For a NonProfit with 20–100 employees, managed IT services should do more than give employees somewhere to call when a computer stops working. A well-structured managed IT relationship should address six core responsibilities: employee support, cybersecurity, system reliability, backup and recovery, strategic planning, and clear accountability.
A useful way to think about it is:
Support → Security → Reliability → Recovery → Strategy → Accountability
The exact services included in a managed IT agreement will vary from one provider to another, which is why NonProfits should be cautious about comparing proposals based only on price or the number of services listed.
The more important question is:
“What is our IT provider taking responsibility for, and what responsibilities still belong to us?”
That distinction becomes increasingly important as a NonProfit grows. Technology may support employees in the office and in the field, sensitive client information may be stored across multiple systems, cybersecurity risks become more complicated, and leadership needs to plan for technology investments without diverting unnecessary resources away from the mission.
Managed IT should make that environment easier to manage—not simply create another vendor relationship for leadership to supervise.
1. Employee Support Should Help People Work, Not Just Close Tickets
For many employees, the help desk is the part of managed IT they experience often.
When something stops working, they need help.
That sounds straightforward, but the quality of that experience can have a significant impact on employee productivity.
Imagine an employee preparing for an important client meeting who suddenly cannot access a file. A program employee is unable to use an application required to document services. The Executive Director is preparing for a board meeting and cannot connect to a system. Or the bookkeeper's computer fails at exactly the wrong point in the month.
In each case, the technical problem matters because someone's work has stopped.
Good managed IT support should therefore be evaluated by more than how many tickets are closed. Employees should know where to go when they need help, the process should be easy to use, urgent problems should receive appropriate attention, and recurring issues should eventually lead to a conversation about why they keep happening.
Over time, the provider should also begin understanding how individual employees and departments use technology.
Heidi Maderia, Executive Director of the Association for Infant Mental Health in Connecticut, described that difference after I-M Technology took over her organization's IT support. She said employees were able to reach a live person quickly, were no longer wasting time navigating layers of support requests, and experienced significantly less downtime.
One of the smaller examples she shared is particularly revealing.
When an employee needed a replacement laptop, the I-M Technology team anticipated that the organization's bookkeeper would benefit from having a computer with a numeric keypad.
That isn't a complicated IT project.
But it demonstrates an important principle:
Good IT support isn't just about understanding the technology. It's about understanding the person using it and the work they're trying to accomplish.
For a NonProfit, that's ultimately what employee support should achieve.
2. Cybersecurity Should Be Part of the IT Conversation From the Beginning
Traditional IT support and cybersecurity are closely connected, but they aren't exactly the same responsibility.
An organization can have excellent technical support while still having significant cybersecurity gaps.
For health and social-services NonProfits, that distinction can be especially important. Employees may work with sensitive client information, access cloud applications from multiple locations, use mobile devices in the field, communicate through email throughout the day, and operate under regulatory, contractual, insurance, or funding requirements.
Managed IT should therefore include a clear conversation about cybersecurity responsibilities.
Leadership doesn't need to understand every security product or technical configuration. It does need to understand how the organization is protecting four broad areas:
Users → Devices → Email → Data
How are employee accounts being protected?
How are laptops, desktops, tablets, and other devices being secured and maintained?
How is the organization reducing risks coming through email?
And how is important organizational and client information being protected?
Depending on the provider and agreement, some cybersecurity services may be part of the core managed IT offering while others may be separate or more specialized.
That's fine—as long as the organization understands the distinction.
The dangerous situation is when leadership assumes the MSP is handling a security responsibility while the MSP assumes someone else is handling it.
If a cybersecurity responsibility isn't included, leadership should be able to answer:
“Then who is responsible for it?”
For NonProfits that need a more comprehensive cybersecurity approach, I-M Technology's SecureIT Managed Cyber Security services address cybersecurity as an ongoing responsibility alongside the broader technology environment.
3. Managed IT Should Make Technology More Reliable Before Something Breaks
One of the biggest differences between traditional break/fix IT and managed IT is what happens before an employee reports a problem.
The break/fix model is straightforward:
Problem → Call IT → Fix Problem → Wait for Next Problem
Managed IT should move the relationship toward something more proactive:
Monitor → Maintain → Identify → Prevent
Not every technology problem can be prevented. Hardware still fails. Software can behave unpredictably. Internet and power outages happen. Cybersecurity incidents remain possible even in well-managed environments.
The objective isn't perfection.
The objective is to reduce preventable disruption and identify issues earlier.
That may involve monitoring systems, maintaining devices, applying appropriate updates, identifying recurring problems, watching the health of infrastructure, and understanding when equipment is approaching the end of its useful life.
The result leadership should care about isn't how many monitoring tools the provider uses.
It's reliability.
Are employees able to work consistently? Is downtime decreasing? Are recurring problems being addressed? Does leadership have confidence that someone is paying attention to the environment even when nobody has submitted a support ticket?
Madonna Place provides a useful example of what that difference can look like.
The Eastern Connecticut NonProfit serves approximately 700 families each year, but its technology had reached a point where slow systems, recurring downtime, and inefficient technology were frustrating employees and consuming leadership attention.
After I-M Technology helped stabilize and manage the environment through reliable network management, employee training, proactive problem identification, and responsive support, Madonna Place reported near-zero downtime outside of power outages.
That is a much more meaningful managed IT outcome than simply saying a provider “offers monitoring.”
4. Backup and Recovery Should Answer More Than “Yes, We Have Backups”
Ask an organization whether its data is backed up and the answer will often be yes.
The harder question is:
“What happens when we need it back?”
Backup and recovery are related, but they aren't the same thing.
A backup is a copy of information.
Recovery is the organization's ability to use that copy to restore what employees and programs need after something goes wrong.
From an executive perspective, there are three useful questions:
What are we backing up?
How quickly would we need it back?
How do we know recovery will work?
Those questions move the conversation away from the backup product and toward operational continuity.
Imagine that an important system becomes unavailable tomorrow morning. Which systems would need to be restored first? How long could employees reasonably work without them? Who would coordinate the recovery? Are there applications or cloud systems leadership assumes are protected but that fall outside the provider's backup scope?
The Executive Director doesn't need to know every technical detail of how backups are configured.
But leadership should understand what is protected and what the organization should expect if recovery becomes necessary.
That's particularly important for NonProfits whose technology supports direct service delivery. An unavailable system may represent more than an inconvenience—it may affect the organization's ability to serve people.
5. Managed IT Should Include a Plan for the Next 12–36 Months
A managed IT provider shouldn't simply become an outsourced repair department.
Someone also needs to be looking ahead.
For a growing NonProfit, a useful technology roadmap should generally look 12–36 months into the future and help leadership anticipate significant changes rather than discovering them through emergencies.
Computers and infrastructure age. Cybersecurity requirements change. Programs grow. Employees begin working differently. New cloud applications are introduced. Organizations open locations or increase remote work. Technology that made sense three years ago may no longer be the right fit.
Without planning, many technology decisions become reactive.
A server fails, so leadership unexpectedly needs money to replace it. A new program launches, and only then does someone discover that the existing technology won't support it. A cybersecurity requirement changes, and the organization suddenly needs an unplanned investment.
A roadmap allows a different conversation:
What needs attention now → What can wait → Why
The phrase “what can wait” matters.
Good technology planning shouldn't be a mechanism for convincing a NonProfit to replace everything on the MSP's preferred schedule. It should help leadership balance reliability, risk, operational needs, and responsible stewardship of resources.
The Coast Guard Foundation provides a useful example.
When I-M Technology worked with the Foundation to modernize its environment, the approach was phased. Existing investments were considered, and older servers were allowed to reach end-of-life before systems were gradually transitioned to the cloud. The broader strategy also addressed infrastructure, communications, remote work, and cybersecurity.
That is what strategic managed IT should accomplish.
Leadership should know what is coming before it becomes an emergency.
When cloud technology is part of that roadmap, I-M Technology's Cloud Services can support that transition as part of a broader technology strategy rather than treating cloud migration as an objective by itself.
6. A Managed IT Agreement Should Make Accountability Clear
This may be the least technical part of managed IT, but it is one of the most important.
Someone needs to know who owns what.
A managed IT relationship generally involves three categories of responsibility:
MSP Responsibility → Client Responsibility → Shared Responsibility
Some responsibilities may belong almost entirely to the IT provider. Others require decisions from leadership. Still others depend on employees following organizational processes.
Cybersecurity is an easy example.
An MSP may manage a particular security system, but leadership may still need to approve policies and make decisions about organizational risk. Employees still need to follow security practices and report suspicious activity.
Likewise, an IT provider can recommend replacing an aging system, but leadership ultimately decides whether and when to approve the investment.
Problems arise when those boundaries aren't clear.
The Executive Director assumes the MSP is handling something. The MSP believes it belongs to another vendor. The other vendor assumes internal staff are responsible.
Nobody intentionally ignored the issue.
Nobody clearly owned it either.
That's why one of the most important questions in a managed IT relationship is:
“If something important isn't being handled by our MSP, do we know who is handling it?”
A good agreement—and a good ongoing relationship—should make that answer easier.
What Isn't Necessarily Included in Managed IT Services?
This is where comparing MSPs can become confusing.
“Managed IT services” isn't a standardized package.
Two providers can use exactly the same phrase while including very different services and accepting very different levels of responsibility.
Depending on the agreement, specialized cybersecurity services, hardware, software licensing, cabling, major cloud migrations, compliance or legal guidance, after-hours projects, strategic consulting, and other specialized work may or may not be included.
That doesn't make one structure automatically better than another.
It means leadership shouldn't assume.
Before signing an agreement, understand what is included, what is excluded, which responsibilities remain with your organization, which responsibilities belong to another vendor, and what types of work may result in additional costs.
This is particularly important when comparing two proposals with significantly different prices.
The less expensive proposal may genuinely be a better value.
Or it may simply include less.
The more expensive proposal may provide substantially more responsibility and expertise.
Or it may simply cost more.
You can't know by looking at the monthly number alone.
A Real NonProfit Example: What Managed IT Looked Like at Madonna Place
Madonna Place strengthens families through programs designed to promote health, prevent child abuse and neglect, and support parents and caregivers. The organization serves approximately 700 families every year in Eastern Connecticut.
More than two decades ago, technology had become a source of frustration for the organization. Systems were slow and inefficient, recurring downtime disrupted work, and leadership lacked confidence that the environment was reliable or scalable.
I-M Technology's approach wasn't limited to waiting for employees to report problems.
The relationship combined four elements: a reliable network, employee training, proactive problem identification, and responsive support.
That broader relationship became particularly important when the COVID-19 pandemic created an unexpected operational challenge.
Madonna Place had previously operated entirely onsite and didn't have remote-work infrastructure in place. Suddenly, employees needed a way to work in a hybrid environment without significantly disrupting services.
I-M Technology helped configure laptops, establish secure remote access, and train employees on the new systems. According to the case study, the organization was able to make the transition quickly and with minimal disruption.
Today, Madonna Place reports near-zero downtime outside of power outages, immediate response when issues occur, improved staff productivity and confidence in technology, and lower technology-related stress for leadership.
That's what makes the story useful when thinking about managed IT.
The value wasn't one particular technology product.
It was having an ongoing relationship capable of supporting employees, improving reliability, identifying problems proactively, and adapting when the organization's needs suddenly changed.
How Should a NonProfit Compare Managed IT Proposals?
When you're comparing providers, resist the temptation to put two proposals next to each other and immediately jump to the bottom line.
Start by determining whether you're comparing the same thing.
A useful framework is:
Scope → Responsibility → Response → Security → Strategy → Exclusions
Scope: What services are included?
Responsibility: What is the provider agreeing to manage, and what remains with your organization?
Response: What should employees expect when they need support?
Security: Which cybersecurity responsibilities are included, which are separate, and who owns anything outside the agreement?
Strategy: Will the provider help leadership plan ahead, or is the relationship primarily operational?
Exclusions: What isn't included, and what could create additional costs?
Once you understand those six areas, the price becomes much more meaningful because you know what you're paying for.
This also makes it easier to compare the providers themselves rather than merely comparing service descriptions.
Managed IT Should Give Your NonProfit More Than an IT Help Desk
For a 20–100 employee NonProfit, managed IT should ultimately create a technology environment that is easier for employees to use and easier for leadership to manage.
Employees should have dependable support.
Cybersecurity responsibilities should be clear.
Systems should be monitored and maintained proactively.
The organization should understand how it will recover when something goes wrong.
Leadership should have a 12–36 month technology roadmap rather than discovering major needs through emergencies.
And everyone should understand who is responsible for what.
That's the difference between simply outsourcing technical tasks and managing IT.
When evaluating a provider, don't ask only:
“What services are included?”
Also ask:
“What outcomes and responsibilities are we expecting this relationship to deliver?”
If you're comparing managed IT providers or proposals and aren't sure whether you're comparing the same level of service, learn more about I-M Technology's Managed IT Services or schedule a Discovery Call. We can talk through your current environment, the responsibilities that need to be covered, and the questions worth answering before you make a decision.
