Does my business need IT support? A straight answer for UK firms of 3 to 100 people

The honest answer to this question is "it depends", but it depends on things you can check in ten minutes. This guide gives you a test based on what you run and what you hold, clears up the myths that keep businesses putting the decision off, and describes the events that usually force it. If you would rather skip to numbers, the IT support cost calculator gives an indicative monthly figure.

The ten-minute test

Count how many of these apply to your business.

1. You have five or more computers in regular use.
2. You have a server, a NAS or a shared drive in the office.
3. Staff share files, calendars and mailboxes through Microsoft 365 or Google Workspace.
4. You hold client, patient, financial or payroll data you could not recreate.
5. Any member of staff works from home or on the road.
6. Losing email or your main application for a full day would cost real money.
7. Nobody has restored a file from backup in the last six months to prove it works.
8. One person "does the IT" alongside their real job, or the owner does.
9. You have had a phishing email get through, a virus warning or a lost laptop in the last year.
10. An insurer, client or regulator has asked what security controls you have.

Zero or one: you can probably manage for now with the basics described below. Two or three: you are at the point where informal IT starts costing more than it saves. Four or more: you need structured support, and the question is only whether it is in-house, outsourced or a mix. That comparison is covered in in-house versus outsourced IT support.

When you genuinely can manage without it

Three situations where a formal contract is reasonable to postpone.

A very small cloud-only team. Two or three people, each on their own laptop, everything in Microsoft 365 or equivalent cloud apps, no server, no office network beyond a broadband router, no regulated data. Even here, do four things: turn on multi-factor authentication everywhere, buy a third-party backup for your Microsoft 365 data, keep laptops on automatic updates, and have a provider you can call. The NCSC's Small Business Guide covers the basics well.

A founder with real IT skills, temporarily. If you can configure a firewall and manage Microsoft 365 properly, you can run a small setup yourself. The cost is your time. Every hour on a printer driver is an hour not selling. This tends to last until the first hire who is not you.

A business between providers. If you have just outgrown a break-fix arrangement and are choosing a managed provider, a gap of a few weeks is manageable. Six months is not.

What IT support actually covers

Part of the reason the decision gets delayed is that "IT support" sounds like fixing computers. That is the smallest part of it. A managed contract typically covers:

• A helpdesk for staff, remote first, on-site when needed.
• Monitoring of every computer and server for faults before they cause downtime.
• Patching of Windows, browsers, Office and the firewall.
• Endpoint security (antivirus or EDR), email filtering and MFA enforcement.
• Backup monitoring and restore testing.
• Setting up joiners and disabling leavers.
• Network and Wi-Fi management.
• Advice on what to buy and when, so hardware is replaced on a plan rather than in a panic.

The full picture is in what is managed IT support?. If you only need three of those things, a provider can scope a smaller contract, but security and backup should never be the ones left out.

The myths that delay the decision

Six things business owners tell us, and why they do not hold.

"IT support is for big companies." Larger firms have IT departments. Support contracts exist precisely for the businesses that do not. Per-device pricing means a ten-person firm pays for ten devices.

"We're too small to be a target." The GOV.UK Cyber Security Breaches Survey reports that a large share of UK businesses of all sizes identify breaches or attacks each year, with phishing the most common. Attackers send the same email to everyone. Smaller firms are hit because they are easier, not because they are chosen.

"Our cloud provider handles security and backup." Microsoft secures its platform. You are responsible for your accounts, permissions and data, and Microsoft's own documentation on shared responsibility says so. Deleted items age out of retention. Ransomware syncs to OneDrive just as happily as a spreadsheet does.

"Our office manager is good with computers." They probably are. They are also not patching the firewall, reviewing who still has access to the shared drive, or testing backups, because none of that is their job. See what IT tasks should never be left to non-IT staff.

"We have insurance." Cyber insurance pays out after an incident, subject to conditions that increasingly require MFA, patching, backups and endpoint protection to have been in place. It does not prevent the incident, and it does not restore the week you lost.

"Support contracts lock you in." Some do. Twelve-month terms are common, rolling monthly is available, and any decent provider will explain notice periods before you sign. What matters more is that your data, documentation and admin credentials are yours on exit. We cover this in what to look for in an IT support contract.

What it costs to have nothing in place

Businesses without support do not pay nothing. They pay in a different currency.

Downtime lands on payroll. If 15 people cannot work for two hours, that is 30 staff hours gone. The IT bill for the fix might be small. The cost was already paid.

Recovery costs more than prevention. An engineer walking into an unknown environment during an incident has to discover the network, find or reset passwords, and work out whether backups exist, all while people are waiting. Planned onboarding does the same work calmly and once.

Security incidents are the expensive tail. A compromised mailbox used to send fake invoices to your customers, or a ransomware event with no clean backup, can cost more than years of support fees and may have to be reported to the ICO under UK GDPR.

Knowledge walks out the door. When the person who set everything up leaves, so do the passwords, the licence logins and the understanding of why the network is wired the way it is.

Growth stalls. New starters wait days for a laptop and access. Shared drives sprawl. Every new tool is bolted on without anyone owning how it fits.

The pattern is not a steady drain. It is long quiet periods punctuated by rare, expensive events, which is exactly why it is easy to under-budget.

What usually triggers the decision

In our experience businesses rarely buy IT support because a spreadsheet told them to. Something happens.

• A stoppage. The server fails, or the internet goes down for a day, and it becomes clear nobody knows how the systems work or how fast they can be fixed.
• A security scare. A mailbox is compromised, a member of staff clicks a link, the bank flags a payment. Even a near miss reveals that MFA, backups and filtering were never set up.
• Growth. The setup that worked for five people breaks at fifteen. Joiners wait, permissions are guesswork, remote working is improvised.
• The IT person leaves. The director or employee who held everything together goes on leave or moves on, and the passwords go with them.
• An outside question. A cyber insurance renewal, a supplier questionnaire from a large client, or a Cyber Essentials requirement asks for evidence that does not exist.
• A new director or finance lead. Fresh eyes look at the software subscriptions, the reactive spend and the risk, and ask why it has been tolerated.
• Small problems, added up. Slow machines, printers dropping off, email problems that return every few months. Individually trivial, together a constant drag.

If you recognise one of these, the question has probably already answered itself.

Which kind of support fits

Three routes, briefly.

The detailed comparison of the first two is in break-fix versus managed IT support. Most businesses of up to 250 people in Hertfordshire, west Essex and London that come to us end up on a managed contract, with projects such as office moves or migrations quoted separately.

What to do next

If you scored two or more on the test, the sensible first step is an IT health check: a structured review of your devices, network, Microsoft 365 setup, backups and security controls, with a prioritised list of what to fix first. It gives you a clear picture before you commit to anything, and it is the same assessment a new provider would run in the first weeks of a contract.