Managed IT services fall into nine core categories: network and infrastructure management, help desk and end-user support, managed cybersecurity, cloud services management, backup and disaster recovery, managed communications, compliance management, vendor and procurement management, and strategic IT consulting. Most providers bundle several of these into a flat monthly fee — and almost no two providers mean the same thing when they say "fully managed."
That last part is why this article exists. When businesses compare quotes, the prices often look wildly different because the bundles underneath them are wildly different. Once you can name the nine types, you can read any proposal and see exactly what's included, what's missing, and what you'd still be on the hook for yourself.
1. Network and infrastructure management
The foundation layer: servers, firewalls, switches, wireless, and the monitoring that watches all of it. The provider keeps systems patched and updated, watches for failures and capacity problems, and fixes issues — often before anyone at your business notices them. If a proposal doesn't include proactive monitoring and patching, it isn't managed IT; it's on-call repair with a monthly invoice.
2. Help desk and end-user support
The part your employees actually experience: someone to call when a laptop won't start, email misbehaves, or a password needs resetting. The details worth checking are the hours (business hours vs. 24/7), the channel (phone, chat, ticket portal), and the guaranteed response time. Ask for the provider's real average response time, not just the contractual maximum — the gap between those two numbers tells you a lot.
3. Managed cybersecurity
Everything that protects the business: endpoint protection, email filtering, identity and access controls, and — critically — someone actually watching the alerts. Security tooling that nobody monitors is decoration. Verizon's Data Breach Investigations Report found ransomware present in 88% of breaches at small and mid-sized businesses, and the common thread is that the early warning signs — a suspicious login, a new email forwarding rule, an off-hours privilege change — went unseen. Some providers include baseline security in every agreement and offer advanced monitoring as a tier; others quote security entirely separately. Make them spell it out.
4. Cloud services management
Administering the platforms your business runs on — Microsoft 365 or Google Workspace, plus any servers or applications hosted in Azure, AWS, or a private cloud. This covers licensing, user setup and offboarding, configuration, cost optimization, and migrations. It matters more than it sounds: misconfigured cloud accounts are one of the most common ways businesses get breached, and unmanaged licensing is one of the most common ways they overspend.
5. Backup and disaster recovery
Not the same thing as "we have backups." Managed backup means someone verifies the backups actually ran, tests that they restore, and has a documented plan for how long recovery takes. The two questions that define this service: how much data can you afford to lose (hours? a day?) and how long can you afford to be down? If your provider can't answer both with numbers for your environment, this type isn't being managed — it's being assumed.
6. Managed communications
Business phone systems (VoIP), video conferencing, and the collaboration stack. Often bundled with general IT support, sometimes carved out separately. The value is having phones, meetings, and chat administered by the same team that runs your network — when call quality drops, you don't want two vendors pointing at each other.
7. Compliance management
For businesses that answer to a framework — HIPAA in healthcare, CMMC for defense contractors, PCI for card payments, SOC 2 for companies selling to enterprises, or cyber-insurance requirements, which have quietly become a compliance framework of their own. This service maps controls to requirements, maintains the evidence, and prepares you for audits and questionnaires. If you're in a regulated industry, this type decides which providers are even eligible — a generalist without compliance experience will cost you more in audit pain than they save in fees.
8. Vendor and procurement management
The unglamorous type nobody markets: sourcing hardware and software, managing warranties and renewals, and being the single throat to choke across your internet carrier, printer company, and line-of-business software vendors. Its value shows up the first time something breaks between two vendors and you make one call instead of five.
9. Strategic IT consulting (vCIO / vCISO)
The forward-looking layer: technology budgeting and roadmaps, security strategy, and executive-level guidance — the work a CIO or CISO would do, delivered fractionally. In practice this is a scheduled cadence of planning reviews rather than a person on staff. It's the type most often missing from cheap agreements, and its absence is why some businesses run five-year-old servers into the ground and then face a surprise six-figure refresh.
How the nine types get bundled
| Bundle you'll see quoted | What it typically includes | Who it fits |
|---|---|---|
| Fully managed | Types 1–5 as the core, usually 6 and 8, with 7 and 9 varying by provider | Businesses with no internal IT staff |
| Co-managed | Provider owns monitoring, security, and help desk; your internal IT keeps projects and line-of-business apps | Businesses with an IT person or small team |
| Security-only | Type 3 (plus parts of 7), layered on top of whoever does day-to-day IT | Businesses happy with their IT but exposed on security |
| Monitoring-only | Type 1 alerts, with repairs billed hourly | Cost-sensitive businesses accepting slower fixes |
Pricing follows the bundle. Most small and mid-sized businesses land between $100 and $200 per user per month for a fully managed agreement — we've broken down what drives the range in our IT support cost guide. If a quote comes in far below that, the money usually came out of type 3 or type 5 — the two you'll miss most at the worst possible time.
Reading a proposal? Score it against the nine types: which are included, which cost extra, and which are silently absent. The most expensive line item in managed IT is the type you assumed was covered and wasn't.
Which types you actually need
Every business that depends on technology needs the first five: infrastructure management, support, security, cloud management, and backup. Those are the "keep the lights on and the doors locked" layer, and going without any of them is a gamble, not a savings.
The rest depend on your situation. Regulated industry or cyber-insurance requirements? Type 7 is mandatory. Multiple offices or a phone-heavy operation? Type 6 earns its keep. Growing past 20–30 employees? Type 9 is the difference between a technology plan and a technology surprise. And if you already have internal IT, the real question isn't which types to buy — it's how to split them, which is a different decision with its own trade-offs.
For the full picture of how these types come together in one agreement, see our managed IT services overview.
Frequently asked questions
Want your current coverage scored against the nine types?
A free assessment maps what you have, what's missing, and what each gap would actually cost your business — no pressure, no pitch.
Get a Free Assessment