In this guide · 8 sections
- 01IT support models for small businesses
- 02Response times, remote vs onsite, and after-hours cover
- 03Who owns the admin accounts
- 04The security baseline your IT provider should maintain
- 05Questions to ask an IT support provider
- 06Matching IT support to your business size
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Choose the model that matches how often things break: ad-hoc for a small office with few problems, a retainer for predictable monthly help, a per-user managed service to have devices and security looked after. Either way, get response times in writing and keep admin accounts in your company's name.
IT support models for small businesses
Most providers sell some mix of these three. Decide which one you are buying before comparing prices.
| Model | How you pay | Good for | Watch out for |
|---|---|---|---|
| Ad-hoc (break-fix) | Per job or per hour | Small offices with few issues and cloud apps | No prevention; slow response when busy; costs spike when something big breaks |
| Monthly retainer | Fixed hours or tickets a month | Steady stream of small requests | Unused hours lost; clarify what happens when you exceed them |
| Per-user managed service | Monthly fee per user or device | Offices that want devices, accounts and security maintained | Long contracts; check exactly what is in and out of scope |
Licences such as Microsoft 365, antivirus and backup are usually a separate cost from support labour, whichever model you pick. Our IT support cost guide shows typical Singapore pricing for each model.
Response times, remote vs onsite, and after-hours cover
Response time is the most misunderstood part of an IT contract. "Response" usually means someone acknowledges the ticket, not that it is fixed.
- Response time: how quickly a person replies, often by priority (for example, urgent within a set number of hours).
- Resolution or target time: how long to fix, usually best-effort. Ask how they define it.
- Business hours: which days and hours count. Public holidays and Saturdays are often excluded.
- After-hours: whether there is any cover at night and weekends, and the extra cost.
- Remote vs onsite: most problems are fixed remotely. If you need someone at the office for printers, network or hardware, check whether onsite visits are included, how fast, and at what rate.
If your office runs on cloud apps with no server, remote support covers most needs. If you have a server, network cabinet or many printers, onsite capability matters more.
Who owns the admin accounts
Many small businesses discover, when they change provider, that the old one holds every admin password. That makes switching slow and risky.
A good set-up
- Your company owns the Microsoft 365 or Google Workspace tenant and billing
- A director holds a break-glass global admin account, protected with MFA
- The provider uses named admin accounts that can be removed
- Domain and DNS are registered in your company's name
- A current list of systems, accounts and licences is shared with you
Red flags
- The provider bought licences through its own account and will not transfer them
- Only the provider knows the admin passwords
- Shared logins such as admin@ used by several technicians
- No documentation of what is installed where
- Offboarding the provider requires paying an exit fee
Ask for this in the contract: on termination, the provider hands over all credentials, documentation and admin access within a set number of days.
The security baseline your IT provider should maintain
Support is not only fixing things. A provider should keep you at a basic level of protection. CSA's Cyber Essentials mark is a useful yardstick: the certification is valid for two years and assessed by an independent certification body.
Minimum IT security baseline
Our Microsoft 365 security checklist covers the most common platform in detail. If a provider cannot explain how they keep you at this baseline, they are offering repairs, not support.
Questions to ask an IT support provider
Use these to compare two or three quotes on equal terms.
What exactly is included?
Ask for a list: users, devices, apps, printers, network, servers. Ask what is excluded and how out-of-scope work is charged.
What are the response times?
Get them per priority level, with business hours and after-hours cover stated.
Who will do the work?
A named technician, a team, or subcontractors? Is there cover when that person is away?
How do you handle security?
Ask how MFA, updates, backups and antivirus are managed and reported to you.
Who owns accounts and licences?
Confirm admin access, licence ownership and handover on exit, in writing.
What do the reports show?
A short monthly summary of tickets, patches and backup status shows the work is being done.
What is the contract term?
Check minimum term, notice period and any exit fees. Shorter terms keep providers honest.
If a provider offers penetration testing or a managed security operations centre, check it on the CSRO list of licensed providers. Our cybersecurity service licence guide explains which services need a licence.
Matching IT support to your business size
There is no single right answer, but a few patterns are common.
| Your office | Usually enough | Consider adding |
|---|---|---|
| 1 to 5 people, all cloud apps | Ad-hoc help plus a one-off security set-up | A low-cost monthly security plan |
| 5 to 20 people, cloud apps, some devices | Per-user security plan plus ad-hoc help | Device management, backup, training |
| 20+ people or a server on site | Managed service with onsite cover | Network monitoring, documented recovery plan |
| Regulated data (clinic, finance, legal) | Managed or security plan with reporting | Cyber Essentials or Cyber Trust certification |
A new company can avoid most later problems by setting things up right from day one. Our new company IT set-up guide lists what to put in place first.
Do it yourself or get help?
If you are a small office on cloud apps, you can handle a lot yourself with the baseline checklist and occasional help. Bring in a provider when you no longer have time, when you handle sensitive data, or when customers start asking about your security.
IT Sorted works remotely, with no onsite visits. Our Quick Fix (S$119 for one hour, paid upfront) covers single tasks. Protect Standard (S$19 per user a month, minimum 3 users) keeps antivirus, devices, password manager and training on track. Microsoft 365 / Google Security Lockdown (S$590) sets the security baseline in one go.
Frequently asked questions
It depends on the model. Ad-hoc support fixes problems as they happen. A retainer gives a set amount of help each month. A per-user managed service usually covers devices, accounts, updates, antivirus and backups, plus helpdesk. Always ask for a written list of what is included and excluded, and how extra work is charged.
For many small offices on cloud apps such as Microsoft 365 or Google Workspace, yes. Most account, email and software problems can be fixed remotely. If you have a server, network equipment or many printers, you will want a provider that can also send someone on site.
Your business. The tenant and billing should be in your company's name, and a director should hold a break-glass global admin account protected with MFA. Your IT provider should use its own named admin accounts that you can remove if you change provider.
General IT support does not. Under the Cybersecurity Act, providers of penetration testing and managed security operations centre monitoring need a licence from the Cybersecurity Services Regulation Office. If your provider offers either service, check its name on CSRO's published list of licensed providers.
Before giving notice, confirm you hold admin access to email, domain, devices and backups. Ask the old provider for all credentials and documentation in writing. Overlap the providers for a short period, change shared passwords, and remove the old provider's admin accounts once the new one is in control.