Managed IT & Buying Guidance
Updated
A managed IT report should help someone decide what to fix, fund, accept, or investigate. Ticket totals and green status icons may be inputs, but they are not management information until the report states scope, trend, exceptions, evidence quality, and ownership.
Start with decisions, then select measures
NIST SP 800-55 Volume 1 recommends selecting and prioritizing information-security measures based on their value and evaluating the quality and uncertainty of underlying data. Apply that discipline to the whole managed-service report. Begin with leadership questions, not whatever charts a tool exports.
| Leadership question | Useful evidence | Decision supported |
|---|---|---|
| Where is support friction increasing? | Demand by impact and cause, recurrence, aged work, reopen patterns, and affected groups. | Remove a root cause, change training, or adjust ownership. |
| Can critical operations recover? | Covered backup scope, job exceptions, restore evidence, dependencies, and recovery-plan status. | Test, remediate, fund, or accept a gap. |
| Which security issues matter now? | Material findings, affected assets, coverage, aging, business impact, and owner. | Contain, remediate, transfer, or accept risk. |
| What will become tomorrow's outage? | Unsupported assets, expiring services, capacity, vendor changes, and lifecycle dependencies. | Place work and funding on the roadmap. |
| Is the service model still a fit? | Scope exceptions, out-of-scope demand, handoffs, service trends, and business change. | Clarify responsibility or adjust scope. |
Every metric needs a definition card
A number without a denominator, data source, and boundary invites the wrong conclusion. For each recurring measure, require:
- Question: what management question does it answer?
- Scope: which covered users, systems, sites, and period are included?
- Method: how is it calculated and which named system supplies the data?
- Cadence: when is it collected, reviewed, and retired?
- Owner: who investigates exceptions and makes the resulting decision?
- Limitations: what is missing, stale, manual, estimated, or uncertain?
NIST SP 800-55 Volume 2 treats measurement as a managed program with roles, communication, data management, and continuous improvement. A provider should explain why a measure exists and how it changes with the environment.
Build the monthly package in layers
| Layer | Contents | What to exclude |
|---|---|---|
| Executive page | Material change, top risks, decisions due, owner list, and prior commitments. | Unfiltered alerts and tool screenshots. |
| Service operations | Demand trend, high-impact issues, recurrence, aging, escalations, and blockers. | Ticket volume presented as quality by itself. |
| Reliability and recovery | Coverage exceptions, monitoring gaps, restore evidence, critical changes, and continuity work. | A single backup-success icon with no scope. |
| Security and control health | Material findings, control drift, telemetry gaps, aging, owners, and accepted risk. | Raw vulnerability totals without prioritization. |
| Roadmap and commercial | Completed improvements, lifecycle events, dependencies, scope questions, and budget decisions. | A shopping list disconnected from business risk. |
Report backup confidence honestly
CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster-recovery scenario. That does not mean every monthly report should claim a full recovery test occurred. Distinguish job status, coverage, restoration evidence, and broader recovery-plan evidence.
State which covered workload had an exception, what was verified, the date and scope of relevant restore evidence, what remains untested, and who owns the next action. The backup versus disaster recovery guide provides the right vocabulary.
Use the quarterly review for decisions, not narration
The monthly report monitors operating state. The quarterly review interprets the trend and leaves with decisions. Send evidence before the meeting, then:
- Confirm prior commitments: completed, blocked, changed, or overdue.
- Review material service, reliability, recovery, and security trends.
- Resolve open risk acceptances and responsibility gaps.
- Choose roadmap priorities and identify dependencies.
- Assign an owner and due date to each decision or follow-up.
If the same handoff fails repeatedly, change the operating model. Use the service escalation playbook to review those boundaries.
Artifacts to request before selecting a provider
- A sanitized monthly report with denominators, exceptions, and owner fields.
- A sample quarterly agenda and resulting action register.
- The definition for one support, security, and backup measure.
- An example showing how incomplete data or an uncovered system is disclosed.
- A lifecycle view connecting aging assets to a funded plan.
- A link between serious incidents, corrective work, and future reporting.
For decision-focused security measures, see the security KPI reporting playbook. For asset decisions, use the technology refresh cadence guide.
Red flags in a reporting package
- Percentages appear without a denominator or scope definition.
- Every status is green while unresolved risks stay off the page.
- Backup confidence is inferred only from job completion.
- Security findings use only a tool score, without business context.
- There are no data-quality caveats, owners, or decision dates.
- The quarterly meeting repeats the report but creates no action register.
Sources and further reading
- NIST SP 800-55 Volume 1 - selecting, prioritizing, documenting, and evaluating information-security measures.
- NIST SP 800-55 Volume 2 - measurement governance, roles, communication, and data management.
- CISA #StopRansomware Guide - backup protection, testing, response, and recovery guidance.
- NIST Cybersecurity Framework 2.0 Resource Center - risk-governance lifecycle outcomes.