“That’s what we thought was included with you.” We usually hear this sentence when something has failed and time is pressing. Managed Services and IT Management sound similar but do not mean the same. Those who clarify the difference before signing the contract won’t have to discuss it later during an incident.

What is the difference between Managed Services and IT Management?

Managed Services are the ongoing operation of clearly defined IT components. IT Management is the control of your IT as a whole and remains a leadership task within your company.

A Managed Service is a defined service: provisioning workstations, monitoring servers, maintaining firewall rules, patching applications. Scope, service hours and response times are specified in the contract. Billing is usually flat-rate per device or per user.

IT Management answers the questions before and after that. Which systems will the company need in three years? How much is an hour of uptime worth to us? Who is allowed to access payroll data? Your service provider can calculate and implement options. You must decide.

Handing over operation does not automatically mean handing over responsibility for priorities and access rights.

Who decides, who operates, who is liable?

You decide, your service provider operates, and your company remains liable towards customers and authorities. Separate these three roles before discussing prices.

The terms get mixed up in everyday use. To decide means to set the framework: budget, permissions, required availability. To operate means to implement and monitor this framework technically. To be liable means to be accountable to customers, authorities, and the law.

The following overview shows the basic pattern along the components that BeSync offers as Managed Workplace for Swiss SMEs and Managed Services. Your binding agreement is always your service contract with the associated Service Level Agreement (SLA).

The last column contains no technical tasks, but approvals and notifications. If an exit is not reported, access remains, regardless of what the SLA states.

Why do misunderstandings arise despite having a contract?

Because contracts describe services but expectations mean results. The contract states 'Server monitoring'. In the managing director’s mind it means 'our data is safe'.

There are three practical causes. First, vague terms: 'included', '24/7', and 'support' mean different things depending on the provider. Second, gaps between multiple suppliers – internet provider, telephony, specialised application and IT partner tend to blame each other in case of disruption. Third, the translation into business terms is missing: A response time of four hours sounds harmless, until you factor it into your own daily business.

Which tasks remain with you even with managed services?

Four tasks cannot be contractually delegated: risk decisions, approval of access rights, reporting of changes and control of the service provider.

The Federal Office for Cybersecurity (FOCS) states clearly: responsibility cannot be outsourced or delegated. If an incident occurs, your company is at the end of the liability chain. This applies regardless of how carefully your partner works.

Practically, you therefore need a data processing agreement and an answer to the question of whether your data is located in Switzerland, the EU, or a third country. This is accompanied by the periodic review of the agreed services. The revised Data Protection Act requires this overview from you, not from your service provider.

How do you review an existing contract?

Take the contract in hand and highlight every service for which you cannot clearly say in one sentence what happens in an emergency. These are your agenda items for the next contract discussion.

The FOCS recommends that companies ask their IT partner, among other things, the following questions:

• Exactly where are our data located, and is there a data processing agreement?
• What does the backup concept look like, and when was recovery last successfully tested?
• Are all accesses protected with multi-factor authentication, including remote maintenance?
• What monitoring is included, and who is alerted when?
• Who is reachable at night and on weekends, and what does an emergency deployment cost?

Conclusion

Operations can be outsourced, liability cannot. Therefore, go through your contract step by step and note for each who decides, who operates, and who is liable. Where you cannot fill in a column, you have a topic for the next conversation with your service provider. Clarify it before extending the contract.