These are the questions Australian businesses most often ask us about IT support, answered directly.
How quickly should an IT provider respond?
A reasonable expectation for a managed IT agreement is a first response within one business hour. The important distinction is what "response" means: an automated ticket acknowledgement is not a response, and some providers measure it that way. Ask whether the figure quoted means an engineer is actively working the issue.
Xen IT averages under 15 minutes for support requests from managed clients, and responds to new enquiries within 2 business hours.
Should an IT contract have a lock-in period?
Multi-year lock-in contracts primarily protect the provider. Month-to-month agreements with a reasonable notice period have become the standard among providers confident in their service. If a provider requires a three-year term, it is fair to ask what happens to their incentive to perform in year two.
Who owns our data and our Microsoft 365 tenant?
Your business owns its data, its domain name and its Microsoft 365 tenant. An IT provider administers these on your behalf. A provider who refuses to hand over administrative access to systems you legally own is not exercising a legitimate right, and this is worth confirming in writing before you sign anything.
What happens to our IT if we switch providers?
A well-run transition involves no downtime. Access transfers, monitoring agents deploy quietly, and support continues throughout. A typical onboarding plan runs up to 45 days, with most of that being background work: documentation, security remediation and backup verification.
Do we legally have to report a data breach?
Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify the Office of the Australian Information Commissioner and affected individuals when a data breach is likely to result in serious harm. Ransomware incidents involving access to personal information are notifiable, not merely operational problems.
How often should backups be tested?
At least quarterly, with a genuine restore rather than a confirmation that the backup job completed. A backup that has never been restored is an assumption. Testing should cover a full restore of a representative system, and the time it takes should be recorded, because that is your actual recovery time.
Is multi-factor authentication enough?
No, though it remains one of the highest-value controls available. Attackers bypass standard MFA through adversary-in-the-middle proxy attacks, push notification fatigue and SIM swapping. Phishing-resistant methods such as FIDO2 security keys or passkeys are materially stronger than SMS or push approval.
What should we do if we are hit by ransomware?
Disconnect affected machines from the network without powering them off, then escalate immediately. Powering off destroys memory that may hold encryption keys and forensic evidence. Do not delete ransom notes or affected files, since they are evidence for insurers and regulators. Verify whether backups are isolated from the compromised network before doing anything else.
How much should IT support cost?
Most Australian SMBs pay between $900 and $2,500 per month for fully managed IT, or roughly $100 to $200 per user per month. Total IT spend including licensing, hardware and security typically lands between 3% and 6% of revenue.
What is after-hours support usually charged at?
This varies significantly and is worth pinning down before you need it. Some providers include after-hours response in higher tiers, others exclude it, and others bill at an agreed hourly rate. Xen IT escalates critical alerts 24/7 through monitoring, with after-hours emergency work billed at a negotiated hourly rate agreed with you up front.
Ready to stop fighting your IT?
Book a free, no-obligation IT assessment. We'll identify your biggest vulnerabilities and opportunities, and give you a clear roadmap, whether you engage us or not.