When a contractor grows from 15 employees to 60, the person who handled IT on the side, often the office manager or a nephew who is good with computers, stops being enough. Projects multiply, field staff need support, and the company starts handling more sensitive data. Many firms then look for a managed IT provider.
Not all managed services are equal. This guide covers what a good agreement should include for a contractor or energy company and what to ask before signing.
What belongs in the scope
Help desk that understands field work
Support hours should match when your people work. If crews start at 6 a.m., help that begins at 9 does not help. Ask about after-hours coverage, response time commitments, and how field staff reach support from a truck or a trailer.
Device and user management
The provider should set up, patch, and secure laptops, phones, and tablets, and handle onboarding and offboarding. Offboarding matters a great deal. When someone leaves, accounts should be disabled promptly and equipment recovered.
Security built in, not bolted on
Basic security should be part of the service: multi-factor authentication, email filtering, endpoint protection with monitoring, patching, and tested backups. If security is priced as an optional add-on that most clients skip, that is a warning sign.
Backup and recovery
Ask what is backed up, how often, where copies are stored, and when the last restore test took place. A provider that cannot answer the last question has not tested recovery.
Software and line-of-business support
Contractors depend on accounting, estimating, and project tools. The provider need not be an expert in every product, but should coordinate with software vendors and understand how these systems connect to each other.
Jobsite connectivity
If your projects need temporary internet, the provider should be able to help specify, configure, and support routers, failover, and secure remote access.
Planning and reporting
Look for a regular review that covers the asset list, open risks, and upcoming renewals, plus a technology budget for the next year. You should never be surprised by a laptop refresh or a license increase.
Questions to ask any provider
- Who is our primary contact, and who covers when they are out?
- What are your response targets, and how do you report against them?
- What security tools and practices are included in the base price?
- How do you handle an incident at 2 a.m. on a Saturday?
- Who owns the administrator credentials and documentation? You should.
- What happens if we leave? How are data and credentials handed back?
- Have you supported contractors or energy companies before, and do you understand compliance requirements like CMMC if we work on defense contracts?
Warning signs
- Vague pricing and unlimited promises with no defined scope.
- No clear process for onboarding and offboarding.
- Reluctance to share documentation or admin access.
- A long contract with no exit terms.
- Reports that list activity but not outcomes.
What a good first 60 days looks like
The first two months set the tone. Expect the provider to inventory your devices and accounts, document your network, confirm that backups work, enable multi-factor authentication, and give you a written list of risks ranked by importance. You should come out of that period knowing what you own, who has access to it, and what the plan is for the gaps.
Pricing models
Per-user pricing is common and predictable, and often includes help desk and basic management. Per-device pricing may suit companies with many shared field devices. Project-based work such as a migration is usually priced separately. Compare what is included, not only the monthly figure, and ask what triggers extra charges.
Start small and check the fit
A good provider will welcome a short onboarding assessment before a long commitment. Ironfield Cyber offers managed IT with security built in, designed around the way contractors and energy companies work. If you are comparing options, we are happy to review your current setup and explain what we would change and why.