Introduction

Many SMEs sign up for managed IT because they want the reassurance of an outside IT function. What they often receive is reactive support: tickets are answered, outages are cleared, and devices stay online, but there is no maintained security baseline and no structured ownership model.

The UK Government recommends Cyber Essentials as the minimum standard for protecting organisational data. For an SME in Sussex or Kent with ten to twenty-five seats, that minimum is not an event; it is a maintained baseline.

What "Managed IT" Usually Means in SME Deals

The reactive-cover pattern

Reactive IT arrangements tend to share a common structure: support requests are logged and resolved, device faults are fixed or replaced, software updates are applied reactively, security is treated as an antivirus and firewall check, and ownership, evidence, and maintenance schedules are undocumented.

Why the label matters

Managed IT should be evaluated on outcome: what must be true, who owns each control, what evidence is retained, and how the baseline is maintained across time.

What Cyber Essentials Aligned Managed IT Should Include

1. A maintained baseline, not a one-time check

Cyber Essentials is frequently treated as a certification event. An aligned managed IT arrangement keeps the baseline maintained between assessments.

2. Clear ownership for each control

Ownership is the missing link in most SME IT arrangements. In an aligned model, each control has an owner, a review cadence, and an evidence trail.

3. Evidence retention aligned to assessment requirements

Cyber Essentials assessments ask for evidence. An aligned managed IT arrangement produces that evidence as a by-product of normal operation.

4. Standardisation across the user estate

Standardisation is the operational expression of governance. It reduces the attack surface and makes evidence collection predictable.

The Difference Between Managed IT and Reactive IT in Practice

Response model

Reactive IT responds when something fails. Managed IT monitors for conditions that precede failure.

Evidence model

Reactive IT generates evidence retrospectively. Managed IT generates evidence continuously.

Improvement model

Reactive IT optimises for ticket closure. Managed IT optimises for baseline improvement.

Common Claims to Treat Carefully

"We handle all your IT security"

This claim is often accurate at the level of endpoint antivirus and boundary controls. It is rarely accurate at the level of ownership, evidence, and maintenance governance.

"We will make sure you pass Cyber Essentials"

No provider can guarantee a certification outcome. A provider can design and maintain a baseline that is aligned with the scheme requirements.

"Our SLA guarantees security outcomes"

Service-level agreements typically describe response and resolution times. They do not guarantee security outcomes.

What to Look for in a Provider Conversation

The conversation should include: what is included in the baseline, who owns each control, how is patch management governed, how are device standards defined, what evidence is retained, how does the provider handle changes, and how does the provider distinguish between support responsiveness and security governance.

Is a Security Triage Call the Right Next Step?

For SMEs that recognise the gap between their current IT arrangement and the baseline described above, the immediate need is usually diagnosis, not purchase. A Security Triage Call is intended to identify current gaps against the Cyber Essentials v3.3 control set.

FAQ

Is reactive IT ever acceptable for an SME?

Reactive support is acceptable for device faults and user requests. It is not sufficient as the entire security model.

Does Cyber Essentials require managed IT?

Cyber Essentials does not require a specific procurement model. It requires controls, evidence, and maintenance.

What is the difference between a Security Triage Call and a Security Baseline Review?

The Security Triage Call is a no-prep, diagnostic-first conversation. The Baseline Review is a deeper paid engagement that produces a maintained baseline, evidence package, and governance model.

Can managed IT replace internal IT governance?

No. Managed IT provides operational capability and external accountability, but the business retains responsibility for approving the baseline.

Does Infinite Cloud IT offer managed IT services?

Infinite Cloud IT provides managed and standardised operating models aligned to Cyber Essentials, with ownership, evidence, and maintenance governance built into the engagement.

This article was generated with AI assistance and reviewed by the Infinite Cloud IT marketing team.