An estate review, then a service you can leave.

Preferably. Most of our best outcomes are blended teams. Your engineers know the business; ours bring practices and capacity. It also makes the eventual hand-off almost free.

A fair question, and you should not have to diagnose yourself before you are allowed to buy help. The rough line: keeping things running and hard to break is ours: patching, endpoint protection, access, tested backups, the mail security that stops most of what arrives by email. Finding out whether someone got in, proving to an insurer or an auditor that a control works, and responding to an incident that has already happened is the cybersecurity practice, which is separate people on a separate engagement. If you are not sure which one you need, write to either and say what happened; sending you next door costs us nothing and guessing costs you a lot.

Managed support runs $150–$250 per user per month across the market, and device protection $75–$150 per device per month; those are measured market rates rather than our rate card, and they are on the services page. Where you land inside a band is a question about your estate rather than your headcount, because the same seat count can be two different jobs: how many sites, what is already in place, and what condition it is in. That is what the estate review settles, and it ends in a written picture of what you have and what it would cost to run. Tell us roughly what you have in your first message and we will give you a narrower number in the reply, before you commit to anything.

One business hour to a named engineer who has read your ticket, Monday to Friday, 8:00 to 18:00 Central. Not an autoresponder and not a queue position, a person, with the ticket open. If your people cannot work, that is where we already are. Outside those hours we are not a standing commitment, and we would rather write that down than imply a rota two people cannot staff: after-hours cover exists where your agreement provides for it, and that agreement names who you call and what it costs. The reason the number is one hour rather than fifteen minutes is that it counts from your problem to an engineer, not to a system acknowledging receipt.

The term is agreed with you rather than imposed: a support agreement is negotiated against your estate, your renewal dates and whatever your outgoing provider is holding, so the term that suits a single-site operation is not the one that suits five. What we will not do is make it hard to find. Ask for the notice period in your first message and it will be in the proposal rather than discovered in the paperwork. If you are leaving an incumbent right now, say so, because the handover is the part we would want to plan around first.

Yes. We work under client paper rather than asking you to work under ours, and we redline rather than refuse. Security is handled through an exhibit written for your data rather than a pointer to our own policy, and the terms we will agree to there include notification of any actual or suspected incident within 24 hours, the content and timing of any notification to your customers or regulators left entirely in your control, a BAA where PHI is involved, and support for joint security testing. Questionnaires are part of onboarding rather than an afterthought. Send the requirements early, including whatever insurance you require us to carry, and we’ll flag anything we can’t meet.

Usually one of three ways, and we will tell you which is fastest for your institution rather than the one that suits us. First, subcontracting: we work under a prime who already holds the vehicle, which is the most common route for a firm at our stage and needs nothing new from your procurement office. Second, your own delegated authority: many institutions can issue a purchase order directly for services under their own limit, and those limits are set locally rather than centrally, so the number is yours to confirm. Third, a cooperative or state vehicle you already use. Being plain about that third one: we hold no cooperative or state contract awards today. Awards on those come through competitive solicitation cycles rather than on request, they are published, and any vendor implying otherwise is worth checking. If a vehicle is the only viable path for you, the honest answer is that we are the wrong firm this fiscal year, and we will say so on the first call rather than in month two.

All in the United States, all in Central time. We don’t subcontract delivery offshore. If a role requires clearance, citizenship or on-site presence, tell us early and we’ll be direct about whether we can staff it.

In the engagement agreement, in writing, before any work starts. Ownership and licensing are commercial terms rather than something we publish a standard answer to here, and they are settled with you during scoping. What we will say in general is that we do not rely on “work made for hire” language to do it: work for hire is a copyright doctrine that does not reach patents or trade secrets, and it reaches commissioned work only in nine narrow statutory categories that software is not one of, so whatever is agreed is agreed by express assignment. Any third-party or open-source component we use is listed with its license.

Acceptance criteria go in the statement of work, in objective terms, before the work starts. If something doesn’t meet them we fix it at our cost inside a defined window. Nothing is ever deemed accepted because time passed, and a holdback on each phase is released only on acceptance of that phase. If we can’t get it right, you stop paying for it.

Every change is priced and signed before work on it starts. We also rewrite our own assumptions as your obligations with dates attached, because an unstated assumption is how a contractor creates an exit and a change-order revenue stream at the same time. On estimated work we agree an overrun mechanism up front: modest variance is ours to absorb as the normal play in an estimate, and a large miss means the estimate was a guess, which is our problem rather than yours.

Mutual, with carve-outs that sit outside the cap: IP infringement indemnity, gross negligence, willful misconduct, and deliberate misuse of your confidential information. A cap that swallows the indemnity makes the indemnity decorative. We draw one line deliberately: a confidentiality breach we caused on purpose is uncapped, and one caused by a mistake sits under the cap or under a higher security-specific cap we will agree. We would rather tell you where our insurance actually reaches than promise an unlimited number that nothing funds. We’ll negotiate it against the size and criticality of the engagement, and we’d rather have that conversation on the first call than in week six.

Whatever the engagement agreement says, and it says it before any work starts rather than at the end. Ownership, licensing and where the code and infrastructure are held are settled in writing during scoping, which is also what decides whether an escrow arrangement is worth anything to you. What does not depend on that negotiation: the hand-off phase is in the plan from the start rather than improvised under pressure, your data is exported in a platform-neutral format as well as ours and then certified destroyed to NIST SP 800-88, documentation, runbooks and architecture decision records are written as the work happens rather than assembled at the end, and there is a named handover contact for a defined window after the last day.