A managed IT monthly fee usually covers help desk support for your team, security tools watched by people, monitoring and updates for every computer, onboarding and offboarding, vendor management, regular planning, and backup of your Microsoft 365 or Google Workspace data. Projects such as office moves and migrations, hardware, network gear, cameras and compliance programs are usually quoted separately. The clearest way to know what you're buying is to ask every provider for a written list of what's in and what's out.

What is managed IT, in plain terms?

Managed IT means one outside team runs your technology for a predictable monthly fee. Instead of calling someone when something breaks and paying by the hour, you pay a team whose job is to keep things from breaking, support your people and plan what comes next.

The details vary from provider to provider, which is why two quotes that look similar can cover very different work. Here's what you'll usually find on each side of the line.

What's usually included in the monthly fee?

• Help desk support. Your team calls or emails when something isn't working, and a person fixes it or escalates it.
• Security tools, monitored. Protection on every computer, email filtering, and multi-factor sign-in (MFA), which asks for a second proof of identity such as a code on your phone. The key word is monitored: someone watches the alerts and acts on them.
• Monitoring and patching. Patching means installing the security updates that software makers release. A managed provider keeps every machine current and watches for warning signs like failing drives.
• Onboarding and offboarding. New hires get accounts and a working laptop. Departing employees lose access, and company devices come back.
• Vendor management. When the internet goes down or a business application misbehaves, your provider calls the vendor so you don't sit on hold.
• Planning and regular reviews. A standing meeting, often quarterly, to look at what's aging, what's at risk and what's coming next year.
• Backup of cloud data. A separate backup of the email, files and accounts in Microsoft 365 or Google Workspace, so deleted or overwritten data can be recovered.

What usually costs extra?

Most providers separate ongoing work, which is in the monthly fee, from one-time work, which is quoted as a project. Common extras:

• Projects: office moves, email or file migrations, new software rollouts, and replacing a server.
• Hardware: laptops, monitors, phones and docks, plus the labor to set them up in some agreements.
• Network equipment: firewalls, switches and Wi-Fi access points, and sometimes the ongoing management of them, priced per office.
• Cameras and door access: physical security is usually its own system with its own pricing.
• Compliance programs: preparing for a framework like SOC 2 or HIPAA involves policies, evidence and audits that go well beyond day-to-day IT.
• After-hours project work: scheduled changes done nights or weekends at your request.
• Software licenses: Microsoft 365, Google Workspace and your business applications are often billed separately from the support fee, even when the provider resells them.

Treat this as a starting point, not a rule. Some providers bundle network management into the monthly fee; others include a set number of project hours. The only list that matters is the one in your agreement.

Can contractors, personal devices or light users be left out?

Often, yes. The useful question is who touches company data. Someone who signs in to your email, files or client systems is a security exposure whether they're on payroll or not, so leaving them unprotected saves little.

Common middle grounds:

• Contractors get a limited account that expires when the engagement ends, instead of full coverage.
• Personal phones get app-level protection that separates work data from personal data, rather than full device management.
• Light users, such as staff who only check email, may be covered differently from people who live in their laptops all day. Ask how each provider handles them.

Is a flat monthly fee worth it if we rarely submit tickets?

Tickets are the visible part of the work, not most of it. A good month is a quiet one, and quiet months are usually the result of updates installed on time, a suspicious sign-in stopped before anyone noticed, and a new hire whose laptop worked on the first morning.

Picture a 30-person firm that submits a handful of tickets a month. The fee still pays for security monitoring every day, patching every week, clean onboarding and offboarding as people come and go, and someone planning ahead so the next server or laptop replacement isn't a surprise. If a provider can't show you that work, ask them to.

Will managed IT duplicate tools we already pay for?

It can, and it's worth checking before you sign. The most common overlaps are antivirus, backup, password managers and email filtering. Ask any provider to list the tools they deploy, then compare that list with what you're already paying for.

A sensible provider maps your current tools, tells you which ones to keep, and times any replacement to your renewal dates so you're not paying for two products for a year. Any change to security tools should be tested with a small group before rolling out to everyone, so nothing important gets blocked by surprise.

Is the quote over-scoped? Can it come in tiers?

Ask the provider to explain each line in plain language and what would change if you removed it. If they can't explain a line, that's useful information. Some providers offer tiers, and that can work well, as long as the basics of security, backup and offboarding stay in every tier. For a closer look at pricing models and how to compare quotes line by line, read how IT providers price their services.

What reporting should we expect?

You should be able to see what you're paying for, but more reports aren't always better. Monthly reports that nobody reads become noise. What matters is that you can get answers when you ask, and that someone walks you through where things stand on a regular schedule, often quarterly. On request, a provider should be able to show you:

• Tickets opened and closed, and how quickly they were answered
• Recurring issues and what's being done about the root cause
• Security status: devices up to date, MFA coverage, backups completing
• Upcoming renewals, aging equipment and recommendations

None of it needs to be long. It needs to be honest and readable by someone who isn't technical.

What questions should we ask any managed IT provider?

• What exactly is in the monthly fee, and what is billed separately?
• How is the fee calculated: per person, per device, per location, or a mix?
• What happens when someone joins or leaves? How fast is access removed?
• What are your help desk hours, and how do we reach you after hours?
• Which security tools do you deploy, and who watches the alerts?
• Is our Microsoft 365 or Google Workspace data backed up, and when was a restore last tested?
• How often do we meet to plan, and who attends?
• What reporting can we get, and how often do we review it together?

How Simple IT handles it

Our Managed IT services page lists exactly what our monthly service covers. A few things we'll say plainly: our help desk runs Monday through Friday, 8 AM to 8 PM Eastern, with after-hours emergency support by phone: you reach someone, or leave a voicemail and we respond within an hour. Reporting is available whenever you ask for it, and we review where things stand with you quarterly. Typical first response is under an hour during business hours, and the help desk fixes or escalates issues the same day. Departing employees lose access the same day. Our security work follows the CIS Controls v8 Implementation Group 1 as a baseline, and you can see how that shows up day to day on our cybersecurity page.

Where to start

If you're comparing providers, or wondering whether your current agreement covers what you think it does, take the free 5-minute IT Snapshot to see where things stand. If you're weighing a change, our guide to switching IT providers without disruption walks through the process. Or book a 15-minute call and we'll talk through what you have today.

Most IT providers price ongoing support per user, per device, in tiered bundles, or by the hour through block hours or break-fix billing. What you actually pay is driven by how many people, devices and locations you have, the security level you need, any compliance work, and the support hours you expect. To compare quotes fairly, line them up against the same scope, separate one-time costs from monthly ones, and ask what each line actually does.

What are the common IT pricing models?

You'll usually see one of four models, or a mix of them. None is right or wrong. Each fits some businesses better than others.

Many providers combine models: per user for help desk and security, per location for office networks, and project quotes for one-time work.

What drives the cost of managed IT?

Whatever the model, a handful of things decide the price:

• People. More people means more support, more accounts and more onboarding and offboarding.
• Devices. Laptops, phones and shared machines each need protection, updates and eventually replacement.
• Locations. Each office has its own internet service, firewall and Wi-Fi to manage.
• Servers. On-site servers take more care than cloud services.
• Security level. Monitoring by people, account protection and training add real work.
• Compliance needs. Preparing for frameworks like SOC 2 or HIPAA adds policies, evidence collection and audit support.
• Support hours. Extended hours and after-hours coverage cost more to staff.

What costs are there beyond the monthly fee?

Separate one-time costs from recurring ones before you compare anything.

• Onboarding. Some providers charge to take over your environment: documenting systems, deploying tools and fixing what they find. Others fold it in. Either way, ask what it includes.
• Projects. Office moves, migrations and network upgrades are usually quoted separately.
• Hardware. Laptops, network gear and cameras are typically bought or leased on top of support.
• Licenses. Microsoft 365, Google Workspace and business applications may be billed by the provider or directly to you.
• Incident response. Ask what happens when something serious goes wrong. Many providers include the first response and quote larger recovery work separately. Get the answer in writing.

Why is one quote higher than another?

Usually because they cover different things. One quote may include security monitoring, cloud backup and quarterly planning; another may cover help desk only and bill everything else as it comes up. One may count every device; another may skip phones.

A higher quote isn't automatically better, and a lower one isn't automatically a bargain. The question is what each one covers and what you'd pay for separately with the other.

How do you compare IT quotes apples to apples?

Put the quotes side by side and answer the same questions for each one:

• Who and what is counted: people, devices, locations, servers?
• Which security tools are included, and does a person monitor the alerts?
• Is Microsoft 365 or Google Workspace data backed up?
• Are onboarding and offboarding included, and how fast is access removed?
• What are the help desk hours, and what happens after hours?
• Are planning meetings and reporting included?
• What is one-time and what is monthly?
• How does the price change when you add or remove people?
• What's the contract length, and how does notice work?

If a quote leaves you unable to answer one of these, ask. For a fuller picture of what typically sits inside a monthly fee, read what managed IT services include.

Can we stay at or below what we spend today?

Sometimes. Start by counting everything you spend now, not just the IT invoice: separate security tools, backup subscriptions, hourly calls, and the hours you or a staff member spend on IT. Once that's on paper, the comparison is often closer than it looks.

If a new quote is higher, find out what it adds. If the extra is work you've been going without, like monitoring or planning, you can decide whether it's worth it with clear eyes.

Can we cut scope, or ask for a discount?

You can always ask how pricing changes as your team grows, and whether a smaller scope is possible. Ask what each removal would mean in practice, not just on the invoice.

Be careful with the lines that seem easiest to drop. Security training and offboarding look optional until someone clicks a convincing phishing email, or a former employee still has access to client files months later. Those two cost little relative to the problems they prevent.

What are the red flags in an IT quote?

• A scope so vague you can't tell what's included
• Almost everything listed as "additional" or "billed as needed"
• Security tools listed with no mention of who watches them
• No mention of backup, offboarding or planning
• Line items no one can explain in plain language

Most providers write quotes in good faith. These are simply signs to ask more questions before you sign.

How does Simple IT price managed IT?

We price Managed IT per person, and it covers every active account and device that person uses under one security and management service. Infrastructure Management is priced per site and covers the network infrastructure and servers at that location. Projects like moves or migrations are quoted separately. Your quote is built from what you actually have, so it reflects your business rather than a package.

Where to start

A quote is only as good as the information behind it. Take the free 5-minute IT Snapshot to get a clear view of your people, devices and security today, then book a 15-minute call and we'll walk through what a fair comparison looks like for your business.

Switching IT providers goes smoothly when you do it in order: read your current agreement for notice terms, secure admin access to your own accounts, take an inventory of what you have, then plan a short overlap so support never lapses. Your email and files live in Microsoft 365 or Google Workspace, not with your provider, so a planned switch changes who manages them, not where they are. With Simple IT, most switches complete within 30 days.

How do we get out of our current IT contract?

Start with the agreement itself. Most people find the answers to their first questions in a few sections:

• Notice period: how far ahead you need to give notice, and in what form
• Term and renewal: when the current term ends, and whether it renews automatically
• Termination terms: what happens if you end the agreement early
• Transition help: whether the provider commits to hand over documentation and access
• Licenses and tools: which software is licensed through the provider and what happens to it when you leave
• Non-solicit clauses: terms about hiring the provider's staff, which people sometimes ask about

We can help you find these sections and plan around them, but we don't interpret contracts. If anything is unclear, have your attorney review it before you give notice.

A few practical habits help. Give notice exactly the way the agreement specifies, including the method and the address. Ask in writing for your data, credentials and documentation. Once the handoff is complete, ask the old provider to confirm in writing that they've deleted their copies of your data and credentials. And keep paying invoices that are due during the transition, because withholding payment can create a dispute of its own.

Will we pay two providers at once?

Possibly, for a short time, and it's usually worth it. A brief overlap means your team is never without support while the new provider settles in. The goal is to time your notice so the overlap is short and planned rather than long and accidental.

If you're mid-contract, you don't have to wait for the last day to start planning. The inventory and access work below can happen before you give notice, so you're ready when the term ends.

What should we secure first?

Admin access. Before anything else changes, make sure your company, not a provider, holds the top-level accounts for your systems. That means a named person at your business has, or can get, administrator access to:

• Microsoft 365 or Google Workspace
• Your domain registrar and DNS (the settings that tell the internet where your email and website live)
• Your firewall and Wi-Fi management
• Backup systems
• Your password manager, if you use one
• Business applications such as accounting, CRM and industry software
• Vendor portals for internet service, phones and software licenses

These accounts belong to your business. If documentation or passwords are missing, access can be recovered, but it's much easier when you ask early and in writing. Plan any password or admin changes carefully and test them with one account first, so nobody gets locked out on a Monday morning.

What goes into the inventory?

An inventory is a plain list of what you have and who manages it. It's the foundation of a calm switch.

• Accounts and licenses: who has what, and when each license renews
• Domains and DNS: where they're registered and who can change them
• Devices: laptops, phones, printers and servers, and who has each one
• Network: internet service, firewall, switches and Wi-Fi at each location
• Backups: what's backed up, where, and when a restore was last tested
• Security tools: antivirus, email filtering and anything else installed on devices
• Vendors: every company you call when something specific breaks

Pay close attention to renewal dates. A license or domain that expires mid-switch is one of the few things that can cause a real interruption, and it's easy to prevent once it's on the list.

Will switching break email or lose data?

Not when it's planned. Your email, files and calendars live in Microsoft 365 or Google Workspace. Changing providers changes who manages those services, not where your data sits.

The risk points are specific and manageable:

• DNS changes made carelessly can interrupt email delivery, so a copy of the current records is saved first and changes are made at a quiet time and checked.
• Security tools are swapped in a planned order, device by device, so no computer is left unprotected and two security tools aren't fighting each other on the same machine.
• Licenses held under the old provider's account need to be transferred before that account closes.
• The old provider's access is removed once the handoff is complete: their admin accounts, any delegated access to Microsoft 365 or Google Workspace, and their remote-support tools on your computers. Any shared passwords they knew get changed.
• Backups should be confirmed working under the new setup before the old one is retired.

How does a respectful handoff work?

Most providers hand off professionally, and it helps to make it easy for them. Give notice in writing, include a clear list of what you need (admin credentials, documentation, license details, any pending work), and agree on a date. Your new provider can handle the technical back-and-forth directly, so you're not stuck relaying messages between two IT teams.

Keep it cordial. A switch is a business decision, and a calm handoff is better for everyone, including your team.

What will our employees notice?

Less than you'd expect. Most of the work happens in the background or after hours. Your team will typically notice:

• A new way to reach the help desk, and an introduction to who's on the other end
• New management and security software installed on their computers
• Possibly a prompt to set up multi-factor sign-in (MFA), a second proof of identity such as a code on their phone
• A quick check that their laptop, email and key apps work as expected

A short note from leadership explaining the change, and why, goes a long way.

How long does it take to switch IT providers?

With Simple IT, most switches complete within 30 days. The timeline depends mostly on how quickly admin access and documentation come together, and on notice terms in your current agreement.

Our onboarding follows the LIFT Framework, which keeps the switch in a predictable order:

You can read more about how we handle the transition on our switching IT providers page, and see what day-to-day support looks like afterward on our Managed IT services page.

Is it time to switch?

If you're not sure yet, start there. Raise your concerns with your current provider first; sometimes a direct conversation fixes it. If the same problems keep coming back, our article on the signs you've outgrown your IT provider can help you decide.

Where to start

You don't need everything figured out before you talk to anyone. Book a 15-minute call and we'll map out what a switch would look like for your business, including timing around your current agreement.

You don't need to become technical. You need visibility. In your first two weeks, find out who holds admin access to email, your domain and key systems, list your accounts, licenses and vendors, confirm backups and multi-factor sign-in (MFA) are working, and settle who to call when something breaks. Once you can see the whole picture, decide what stays in-house and what goes to a partner.

Why does IT land on finance and operations leaders?

IT lands on whoever is left holding the keys. The in-house IT person resigns. The long-time employee who "handled the computers" retires. A business sale takes the IT team with it. Suddenly the CFO, the head of HR or the operations lead owns something they never signed up for.

If your first reaction is "this isn't my expertise," that's fair. Your job right now isn't to fix servers. It's to find out what you have, who controls it, and who you call when it breaks. That's a management problem, and you already know how to solve those.

Who has admin access to our systems?

Start here. Admin access is the master key: the accounts that can add users, reset passwords, change email settings and delete data. If you don't know who holds them, you don't fully control your own systems.

Make a short list of who has admin rights to each of these:

• Email and files: the administrator accounts for Microsoft 365 or Google Workspace.
• Your domain name: the registrar account where your web address is registered, and its DNS settings (the directory that tells the internet where your email and website live).
• Your website and hosting.
• Your network: the firewall, Wi-Fi and internet service accounts.
• Money-adjacent systems: accounting, payroll and anything that can add users or change payment details.
• The systems that run the work: your CRM, project or practice management tools, ERP.

If the answer for any of these is "the person who just left" or "a shared login everyone knows," move it to the top of your list. The goal is ownership by accounts your company controls, with at least two named administrators so no single person is a point of failure.

Where are the passwords?

The honest answer is often "a few places": a password manager, a spreadsheet, a notebook in a desk drawer, or a former employee's browser. Each tells you something about how much cleanup is ahead.

Wherever they are now, the goal is the same. Move them into a business password manager your company owns, limit access to the people who need it, and change anything that was stored somewhere it shouldn't have been.

While you're looking, gather whatever documentation exists: network notes, vendor contacts, setup instructions. It may be thin. That's normal, and rebuilding it is part of the work.

What are we actually paying for?

Pull the last few months of card statements and bills, and list every technology charge: software subscriptions, licenses, internet, phone service, domain renewals and support contracts. For each one, note what it is, who uses it, when it renews and whose name is on the account.

This list does two jobs. It shows where you may be paying for licenses nobody uses, and it surfaces renewals and contract deadlines before they surprise you. If a support contract has terms you're unsure about, have your attorney read it before you make changes.

Are our backups and security basics working?

You don't need to judge the technical details. You do need clear yes-or-no answers to a few questions:

• Is our email and file data backed up separately from Microsoft 365 or Google Workspace, and when was a restore last tested?
• Is MFA turned on for every account, especially admin accounts?
• Do our computers install security updates automatically?
• Does a person review security alerts from our antivirus or endpoint protection, or do they go to an inbox nobody reads?

If any answer is "I don't know," that isn't a failure. It's your next phone call. A capable IT partner can answer all four within days.

Which devices do we have, and who has them?

List the laptops, desktops, phones, tablets and printers, plus who has each one, roughly how old it is and whether the company owns it. Ask whether laptops are encrypted, so a lost device doesn't mean lost data.

Pay special attention to devices still held by people who have left. Getting those back, and wiping them properly, closes a gap most teams forget about until it matters.

Who do we call when something breaks?

Before the end of week one, answer the question your team will ask you on Monday: "Who do I call?" If there's an existing provider, confirm what they cover, their hours and how to reach them. If there isn't one, line someone up for urgent issues now, even temporarily, so a locked account or a dead laptop doesn't land on your desk.

Then tell everyone. One short email with the support contact saves you a dozen interruptions.

Your first two weeks: a checklist

• Remove access for anyone who has left, starting with admin accounts.
• List who holds admin access to email, domain, website, network and financial systems.
• Make sure at least two named people at your company can reach every admin account.
• Find where passwords live and plan the move to a company-owned password manager.
• List every technology vendor, license and contract, with renewal dates.
• Get yes-or-no answers on backups, restore testing, MFA, updates and alert monitoring.
• List devices and who has them; recover devices from former employees.
• Confirm who your team calls for help, and tell them.

Should we hire a replacement or hand IT to a partner?

Once you can see the picture, this decision gets much easier. Most businesses land on one of three options:

If you're weighing the third option, we wrote about managed IT alongside an internal IT person. If a partner makes sense, here's how our managed IT service works: onboarding follows our LIFT Framework (Learn, Integrate, Fortify, Transform), and most clients are fully onboarded within 30 days.

Whichever path you choose, don't let IT rest on one person again. Shared admin access, current documentation and a written plan are what keep the next transition calm. When you're ready to look further ahead, our first-year IT plan lays out what to fix in what order.

Where to start

You don't need to become an IT expert. You need to see what you have and have a partner you trust. Take the free 5-minute IT Snapshot to see where you stand, or book a 15-minute call and we'll walk through your first two weeks with you.

Report it right away and don't hide it. Disconnect the device from the network if you suspect malware, reset the password from a different device and sign out all other sessions, and check for new mailbox rules. If money moved, call your bank immediately. Then bring in your IT provider, notify your cyber insurance carrier early, before hiring any outside firms, and keep the evidence.

First, a word about the click

Phishing works because it looks like ordinary work: an invoice, a shared file, a recruiter, a message from the boss. Careful, smart people click. What matters most is what happens in the next hour.

The person who reports a click within minutes has done the most useful thing anyone can do. If you lead the business, make that easy. Thank them, then get to work. Blame teaches people to stay quiet next time, and quiet is what turns a small problem into a large one.

What should we do in the first hour?

Work through these in order. Most take a few minutes each.

1. Report it. The person who clicked tells their manager and your IT provider right away, including what they clicked, when, and anything they typed in or downloaded.
2. Disconnect the device if malware is possible. If a file was opened or downloaded, or the computer is behaving strangely, turn off Wi-Fi or unplug the network cable. Leave it powered on unless your IT provider says otherwise, so they can see what happened. If your provider's security tools can isolate the computer remotely, they may do this step for you.
3. Reset the password from a clean device. Use a different computer or phone, not the one that clicked. Then choose the option to sign out of all other sessions. That step matters as much as the new password: some phishing pages capture the signed-in session itself, so a password change alone may not shut the intruder out. If the same password is used anywhere else, change it there too.
4. Check multi-factor sign-in (MFA). Look for sign-in methods you didn't add, such as an unfamiliar phone or app. Remove them. If MFA wasn't on for this account, turn it on now.
5. Check mailbox rules, forwarding and delegates. More on this below. It's one of the most common signs an account was taken over.
6. Check connected apps. Look for apps or add-ons recently given access to the account that nobody recognizes, and remove them. Access granted to an app can outlast a password change.
7. If money moved, call your bank. Don't wait for anything else on this list.

Why do mailbox rules matter?

Once someone has your password, a common next step is to quietly set up a rule. It might forward copies of your email to an outside address, or move any message containing words like "invoice" or "payment" into a folder you never open.

The rule keeps working after the password changes. It also hides the replies that would tip you off. That's why checking rules and forwarding settings belongs in the first hour, and why your IT provider will look at them again even if you already have.

What if a payment was redirected?

Picture a hypothetical: your controller receives an email that appears to come from a long-time vendor, announcing new bank details. The email looks right because it came from the vendor's real account, which had been taken over. A payment goes out to the new account.

If anything like that happens, call your bank's fraud line right away, using the number on the bank's website or your statement, never a number from the email. Tell them it's a fraudulent transfer and ask what they can do to stop or recall it. Speed matters more here than anywhere else in this article. In the US, this kind of fraud can also be reported to the FBI's Internet Crime Complaint Center at ic3.gov. Ask your bank how that fits with their process.

Going forward, the simplest protection is a habit: any change to payment details gets confirmed by phone, using a number you already had on file.

What if it wasn't email?

The same steps apply to other accounts. A fake recruiter link can lead to a taken-over social media or ad account. A text that appears to come from a staff member can ask for gift cards or a quick favor.

• Social and ad accounts: reset the password, remove any admins or users you don't recognize, check billing and payment methods, and contact the platform's support.
• Impersonation: confirm any unusual request through a channel you already trust, such as a phone call to a known number or a quick walk down the hall.

When should we call our IT provider?

As soon as the first steps are underway, and ideally alongside them. A good provider will review sign-in history, look for other affected accounts, check the device, block the sender and confirm whether anything else was touched. They should also save sign-in and audit logs early, because some are only kept for a limited time, and remove the phishing email from anyone else who received it.

For Simple IT clients, our help desk is open Monday through Friday, 8 AM to 8 PM Eastern, with a typical first response under an hour during business hours. After hours, call our emergency line at (317) 300-4606. You'll reach someone, or you can leave a voicemail and we'll respond within an hour.

Our role in an incident is to contain the problem, restore access and preserve evidence. If a deeper forensic investigation is needed, it typically runs through your insurer and attorney, and we work alongside them.

Do we need to tell our cyber insurance carrier?

If you have cyber insurance, contact your carrier or broker in the first hours, alongside your IT provider. Many policies spell out notification steps and timing, and many expect you to check with the carrier before hiring outside investigators or lawyers, or those costs may not be covered. Some carriers run a hotline that connects you with a lawyer who coordinates the response. Waiting until you know everything can work against you.

If client or employee data may have been exposed, call your attorney or the carrier's hotline early. An investigation directed by a lawyer is more likely to stay confidential, and they'll decide whether anyone needs to be formally notified.

What your policy means for your situation is a question for your insurance broker and your attorney, not your IT provider. The same goes for whether you have obligations to notify clients or anyone else. Our job is to give them clear facts and a timeline to work from.

Some businesses find out mid-incident that, without a plan of their own, the insurer's process becomes the plan by default. Reading your policy now, on a quiet day, makes that a much calmer experience. Our guide to what cyber insurance applications ask about your IT covers the IT side.

Why shouldn't we delete the phishing email?

It's evidence. Your IT provider, your bank and your insurer may all want to see it. Instead of cleaning up:

• Leave the phishing email where it is. IT will keep a copy as evidence, then remove it from everyone's inbox.
• Don't wipe or reinstall the device until IT has looked at it.
• Write down a simple timeline: what arrived, what was clicked, what was entered, and when. Stick to facts and times. Leave out guesses about the cause or what was taken; those conclusions belong to the investigation.
• Take screenshots of anything unusual, such as strange rules, unfamiliar sign-in alerts or messages you didn't send.

Should we warn staff and clients?

If the account sent messages you didn't write, yes. Tell your staff first, so nobody acts on a request from the compromised account. Then warn the outside contacts who received those messages, with a short note: don't act on the earlier message, and call us at a number you already have to confirm any request. Keep it to that. Don't speculate about what happened, who was at fault or what information was involved.

Send that warning from a channel you know is secure, or from the account itself once your IT provider confirms it's clean. If client data may have been exposed, talk with your attorney before you send anything beyond a simple warning.

The first 24 hours at a glance

What happens after the first 24 hours?

Once things are steady, hold a short, blame-free review. How did the message get through? What would have caught it sooner? What one or two changes would make the biggest difference? Common answers include MFA on every account, a phone check for payment changes, better email filtering and brief, regular training. If data may have been involved, let your attorney decide how that review is run and written up.

If you'd like a broader starting point, our article on the security basics every 25-person company needs covers the essentials, and our cybersecurity service explains how we handle this for clients.

Where to start

The best time to plan for a phishing click is before one happens. Write a one-page list today: who to call at your IT provider, your bank's fraud line, your insurance carrier's contact, and who inside the company makes decisions. If you'd like help putting that plan together, book a 15-minute call.