25 August 2026LANTEK Computers
Buying IT support used to be simple to describe. Something broke, you called somebody, they fixed it, and you paid for the time it took. The incentive in that arrangement is honest but unhelpful: the supplier earns more when more goes wrong.
A managed service inverts it. You pay a fixed amount every month, and the supplier absorbs the cost of things going wrong. That changes what they do all day. Preventing an outage is now cheaper for them than attending one, so the work moves to the front of the process: patching, monitoring, hardening, verifying that the backup restores.
That is the whole idea. Everything below is what it has to include before the phrase means anything.
The four things that are not optional
Monitoring that produces an action. Every device and server watched continuously, and, more importantly, somebody who does something when it reports a problem. An alert that lands in a mailbox nobody reads is not monitoring, it is logging.
Patching on a schedule you could describe. Not when somebody remembers. A ring or a window, so that the machines get updated in a known order and a bad update cannot take out the whole business at once.
Backups somebody has restored from. An untested backup is a hope, not a control. The question that matters is not when it last ran, it is when somebody last restored from it and how long that took.
Identity treated as the perimeter. Multi-factor authentication on every account, not the ones who asked. Conditional access, so a sign in from an unexpected place is a decision rather than a door. Administrator rights reviewed rather than accumulated. Most of this lives in your Microsoft 365 tenant and most of it is already included in what you pay Microsoft.
What POPIA adds in South Africa
Section 19 of POPIA requires appropriate technical and organisational measures to secure personal information. It does not list them, which is the part businesses find frustrating and is actually the point: what is appropriate depends on what you hold and what it would cost somebody if it leaked.
Two consequences follow for anybody buying a managed service. The first is that your provider is an operator under the Act, processing personal information on your behalf, and the relationship should say so in writing. The second is that you will at some point need to demonstrate the measures were in place before something happened rather than after. That is an evidence problem as much as a technical one, and it is worth asking who produces the evidence.
The usual way to answer “appropriate” without arguing about it is to build against a recognised framework and be able to show where you stand. We use the NIST Cybersecurity Framework 2.0, which is the internationally recognised yardstick and covers the same ground POPIA describes in general terms.
What the monthly fee should not be
It should not be a per-seat number quoted before anybody has looked at what you run. Two businesses with forty staff each can have entirely different environments, and a price set from headcount alone is a guess that somebody will pay for later, either in a bill for out-of-scope work or in a service that quietly does less than it promised.
It should also not be the cheapest number available. A managed service is a labour cost with a margin, and the margin is what pays for the person awake at two in the morning. If it is not in the price, that person is not there.
How long moving actually takes
Two to six weeks is typical for a business under a hundred staff, and the long pole is almost never technical. It is documentation. If your current provider holds passwords, licences and configuration that has never been written down, recovering it is the work. The migration itself is short and, if it has been planned properly, reversible.
Ask for it to be staged around your trading week rather than the supplier’s. Nothing about a provider change requires it to happen on a Tuesday morning.
The national picture
Almost all of a managed service is delivered remotely, which is why a provider does not have to be down the road to run your environment well. What being nearby changes is the day somebody has to be physically present. LANTEK covers South Africa from two offices, Ballito in KwaZulu-Natal and Sandton in Gauteng, and attends site from whichever is closer.
If you want to know where you actually stand before changing anything, the free IT audit and health check is the least committal way to find out. Somebody goes through the environment on site, you get a written report and an action plan, and a free dark web exposure scan against your domain comes with it. You keep the findings either way.