Registered office
20 Wenlock Road
London N1 7GU
Managed server support puts routine monitoring, maintenance, security, backup oversight and incident response under clear ownership. The provider looks after an agreed set of Windows, Linux, cloud or on-premises servers, while the contract defines what is monitored, what changes are included and how urgent incidents are handled.
Reviewed: 18 August 2026
What is normally included?
- Discovery, documentation and an initial risk review
- Availability, resource and service monitoring
- Operating-system and supported application patching
- Security hardening and vulnerability response
- Backup monitoring, retention checks and restore testing
- Incident triage, troubleshooting and escalation
- Capacity and performance management
- Change records, reporting and recommendations
The exact boundary matters. “Managed” should never be assumed to mean every application, database, network or recovery event is automatically covered.
1. Onboarding and documentation
A responsible provider starts by identifying servers, operating systems, applications, dependencies, administrators, network exposure, backup jobs and business owners. It should also record support status, licences, certificates, maintenance windows and current risks.
Onboarding normally produces an asset list, access method, escalation contacts and a small runbook for common events. Unknown infrastructure is difficult to recover under pressure, so documentation is part of the service—not optional paperwork.
2. Monitoring and alert response
Monitoring may cover reachability, CPU, memory, storage, services, logs, certificates, backup jobs and selected application checks. Useful monitoring also defines who receives an alert, at what threshold and what happens next. A dashboard that nobody reviews is not management.
Ask whether alerts are handled around the clock or only during contracted hours. Also distinguish “monitoring” from “resolution”: an alert may be included while the remedial project, hardware replacement or third-party licence is charged separately.
3. Patch and vulnerability management
Managed support should include an agreed rhythm for operating-system updates, testing, maintenance windows, reboots, verification and reporting. Critical vulnerabilities or actively exploited issues need a risk-led route outside the normal monthly schedule.
The provider should record exceptions when a patch cannot be applied and agree a temporary mitigation or acceptance with the business owner. Our server patching checklist sets out the process for Windows and Linux systems. The NCSC’s vulnerability management guidance also emphasises knowing assets, triaging vulnerabilities and remediating according to risk.
4. Security hardening
Hardening typically includes removing or disabling unnecessary services, restricting administrative access, configuring host firewalls, securing remote management, reviewing privileged accounts and applying a documented baseline. Internet-facing services need particular care.
Clarify whether the service includes endpoint detection, managed firewall, security information and event management, penetration testing or compliance consultancy. These are often related services rather than automatic parts of a base server plan.
5. Backups and recovery
A backup service should define what is protected, frequency, retention, storage location, encryption, monitoring and who can delete backups. It should also define recovery point objective (how much data may be lost) and recovery time objective (how quickly service should be restored).
Restore testing is essential. Ask whether tests cover individual files, databases, applications or a complete server, and how often evidence is produced. Disaster recovery—the coordinated restoration of a business service—may require a separate plan even when server backups are included.
6. Incident response and troubleshooting
The provider should triage outages, high resource use, failed services, certificate problems, update failures and suspected compromise within the contracted scope. Priority levels should be based on business impact and carry clear first-response targets.
First response is not the same as resolution. Complex incidents may depend on a software vendor, cloud platform, internet provider or customer decision. The useful measure is whether ownership, updates and escalation remain clear until the service is stable.
7. Performance and capacity
Managed support should identify trends before storage, memory, CPU or database growth causes an outage. Recommendations may include configuration tuning, query or index work, archiving, resizing or architectural changes.
Optimisation projects and application code changes are often outside routine support. The agreement should show where monitoring ends and chargeable engineering begins.
8. Reporting and service review
Reports should turn technical activity into decisions: availability, incidents, patch compliance, backup results, risks, capacity trends, changes and actions requiring approval. A periodic review is the place to address recurring faults, unsupported software and planned growth.
What is commonly excluded?
- Unsupported or end-of-life operating systems
- Application development and code defects
- Major migrations, redesigns and new server builds
- Third-party licence, cloud and hardware costs
- Guaranteed recovery where backups were never in scope
- Onsite work or out-of-hours changes unless contracted
- Security incident forensics and legal response
Exclusions are not a warning sign when they are explicit and a route exists to scope additional work. Ambiguity is the real risk.
Managed server support questions to ask
- Which servers, services and applications are covered?
- What hours are monitored and staffed?
- What are the priority levels and first-response targets?
- Which updates are automatic, tested or manually approved?
- Who owns backups and how are restores tested?
- How is privileged access protected and audited?
- What happens when a third-party supplier is responsible?
- Which projects or incidents incur additional charges?
- How can the service be exited, and who owns the documentation?
The NCSC provides a broader checklist for choosing an MSP, including responsibilities, data access, resilience, incident management and exit arrangements.
ACA managed server support
ACA Tech Solutions supports Windows and Linux servers across cloud and on-premises environments. The published service combines monitoring, patching, backup checks, hardening, reporting and escalation, with plans from £99 per server per month. Review the current managed server plans and scope for exact inclusions and response targets.
Frequently asked questions
Is hosting included in managed server support?
Not necessarily. Management can be applied to a server hosted by the provider, a public cloud or the customer’s premises. Confirm infrastructure charges and management fees separately.
Does managed support include 24/7 resolution?
Only if the contract says so. Some plans monitor around the clock but perform routine work in business hours; others include 24/7 response for priority incidents.
Who owns administrator credentials?
The customer should retain appropriate ownership and an exit route. Day-to-day privileged access can be controlled through named accounts, secure vaulting and documented emergency access.
