Two needs that can complement each other
Need an assessment before deciding on work? An audit may help. Know what must be operated and need recurring support? A managed services contract may fit. A small business can need both on distinct scopes.
ANSSI's outsourcing guide describes entrusting all or part of an information-system activity to a third party. The contract and actual responsibilities determine what you buy.
What you receive
| IT audit | Managed services | |
|---|---|---|
| Objective | Understand a scope at a point in time and identify priorities. | Organise ongoing responsibility for defined activities. |
| Expected work | Inventory, analysis, findings and presentation as agreed. | Checks, maintenance, assistance or operations under the contract. |
| Deliverables | Inventory, risks, mapping or an action plan depending on the level. | Agreed intervention records, checks and reports. |
| Duration | A bounded mission with an agreed schedule. | A recurring relationship with a term and exit arrangements. |
| Corrections | Explicitly included or priced after analysis. | Check what is included and what needs a separate project. |
| Responsibilities | Access, presentation method and recipients. | Access, decisions, interventions, incidents and handover. |
The label does not define a service level. A contract may cover workstations, a server or part of operations. Backups, projects and urgent assistance must be identified explicitly.
Start with an audit when the environment is unclear
You do not know which equipment is still used. Administrator accounts depend on several people. Documentation does not explain application dependencies. Or a migration requires understanding them before choosing a solution.
A bounded audit brings findings into the open. Its presentation should distinguish verified facts, missing information and proposed actions clearly enough to discuss with management and the current provider. The result may justify work, documentation or recurring operations. Not every finding calls for new hardware.
Start with operations when the need is defined
You know the estate, access and applications. The main gap is ongoing ownership: checks have no owner, interventions accumulate or your internal team needs help on a specific scope.
Request suitable operations support. The provider will need information and access and may include an entry assessment. Ask what is examined, what is delivered and whether that work is included in setup fees.
A recurring contract does not remove the need for current documentation or a client-side owner. ANSSI's guide stresses risk assessment and setting requirements with the provider.
Compare budgets on the same scope
An audit fee and a monthly managed services fee do not buy the same work. Compare the same estate, responsibilities and period. First-year recurring costs may include setup, twelve monthly fees, out-of-scope projects and separate licences or tools. A standalone audit does not imply corrections are included.
| Budget question | What to specify |
|---|---|
| Scope | Sites, workstations, servers, accounts and applications. |
| Included workload | Checks, hours, discussions, travel and limits. |
| Separate charges | Licences, storage, backups, equipment and projects. |
| Commitment | Term, renewal, overage and exit. |
| Service level | Hours, initial response, incident handling and actual deadlines. |
An initial response is not a completed repair. A backup check is not a guarantee of full business restoration. Useful scenarios and commitments must appear in the proposal.
Where architecture guidance fits
Technical guidance maintains documentation, reviews changes and follows priorities with your team. It concerns decisions and coordination; user assistance and incidents are not automatically included.
Initial Infra's architect package is €600 excluding VAT per month for eight hours, on the standard scope stated in the offer. Terms include twelve months, business hours and a distinction between advice, audit, implementation and incidents. It can complement existing operations when responsibilities are clear.
Initial Infra starting points
The €990 excluding VAT light IT audit covers one site, up to twenty workstations and three servers, with inventory, priority risks and findings presentation. The €1,990 excluding VAT full audit covers up to two sites, fifty workstations and five servers, with mapping, configuration review and a prioritised action plan.
Corrections are separate. The schedule follows qualification and confirmed access. These audits exclude penetration testing, SOC and NIS2 preparation. A specific technical request can be qualified directly without making a full audit mandatory.
Decide on the next conversation
Gather what you know: estate, key applications, current responsibilities and the problem to solve. Ask for deliverables and commitments that answer that need.
Initial Infra discovery and the initial quotation are free. Audit and implementation start after agreement on scope and price. Request a free discovery call.
Sources
- ANSSI, outsourcing and information-system security, 2010 guide consulted 18 October 2026 for outsourcing and responsibility principles.
- Initial Infra offer and package scopes.
View sources (1)
Support available on this topic
Initial Infra handles these topics for SMBs and mid-size companies. A short call is enough to identify priorities and the right scope of intervention.