IT maintenance for SMEs: what it includes, how it is priced and what to ask for before hiring

Published on November 3, 2026 · The mitza.es team

In many small businesses, IT works until it stops working: a computer that won't start, a printer that vanishes from the network, an email that locks up just before you send a quote. IT maintenance exists so that these things happen less often, get fixed sooner and don't bring the company to a standstill. But the term covers very different services, and comparing quotes without knowing what each one includes leads to a poor choice. This guide gives you the criteria.

What IT maintenance is

It is the set of tasks that keep a company's equipment, network and IT services in good condition and secure: computers, servers, printers, wifi, email, software, backups and people's access. It normally combines three types of work:

• Corrective maintenance: fixing what fails when it fails.
• Preventive maintenance: periodic tasks so that it doesn't fail (updates, disk checks, cleaning, backup tests).
• Proactive or managed maintenance: continuous monitoring with monitoring tools that detect problems before the user notices them.

What a good service usually includes

• Inventory of equipment, software and licences, always up to date.
• Updates and patches for systems and applications, with a defined deadline for critical flaws.
• Protection against threats: antivirus or EDR, email filtering and device control.
• Backups with periodic restore tests (we explain it in the 3-2-1 rule).
• User and access management: onboarding, offboarding, permissions and two-step verification.
• Network, wifi and firewall: configuration and review (see what a firewall is).
• Email and cloud services: setup and support for the suite you use.
• User support by phone, by email or with remote assistance, and visits when needed.
• Regular reports on what has been done, what is pending and the risks detected.
• Documentation: network diagram, safeguarded credentials and procedures.

Contract models: from emergency to peace of mind

• On demand (per incident): you pay for each intervention. It is flexible and suitable if you have few computers and few risks; the drawback is that nobody watches anything until something fails.
• Block of hours (hour bank): you buy a package of hours that you spend on incidents and improvements. It makes costs predictable, but you should know how long each task takes and what happens to the hours you don't use.
• Monthly fee per computer or user: the provider commits to a set of services (monitoring, patches, support) for a fixed amount. It is the most convenient model for the budget and the one that best covers preventive work, but you have to look closely at what is left out.
• Managed service (MSP): the provider acts as your IT department: it monitors, manages security and responds to incidents within agreed times. It is usually the most complete option and the most expensive.

How it is priced and what the price depends on

We don't give figures because they depend on too many variables and vary a lot between providers. What is worth knowing is what the price of maintenance depends on, so you can compare with sound judgement:

• Number of users and computers (and servers, if you have any).
• Scope: support only, or also security, backups, monitoring and cloud management.
• Response time and hours (office hours, extended hours, emergencies).
• Remote or on-site support and whether travel is included or not.
• Complexity of the environment: several sites, specialised software, regulatory compliance.
• Hardware and licences: almost always invoiced separately.

Be wary of “unlimited flat rates” without small print: they almost always leave out projects, out-of-hours emergencies or certain types of incident. Always ask in writing what is included, what isn't and how what isn't included is charged.

Remote or on-site support

A large share of incidents (software, email, printers, configuration) are solved remotely in minutes and without travel. On-site support is essential for hardware, cabling, equipment installation and situations where the computer won't start. A good provider combines both and explains when each is appropriate.

Response times and resolution times: not the same thing

Many contracts promise a “response time” (when someone starts handling your incident) but not a resolution time. Ask about both, about how incidents are prioritised (a server that is down isn't a printer out of toner) and about what happens if the times aren't met. Ask for it in a simple, measurable service level agreement (SLA).

Security is not an extra

Today IT maintenance without security is only half the job. Attacks on equipment exposed to the internet, such as VPNs and firewalls, are increasingly frequent: we have seen it with the Ivanti Connect Secure zero-day and with the picture of ransomware in Spanish companies. Ask specifically about patching, tested backups, email protection, two-step verification and what is done in the event of an incident. If regulation affects you, you will find the context in our guide to NIS2 for SMEs.

Outsource or have an in-house IT person?

There is no magic number. As a general guideline: a dedicated person only makes sense when there is enough daily workload and project volume; in small companies, an in-house specialist is a single point of failure (if they leave or fall ill, nobody knows how everything is set up). The usual approach in small businesses is to outsource maintenance and security and have someone in the company act as the point of contact. The two can also be combined: an internal person in charge for the day-to-day and a provider for specialist work and for on-call cover.

What to ask before hiring: checklist

1. What exactly does the service include and what is left out?
2. What response and resolution times are committed to, and during what hours?
3. Who safeguards the passwords and the administrator access? (the company must always be able to recover them).
4. How is the network documented and who holds the documentation?
5. What backups are made, where are they stored and how often is restoring them tested?
6. How are patches and security alerts managed?
7. Is a data processor agreement for personal data signed?
8. Is any service subcontracted? To whom?
9. How is what has been done reported (reports) and how often?
10. What happens when the contract ends? Will you be able to take the documentation and the access with you without problems?

What you must always control, even if you outsource

• Your own administrator account for critical services (email, domain, cloud), even if you don't use it daily.
• An inventory of equipment and licences that you can consult.
• A corporate password manager, so that credentials don't depend on one person. You can generate them with our password generator.
• Knowing where your data is and who has access to it.

Common mistakes when hiring maintenance

• Choosing only on the monthly price, without looking at what is included.
• Not asking for backup restore tests.
• Letting only the provider hold the administration credentials.
• Not making clear what is urgent and what can wait.
• Confusing maintenance with projects: changing servers or migrating to the cloud is usually quoted separately.
• Not reviewing the contract as the company grows.

How it relates to your cloud strategy

Maintenance changes if part of your services live in the cloud: there are fewer servers to look after, but more accounts, permissions and backups to control. If you are considering that step, read our guide to cloud computing for SMEs and the one on what a NAS is if you still keep files in the office.

How we can help at Mitza

We offer technical support and IT maintenance for small businesses and freelancers. If you're in southern Madrid, see our IT maintenance service and the one for computer repair; and if you want to tell us about your case, write to us from the contact page.