The IT Services Buyer's Guide for 50+ User Businesses

What does a mature IT setup look like at 50+ users?

A mature IT setup at this size is one where technology is planned, measured and tied to the business, rather than repaired when it breaks. Staff can work without thinking about IT. Leadership can say who is responsible for what, how much is being spent and what happens if something fails.

Below about 20 people, a good generalist and a handful of cloud tools are often enough. Somewhere around 50 users, the picture changes. There are more systems, more suppliers, more data, more customer questions about security and more cost if the business stops for a day. Informal arrangements start to creak.

This guide describes what good looks like for a mid-market firm, gives you a ten-area scoring grid to grade where you stand, and explains what to ask of a provider at each level. It is written for managing directors and operations managers who are not technical but are accountable for the result.

Why does the break-fix model stop working at this size?

Break-fix support responds to problems after they happen. It can be a sensible, economical choice for a very small business. At 50 users the cost of a problem is higher, because a failed server, a compromised mailbox or a lost laptop affects many people at once.

The deeper issue is that break-fix has no one looking ahead. Nobody is asked whether the firewall is nearing end of life, whether backups can be restored or whether the next office move has been planned. Those jobs fall to whoever notices, which is often nobody.

For more on how support models differ, see our guide to the levels of IT support, and for the commercial side, how to choose an IT support company. The article on moving away from an informal arrangement, outgrown the local IT person, covers that transition in detail.

What are the ten areas of IT maturity?

We use ten areas because together they cover what a board or a customer is likely to ask about. They are not a certification, and the scoring is yours to apply. The point is to make the conversation concrete.

1. Identity and access: who can sign in to what, with what protection, and how that changes when people join, move or leave.
2. Patching and device management: how quickly updates are applied and whether you know what devices you own.
3. Backup and recovery: what is backed up, how often and whether it has been restored in a test.
4. Security monitoring: whether someone watches for threats and responds, not just whether tools are installed.
5. Governance and policy: written policies, data handling rules and supplier oversight.
6. Continuity testing: a plan for failure that has actually been exercised.
7. Account management: a named person who knows your business and meets you regularly.
8. Roadmap and budget: a 12 to 24 month plan with costs attached.
9. Documentation: systems, passwords and processes recorded so they survive staff changes.
10. Support experience: how staff find the help desk, judged by the people who use it.

Some of these overlap with formal frameworks. If you want a more technical view of security specifically, see the cybersecurity maturity model guide and the overview of cybersecurity frameworks.

How do you score your own IT setup?

Score each area from 1 to 4 using the descriptors below. Choose the level that describes what is happening today, not what is planned or intended. If you are between two levels, take the lower. Where you do not know the answer, score 1 and treat the gap as a finding.

Add up the ten scores. The maximum is 40 and the minimum is 10. Then read your total against the bands below.

What do the scores mean?

Look also at the lowest individual scores, not just the total. A business scoring 3 in most areas with a 1 in backup and recovery is more exposed than the total suggests. Treat any 1 in identity, backup, security monitoring or continuity as a priority, whatever the band.

Be wary of treating this grid as a pass or fail test. It is a planning tool. Moving a score from 2 to 3 in the right area is worth more than a general effort to reach the top band.

Which areas matter most for data governance and continuity?

Governance is the area most often skipped at this size, partly because it feels like paperwork. In practice it answers questions that customers, insurers and auditors increasingly ask. Where is our data? Who can see it? How long do we keep it? What happens if a supplier fails?

Start with a short register of systems and data: what you hold, where it sits and who owns it. Add a supplier list with a note on what each supplier can access. Then write the handful of policies that you can actually follow. The guide on how to demonstrate cybersecurity compliance to customers shows what evidence tends to be requested.

Continuity is the second area. A business continuity plan sets out how you carry on if a key system, site or supplier is lost. It needs recovery priorities, named responsibilities, contact details and a tested method of restoring service. Our business continuity service page explains the typical components, and the incident response plan template helps with the cyber side.

• Recovery time: how long each key system can be down before the business is affected.
• Recovery point: how much recent data you could afford to lose.
• Responsibilities: who makes decisions and who communicates with staff and customers.
• Testing: the date and result of the last exercise, kept on file.

What does dedicated account management add?

At 50 users and above, a help desk alone is not enough. Someone needs to own the relationship, understand your plans and translate them into IT decisions. In a managed IT arrangement that role is often a named account manager, supported by a virtual CIO who provides strategy.

A virtual CIO does the planning work that a full-time chief information officer would do, on a part-time basis. Typical outputs are a technology roadmap, a budget, a risk review and board-level reporting. For firms that do not need a full-time executive, it is an efficient way to get that input. Ask how often the virtual CIO meets you, what a typical quarterly pack contains and who in your leadership team receives it.

The article on strategic IT support explains how this input links to growth, and the comparison of co-managed IT and fully outsourced IT helps if you already employ someone internally.

How should you evaluate IT services for 50+ users?

Evaluate providers by asking for evidence in the ten areas, not by comparing feature lists. A provider that can show a recent restore test, a sample roadmap and an anonymised service review is demonstrating maturity. One that can only show a brochure may be offering a lower level than you need.

• Ask for a sample report: one real format, with client details removed.
• Ask who your account manager would be: and how many clients they look after.
• Ask about security response: who watches alerts, at what hours and what they do next.
• Ask about onboarding: how the first 90 days would run.
• Ask about exit: what you receive if you leave, covered in the SLA guide and your contract.

Where you want help turning the scores into a plan, an IT consultancy engagement can produce a gap analysis and a costed roadmap before you commit to a long contract. For the technical foundations, see the pages on IT infrastructure and Microsoft 365, which sit behind many of the areas scored above.

What should a mid-market firm expect to pay for and receive?

Prices vary by scope, sector and provider, so we do not quote figures here. What you can do is check that the service you are paying for covers the ten areas, and that each area has an owner on the provider's side and on yours.

A well-structured managed IT support agreement for a firm of this size usually bundles the help desk, device management, patching, backup monitoring and security tooling into a defined monthly fee. Strategic input, projects and testing may sit inside or outside that fee, so ask which.

• Inside the fee: day-to-day support, patching, monitoring, backup checks and standard reporting.
• Often separate: larger projects, hardware purchases, penetration tests and major migrations.
• Worth clarifying: how many hours of account management and virtual CIO time are included, and how often they are used.

Insist on seeing how these items appear on the invoice. A fee that looks low but excludes monitoring, testing and strategy may not cover the levels you are trying to reach. The same applies in reverse: do not pay for a level 4 service if your business only needs level 3 in some areas.

How do you turn your score into a 12-month plan?

List the areas where you scored 1 or 2 and rank them by risk to the business, not by cost. Pick the top three. For each, name an owner, a target level and a date. Review progress every quarter.

A realistic first-year pattern for a business in the developing band looks like this, shown as an illustrative example rather than a prescription.

Re-score at the end of the year with the same three people. If the total has not moved, discuss why with your provider. Where infrastructure is changing as the business grows, the article on the shift in IT infrastructure at 50 seats describes what typically changes.

Key-person risk deserves a mention, since many firms at this size still rely on one individual. The guide to key-person risk in a single IT manager sets out how to reduce it.

Where can you get an independent view?

If you would like a second opinion on your scores, you can contact our team and we will talk through the grid with you. A conversation of that kind is most useful when you bring your three completed scorecards and your current contract.

If you would like the strategic side explained before you commit, read about our virtual CIO service. Whatever you decide, keep the scorecard. Repeating it every year gives you a simple, honest record of progress that you can share with a board, an insurer or a customer.