-Fri 8:00-18:00	Mon-Fri 8:00-18:00 plus weekend on-call for P1
Response to P1	4 working hours	1 working hour	30 minutes
Remote helpdesk	yes	yes	yes
Monitoring	basic for workstations	proactive with alerts	automated around the clock, with response within the support window
System and application updates	yes	yes	yes
Backups	monthly verification	backup management	backup and restore with a quarterly restore test
Servers and network	no	one server, basic network with VLAN and VPN	multiple servers, full network management
Documentation	initial documentation	initial documentation	kept up to date
Report and review	monthly report	monthly report and quarterly review	report, quarterly review and status meetings
On-site visits	travel charged separately	travel charged separately	one visit per quarter
Minimum contract term	3 months	6 months	12 months

For organisations with more than 50 workstations, we have the ENTERPRISE IT package from PLN 9,900 net per month. We set its scope and SLA after an audit, because at this scale they depend mainly on the organisation's processes.

Three things are worth knowing when reading this table. We bill endpoint protection separately, from PLN 19 net per month per device, so you can see how many computers you are paying for. Visits within 30 km of Świebodzin are billed at a flat rate of PLN 80 net plus the hourly rate, and beyond that at PLN 1.50 net per kilometre in both directions. Unused hours do not carry over to the next month, and we let you know about limit usage once 80% of the hours have been used.

A quarterly restore test is standard from the PROFESSIONAL IT package upwards. In smaller packages we check every month that backups have run, and a restore test is agreed as separate work, usually during a review. You will find a full overview of prices and terms in our article on IT outsourcing costs.

How to match the subscription scope to your business

The number of workstations is only a starting point. The scope is also affected by the company's working hours, the number of locations, the importance of the ERP or production system, the required time to restore operations and the requirements of customers or the insurer. A company with a dozen or so workstations and shift work may need a wider support window than an office with more people working from 8 to 16.

Before comparing offers, write down three things: which systems stop revenue, how many hours of downtime the company can tolerate without losses and who in the company makes decisions about IT spending. With this list, the conversation with a provider stops being a conversation about the price per workstation.

If you are wondering whether a subscription is better for you at all than hiring an IT person, we compared both models in the article a subscription helpdesk or a full-time IT specialist.

What you should be able to see after the first quarter

After 90 days of ongoing support, the company should have owner accounts registered in its own name, an up-to-date inventory, monitored backups, a ticket history with priorities and a list of risks with a proposed order of work. If, after a quarter, the only evidence of activity is invoices and an assurance that everything is under control, the subscription is not doing its job.

We describe the scope of the ongoing support we provide on the page IT outsourcing.

Sources

• National Cyber Security Centre, Choosing a Managed Service Provider (MSP), published 24/11/2025, reviewed 24/06/2026, https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp (accessed 02/10/2026)
• NIST, SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology, April 2022, https://csrc.nist.gov/pubs/sp/800/40/r4/final (accessed 02/10/2026)
• ENISA, Cybersecurity for SMEs, Challenges and Recommendations, June 2021, https://www.enisa.europa.eu/publications/enisa-report-cybersecurity-for-smes (accessed 02/10/2026)

As of 2 October 2026.