A managed IT agreement is not a support phone number. It is a written scope, a fixed monthly fee, and a named team that is responsible for your systems whether or not anything has broken this month. This page sets out what NetFusion Designs covers under a managed agreement in Toronto, how we scope and price it, what onboarding involves, and where the boundaries sit — so you can compare us properly against the other firms you are speaking to.
Need something fixed today instead? See IT support in Toronto
Under a managed agreement, the work below is ongoing and included in the monthly fee. It is not billed by the hour and it does not wait for you to raise a ticket.
Endpoints, servers, network hardware, and cloud tenancies are monitored continuously. Patching runs on an agreed schedule with a maintenance window that suits your business hours. Firmware, agent health, and certificate expiry are tracked so they are dealt with before they become an outage.
Every user in scope can raise a ticket by phone, email, or portal, as often as they need to, without the fee changing. Our helpdesk and Security Operations Centre are staffed around the clock. Response targets are set by priority level and written into your agreement.
Managed endpoint detection and response, managed firewall, email filtering, conditional access and MFA enforcement, vulnerability scanning, and phishing simulation with staff training. Alerts are triaged by our SOC rather than forwarded to you as email. See 24/7 managed SOC, EDR and MDR.
Backups are configured, monitored, and test-restored on a defined cycle, with the results recorded. Your agreement states what is backed up, how long it is retained, where it is held, and the recovery process we would follow.
Tenancy administration, licence assignment and review, mailbox and SharePoint management, joiner-mover-leaver processing, and security baseline maintenance across Entra ID.
A live inventory of hardware, software, licences, warranties, and renewal dates. Refresh recommendations come with the budget forecast rather than as a surprise purchase order in December.
We deal with your line-of-business software vendors, internet provider, and telephony carrier on your behalf when an issue crosses their boundary, so your staff are not stuck on hold explaining an environment they do not administer.
Scheduled reviews with a virtual CIO covering roadmap, risk register, budget forecast, and the projects worth doing next year. Included in the agreement, not sold as consulting hours.
Most Toronto businesses arrive here from one of two places: an hourly break/fix arrangement, or a single internal person carrying everything. Both work until they do not. Here is what is actually different once an agreement is in place.
| Ad-hoc or hourly support | Managed agreement | |
|---|---|---|
| What triggers work | You notice a problem and call | Monitoring, scheduled maintenance, and your tickets |
| Cost behaviour | Rises in your worst months | Fixed monthly, quoted before you sign |
| Commercial incentive | The provider bills more when things break | The provider absorbs the cost when things break |
| Documentation | Lives in the technician's head | Maintained in our system and handed to you on request |
| Security posture | Reviewed when something happens | Baselined at onboarding, reviewed on a set cycle |
| Patching | When someone gets to it | Scheduled, with a maintenance window you agreed |
| Budgeting | Reactive purchase orders | Forecast in the vCIO review |
| Escalation | Whoever answers | Defined path by priority, named account contact |
The commercial incentive line is the one worth sitting with. Under an hourly arrangement, a fragile environment is revenue for your provider. Under a fixed-fee agreement, it is a cost. That single change is why managed IT providers invest in prevention.
We quote per environment. There is no rate card on this page because a fifteen-person accounting practice in the Financial District and a forty-person distributor with a warehouse in Etobicoke do not have comparable requirements, and any provider quoting you before looking would be guessing.
Pricing is per user or per device depending on which model fits your environment better, charged monthly on an agreed term. The fee covers everything listed under “What a Managed IT Agreement Covers” for the users and devices named in the schedule. Adding staff adjusts the fee at the agreed per-unit rate; you do not renegotiate the contract to hire someone.
Project work is scoped and quoted on its own: office moves, server or firewall replacement, a Microsoft 365 tenant migration, a new site build-out, a major application deployment. Hardware and third-party licences are passed through. We tell you at quoting stage which of the remediation items we find are inside the agreement and which will come back as a project, so the first invoice after onboarding holds no surprises.
Scope disputes are the most common reason managed IT relationships sour. We would rather have the awkward conversation at quoting stage than at month seven.
That last item is not a technicality dressed up as fine print. If a client declines MFA, or keeps a legacy server that cannot be patched, we will document it, propose the alternative, and record the accepted risk. We will still help. It simply sits outside the fixed fee, and you will know that in advance rather than afterwards.
Both models run on the same agreement structure, the same tooling, and the same SOC. The difference is who holds which responsibilities.
We are your IT department. We hold the helpdesk, the infrastructure, the security operations, the vendor relationships, and the strategy. This suits businesses with no internal IT staff, or with an office manager who has quietly inherited IT alongside their actual job.
You keep your internal IT person or team, and we take the layers that are hard to staff for: the after-hours coverage, the security operations centre, the patching and monitoring platform, the escalation path for problems outside their specialism, and the holiday and sick-leave cover. Your team keeps the user relationships and the application knowledge that is genuinely theirs. More detail on co-managed IT.
If your internal person is spending their week on password resets and printer queues rather than the projects you hired them for, co-managed usually returns more value than either replacing them or hiring a second. If IT is currently nobody's actual job, fully managed is the cleaner answer. We will say which one we think fits after the assessment, including when that means recommending the smaller engagement.
Signing an agreement does not make an environment supportable. Onboarding is where a managed relationship is made or lost, so ours is a defined project with a named lead, not a handover email.
We deploy monitoring and management agents, take a full inventory of hardware, software, licences, and identities, and document network topology, firewall rules, backup jobs, and administrative credentials. We meet your team so they know who they are calling. Anything urgent found in this window is dealt with immediately rather than queued behind the plan.
We work through the findings from discovery in risk order: unsupported operating systems, missing or failing backups, absent MFA, over-privileged accounts, unpatched firmware, expired warranties, shared administrator credentials. Items inside the agreement are simply done. Items that are genuinely projects were flagged and priced at quoting stage, so you are approving something you already saw.
Security baselines are applied and confirmed, backup restores are tested and recorded, documentation is completed, and the escalation path and maintenance windows are agreed in writing. You receive your first full reporting pack and hold your first review with the virtual CIO, which sets the roadmap and budget forecast for the year ahead.
If you have an incumbent provider, we manage the handover: credential transfer, licence and tenancy ownership, DNS and domain control, backup data, and documentation. Tenancy and domain ownership should sit with you, not with any provider, and if it currently does not, correcting that is part of onboarding.
A managed agreement that nobody reviews becomes an invoice nobody questions. Ours has a governance rhythm attached.
Tickets are classified by business impact, from a full outage affecting the whole company down to routine requests. Each priority carries a response target set out in your agreement, along with the escalation path if it is not met. Priority definitions are written in plain terms describing business impact, so classification is not a matter of interpretation after the fact.
You receive a regular reporting pack covering ticket volume and type, response performance against target, patch and backup status, security events handled, and asset changes. It is written to be read by a business owner rather than a systems administrator.
Scheduled reviews with your virtual CIO cover what the reporting is showing, the current risk register, the budget forecast, licence and warranty renewals coming up, and the projects worth planning. This is where recurring problems get addressed structurally instead of being closed as tickets forever.
Changes to your environment follow an agreed approval process, and you have a named account contact who knows your business rather than a general enquiries queue. Changes to scope — sites, users, systems — are recorded as schedule amendments so the agreement stays an accurate description of reality.
Terms are agreed up front. If the relationship ends, your documentation, credentials, tenancy ownership, and backup data are yours and are handed over. We would rather be kept because the work is good than because leaving is difficult.
Security is not a line item you add to a managed agreement in Toronto. It is the reason most of the agreement exists.
Every managed client is brought to a defined security baseline: managed endpoint detection and response, enforced multi-factor authentication, conditional access policies, managed firewall and email filtering, privileged account separation, and backups held so that an attacker with access to production cannot reach them. Our Security Operations Centre triages alerts around the clock and escalates to your named contacts under the process agreed at onboarding.
We are SOC 2 Type 2 attested. That means an independent auditor examined how we handle client data and administrative access over a period of time, not on a single day. It is an attestation, not a certification, and we describe it accurately because the firms that ask us about it — legal, financial, healthcare — know the difference.
For regulated and contractually obligated clients, we support the evidence side of compliance: access reviews, log retention, documented controls, and completed security questionnaires for your clients, your regulator, or your cyber insurer. More on our compliance work.
We do not publish uptime figures or guarantees. Availability depends on your hardware, your carriers, your cloud providers, and your budget for redundancy, and a number on a marketing page tells you nothing about any of them. What we will do is state, in your agreement, what we monitor, what we maintain, how we respond, and how it is reported.
The agreement structure is consistent. What changes by sector is the baseline, the compliance evidence, and the applications we need to support.
Practice management and imaging systems, PHIPA obligations, workstation hygiene in operatories, and backups that are provably restorable. Multi-site practices get consistent standards across every location. See managed IT for dental practices.
Document management, matter confidentiality, retention and access controls, client security questionnaires, and law society expectations around data handling.
Privileged access control, audit logging, retention, and the security evidence that institutional clients and regulators request.
ERP and warehouse systems, plant floor equipment on networks that were rarely designed with security in mind, and separation between operational technology and the corporate network.
Site connectivity, mobile and rugged devices, and project teams that appear and disband as jobs start and finish.
Constrained budgets, donor and member data obligations, high volunteer turnover, and licensing programmes worth actually using.
We work remote-first because it is faster for the majority of issues, and on-site when a problem needs hands on hardware. What matters under an agreement is that this is written down rather than negotiated each time: your agreement states how often scheduled on-site attendance is included and how additional visits are handled.
Our Toronto office is at 401 Bay Street, 16th Floor, with a second office at 141 Main Street N in Markham. Managed clients are supported across Toronto, North York, Scarborough, Etobicoke, Markham, Vaughan, Richmond Hill, Mississauga, Brampton, and Oakville.
Our local presence, the districts we attend, and how day-to-day support works if you are not on an agreement are set out on our IT support in Toronto page. This page covers only how on-site attendance is scheduled and charged inside a managed agreement.
You are likely comparing several IT services companies. These are the questions that separate them, and we have put our own answers underneath so you can hold us to the same standard.
Ask what happens in a month with unusually high ticket volume. Ours does not meter helpdesk contact for users in scope.
Ask for the exclusions in writing before signing. Ours are listed above on this page.
You should. If a provider holds your Microsoft tenant or your domain registration in their own account, ask why. We put ownership in your name and hand over documentation on request.
Ask who answers at 2am and what they can actually do. Ours is staffed around the clock by our own helpdesk and SOC.
An undefined onboarding is a warning sign. Ours is a ninety-day project with defined phases, set out above.
You are handing a provider administrative access to everything. We hold a SOC 2 Type 2 attestation and will share the report under NDA.
Ask about notice, data handover, and credential transfer at the start, while everyone is being pleasant about it.
Continuous monitoring and scheduled patching, unlimited helpdesk for the users in scope, managed security tooling with SOC triage, backup management and test restores, Microsoft 365 and identity administration, asset and licence lifecycle tracking, vendor coordination, and scheduled virtual CIO reviews. Projects, hardware, and third-party licences are quoted separately.
IT support is what you call when something is broken. A managed agreement includes that, and adds the work that stops things breaking: patching, monitoring, security baselines, backup testing, and planning. The commercial structure also changes — a fixed monthly fee rather than hours billed after the fact. If you mainly need responsive help now, our Toronto IT support page is the better starting point.
Pricing is per user or per device and quoted per environment after an assessment. The variables that move it most are user count, number of servers and sites, security and compliance obligations, and the condition of the current environment. We quote in writing before you commit, with the exclusions stated.
Yes. Co-managed agreements are a substantial part of what we do. Your team keeps the user relationships and application knowledge; we take monitoring, security operations, after-hours coverage, and escalation. The split is agreed in writing at the start and reviewed as the arrangement settles.
Plan for ninety days to reach steady state. Monitoring and helpdesk go live in the first fortnight; the middle weeks are remediation; the final weeks are baselining, backup restore testing, documentation, and your first reporting pack and vCIO review.
Terms are agreed at quoting stage. We would rather discuss the term openly than hide it, and we hand over documentation, credentials, and data if an agreement ends.
Managed agreements suit organisations from roughly ten users upward. Below that, the economics usually favour a lighter arrangement, and we will tell you if that is the case rather than sell you something that does not fit.
Yes. We hold a SOC 2 Type 2 attestation, meaning an independent auditor tested our controls for handling client data and administrative access over a period of time. We can share the report under NDA.
We manage the transition, including credential handover, tenancy and domain ownership, backup data, and documentation. Most switches happen without a service gap, and we will coordinate the timing around your notice period.
Tell us how many users you have, how many sites, and what is currently causing the most friction. We will assess the environment, tell you what we would fix in the first ninety days, and quote the agreement in writing — including what sits outside it.
We will reply within one business day. If a managed agreement is not the right fit for where you are, we will say so.
We respect your privacy. We will not send you marketing you did not ask for.
%20(1).avif){kind=logo}
%201.avif)
