What Does a Managed IT Support Fee Actually Cover in Australia?

White clay scene of a managed IT support desk with monitoring screens and a patching checklist

A managed IT support fee should buy more than somebody answering the phone when a laptop stops working. It pays for the people who keep the environment running, watch for trouble, patch systems and sort out the vendors behind them. The part worth checking is what happens when that work uncovers a security problem. Is the fix included, or does another quote arrive?

At inSUPPORT, the remediation identified in the onboarding audit is included in the monthly support fee. That choice comes from Kane Nawrocki's view that finding a gap is only useful if someone takes responsibility for closing it. Support starts at $68 per user per month for business hours, with extended retail and 24/7 options. Cyber insurance, backup and security awareness training are separately priced lines on the quote.

If you are looking at two proposals with similar per-user prices, don't try to decide from the headline number. Put the inclusions, exclusions and hours beside each other. Ask what the provider did with last year's audit findings, and what it would charge to fix the same findings in your business. That's where the real comparison begins.

The short version

A monthly fee should say who answers users, who maintains the systems and who owns a security finding after it is reported.
inSUPPORT includes the remediation from its onboarding audit in the support fee. Insurance, backup and awareness training are separately quoted.
Choose the hours your business actually trades: weekday, extended retail, or 24/7 cover.
Ask for the inclusions and incident-notification terms in the agreement, where they will still matter after the sales meeting.

What is actually inside a managed IT support fee?
What gets quoted separately, and why?
Where does security remediation sit, and why does it matter?
What does the hours tier actually buy?
How do you read a quote so you can defend it to the board?
Questions finance teams ask about the fee

What is actually inside a managed IT support fee?

Strip away the brochure and a support fee buys four kinds of work. A helpdesk that answers when a user cannot log in, a printer vanishes or an email will not send. Monitoring that watches servers, network gear, cloud services and backup jobs for the alert that arrives before the outage does. Patching and maintenance applied on a schedule rather than when somebody remembers. And vendor management, which means the provider chases your software suppliers and your telco so that you do not have to.

inSUPPORT's IT support pricing page prints what sits inside each tier in exactly those terms: proactive monitoring and security remediation on every tier, vendor management on the Business tier, and a virtual CIO on the Retail and Complete tiers. Beneath the tiers the same page publishes a fuller service inclusions list, covering 24/7 monitoring of critical systems, monthly patch management, operating system health checks, incident and problem management, service level agreements, licensing compliance, line-of-business application support, roadmap planning and disaster recovery planning and testing. Read that list slowly, because it is the boundary. Anything not on it is a conversation.

One item on that list is missing from most support fees, and it is the reason the fee is built the way it is. Security remediation, meaning the fixes an audit turns up, sits inside the support fee rather than coming back as a project quote. It gets its own section below, because it changes how the whole relationship behaves.

The plain test for any provider is the same, and it works on the one you already have. Ask for the inclusions list in writing, then ask which of last year's invoices fell outside it. A provider who runs the account well already has both answers, and one who needs a fortnight to find them has told you how closely the account is being watched.

What gets quoted separately, and why?

Cyber insurance, backup and security-awareness training are separate, clearly quoted line items, and the reason deserves to be said plainly. Each one is a distinct product with its own cost. A fee that claimed to include all three would either be inflated for the businesses that do not want them or quietly thin for the ones that do. Naming them is the honest version, and it is also the version a finance team can actually budget.

Compliant Backup is priced on its own because a tested, point-in-time restore is real infrastructure rather than a tick in a box: built to the Essential 8 backup controls, tested, and with the restore itself verified, because a backup nobody has tested is a hope rather than a plan. The Education add-on runs a phishing platform that tailors simulated attacks to each individual user based on how that person did in the fortnight's online class. The insurance line coordinates cyber insurance through licensed insurance partners; the insurers underwrite it, and cover is subject to the insurer's assessment.

Hardware, software licences and major projects usually sit outside a support fee. Microsoft 365 Business Premium, for example, was listed by Microsoft Australia at AU$32.90 per user per month on an annual subscription before GST when this article was researched. Ask whether licensing is included, passed through or billed separately, and confirm the GST position on every line of the quote. A small assumption multiplied by every user is not small for long.

The reframe that helps most is this. A named line item lets you see the whole package and decide what you need. For most inSUPPORT managed clients, cyber insurance is part of that wider package, arranged through licensed partners and priced separately on the quote. The technical controls relevant to the insurer are managed alongside the everyday IT work, so the policy discussion is connected to what is actually running.

Where does security remediation sit, and why does it matter?

In the model most of the industry runs, an audit is a paid piece of work that produces a report, and the report produces a second quote to fix what it found. That is a legitimate way to sell IT. It also means the provider that identifies a gap is rewarded with a second project, and the customer who paid for the audit is now holding a list of problems with a price beside each one.

inSUPPORT priced the remediation inside the support fee instead. The onboarding audit, which includes a security audit, a gap analysis and internal and external penetration testing, produces an agreed remediation plan, and the work on that plan is part of the monthly fee rather than a project invoice. The provider that finds the gap is not paid again to close it. That is checkable on the managed IT services page, which is why it persuades where adjectives would not.

What remediation means in practice is mostly the Australian Signals Directorate's Essential Eight, the eight mitigation strategies ASD names as the most effective of its published set: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. An audit against those controls tends to find administrator access nobody needed, devices nobody manages and accounts that were never closed when people left. Fixing those is the remediation, and it is where most of the first week's work goes.

ASD's advice makes the practical case for fixing gaps early: remediation after a compromise costs far more than putting the controls in place beforehand. Ask your provider which findings it will close as part of the agreement, who owns the work and when you will see evidence it was done. Essential Eight guidance changes over time, so check ASD's current model before a maturity target goes into a contract.

What does the hours tier actually buy?

Most of the difference between $68, $100 and $135 is hours. The Business tier covers Monday to Friday, 8:30am to 5:30pm. The Retail tier adds Thursday and Friday evenings to 9:00pm and Saturday mornings from 8:30am to midday. The Complete tier is 24 hours a day, seven days a week. The monitoring, security remediation and patching are the same work at every level; what you are choosing is when a person answers the phone.

The Retail tier exists for a specific reason. inSUPPORT came out of retail IT, where the till, the stock system and the card terminal matter most on Thursday night and Saturday morning, which is exactly when a business-hours helpdesk is shut. If your busiest trading happens at the hours most providers are closed, that tier is the one to price, and the gap between $68 and $100 is the cost of somebody answering at 7pm on a Friday.

Two other things on the pricing page are worth noticing. The Retail and Complete tiers list a virtual CIO, which is strategy-level advice in the room when you are planning, while the Business tier lists vendor management instead. And the pricing FAQ is explicit that an issue arising outside your contracted hours still reaches a 24/7 follow-the-sun helpdesk. Outside your hours is not the same as nobody home, and the difference between the tiers is what you are entitled to rather than whether the lights are on.

The practical onboarding facts, as the company reports them: technical onboarding takes about four hours once the provider has access to the Microsoft environment, and the initial onboarding includes a site visit to document how the business operates, inspect the infrastructure and meet the people who matter. That is the company's own figure rather than an audited one. After onboarding, the fee is the fee, for Australian businesses of roughly 30 to 300 users, run remote-first.

How do you read a quote so you can defend it to the board?

A CFO does not need to understand the technology to judge a managed IT support fee. The quote either answers a short list of plain questions or it does not, and a provider who cannot answer them for the person paying has told you something useful. Work through these six before you sign anything, whether the provider is new or the one you already have.

The inclusions list, attached to the agreement. Not a summary on a proposal. The actual list of what the fee covers, as a schedule to the contract, so that the boundary survives the salesperson leaving.
Where the fee stops and a project starts. Who pays when the audit finds something, and which clause says so. This is the single line that decides whether your provider profits from finding problems.
Every add-on as its own named line. Insurance, backup, awareness training, licensing. One combined number for all of it is not simplicity, it is a decision somebody made on your behalf about what you are buying.
The licensing question, asked out loud. Passed through inside the fee, billed separately, or not included at all. All three are legitimate and only one of them is what you assumed.
The hours a human answers, against your own trading hours. The hours on the website are the starting point, not the answer. Ask what happens at your busiest hour, not at eleven on a Tuesday.
The term and the notice period. Rarely published by anyone, including on this site, so ask for both in writing before you sign. A fee you cannot leave is a different product from a fee you can.

What ASD says to put in the contract

The Australian Signals Directorate's advice for organisations engaging a managed service provider was last updated in 2021, and it is still the clearest short statement of what belongs in the contract. It is not the whole of what ASD publishes: those same pages point readers to the Information Security Manual as the broader framework. But it is short enough to lift straight into a negotiation. State your cyber security expectations upfront. Require the provider to implement cyber security guidance such as the Essential Eight in its own environment. Include cyber security incident notification clauses, so the provider is obliged to tell you when its systems are compromised. And keep a current record of which of your systems the provider can reach, and how.

ASD also publishes five questions to put to the provider itself: are you implementing better practice cyber security, are you securely administering your systems and services, are you monitoring activity on them, are you regularly assessing them, and are you prepared for and able to respond to a cyber security incident. The reason those questions belong in a conversation about money is that a provider holds privileged access to your environment. Their security is part of what your fee is buying, whether or not anybody itemised it.

If you already have a provider

Run the six at renewal, when straight answers are owed, and pair them with the twelve questions to ask your IT provider before you renew, which go wider, into proof and into the day something breaks. If the answers point to a move, how long it takes to change IT providers sets out the four-to-eight-week shape of the job and the three things to settle before you give notice. One awkward answer is not a reason to leave. A pattern of them, on the questions about money, usually is.

Questions finance teams ask about the fee

Is a lower per-user fee actually cheaper?

Only if the boundary is the same, and it usually is not. A managed IT support fee that quotes remediation, after-hours calls and patching projects separately can cost more across a year than a higher fee that does not, because the second invoice is where the difference lives. Compare boundaries before you compare rates, and put last year's out-of-fee spend beside the monthly number. The fee you can forecast is the one whose exceptions are written down.

Do we need someone technical to judge a managed IT quote?

No. Every line can be explained in plain English: what is included, what is quoted separately, who pays when the audit finds something, and what hours a person answers. A provider who cannot explain the fee to the person paying it has answered a bigger question than the one you asked. If you want an independent read before deciding, a Cyber Strength Audit turns the environment into a costed list rather than an opinion.

How long before a new fee settles down?

Technical onboarding takes about four hours once access exists, which is inSUPPORT's own reported figure rather than an audited one, and the agreed remediation programme then runs over a window that depends on what the audit finds and how complex the environment is. Expect the first months to carry that remediation work, which is the point of having it inside the fee. Once the agreed items are closed, the monthly number is the monthly number, with the add-ons you chose sitting beside it as named lines.

Where do we start if we cannot explain our current IT spend?

Pull twelve months of invoices and separate the recurring fee from everything else, then ask your provider for the inclusions list in writing. That comparison alone usually explains the gap. The next step is an independent look at the environment itself: a Cyber Strength Audit documents what is actually configured, ranks the gaps by business impact and returns a costed path to closing them. The number it produces is one you can put in front of a board.

Know what you are paying for If the monthly fee keeps turning into separate projects, let us look at the environment and the agreement together. A Cyber Strength Audit shows what is in place, what needs attention and what it will take to close the gaps. If you choose inSUPPORT for managed support, the agreed remediation identified in that audit is part of the support fee. You should be able to explain your IT spend without having to defend surprises.

Book a Cyber Strength Audit →

Sources

"How to manage your security when engaging a managed service provider", Australian Signals Directorate. The advice to get security into the contract: state expectations upfront, require the provider to implement the Essential Eight, include cyber security incident notification clauses, and keep a current record of which systems the provider can access and how. Also the line that the cost of remediation after a compromise far exceeds the cost of upfront implementation. First published 21 December 2018, last updated 6 October 2021. Read 18 September 2026. cyber.gov.au
"Questions to ask managed service providers", Australian Signals Directorate. The five questions a customer should put to a provider: implementing better practice cyber security, securely administering systems and services, monitoring activity, regularly assessing them, and being prepared to respond to an incident. First published 24 March 2017, last updated 6 October 2021. Read 18 September 2026. cyber.gov.au
"Essential Eight explained", Australian Signals Directorate, the web page at the link below rather than the companion PDF. Names the eight mitigation strategies that make up the Essential Eight, which is what security remediation inside a support fee mostly consists of, and records that the supporting maturity model is updated regularly. The page carries First published 01 Feb 2017 and Last updated 27 Nov 2023. Read 18 September 2026. cyber.gov.au
"Consultation on evolution of Essential Eight", Australian Signals Directorate. ASD's announcement that it was consulting on evolving the Essential Eight into a broader Essentials series grounded in the Information Security Manual, with consultation running until 12 July 2026 and organisations already using the Essential Eight able to expect strong alignment with their existing controls. Published 15 June 2026. Read 18 September 2026. cyber.gov.au
"Microsoft 365 Business Premium", Microsoft Australia. The published price of AU$32.90 per user per month paid yearly, before GST, covering identity and access management for up to 300 users, used above to show that licensing is a per-user cost separate from a support fee. Read 18 September 2026. microsoft.com