Ask five providers in New York what managed IT costs and you get five versions of “it depends,” each followed by an invitation to a discovery call. It does depend, and the dependencies are knowable before anyone books a meeting, because the ranges are published. The part of a proposal that decides what you spend over the term is the out-of-scope schedule, which the headline rate leaves out. The Managed IT page describes what a complete scope contains.
The published bands, and how far to trust them
Three public pricing guides are worth reading: Datapath, Corsica Technologies and ITBudgetCalculator, each current when checked. The table carries their own bands, and the third column matters more than the second. None of the figures below is Stedholm’s price; they are what those three guides publish.
| Guide | Published band, per user per month | How the guide frames it |
|---|---|---|
| Datapath | $100 to $400 | Support scope, security depth, after-hours coverage and compliance obligations move the number |
| Corsica Technologies | $100 to $400 | $100 to $200 for a basic scope; $200 to $400 once security and compliance are inside it |
| ITBudgetCalculator | $75 to $250 | Per-user rates fall as headcount grows; scope and region shift the band |
Two further findings from the same guides matter before you compare anything. They disagree on how common per-user billing is: ITBudgetCalculator calls per-user-per-month the dominant model for any retainer-style relationship, while Corsica cites a figure of 22 percent of providers using it, so ask which model a quote uses before you compare rates. Both of those two put the cost of work outside the base agreement at 30 to 50 percent on top of the headline rate; Datapath lists the same categories of excluded work without attaching a percentage to them. A number that size is larger than the spread between most of the quotes you are weighing, which tells you where to spend your attention.
What a per-user rate is made of
A per-user price is a stack of recurring third-party costs, the engineering time to operate them, and overhead. Ask any provider which of these line items are passed through and which are marked up; the answer is informative even when the total does not move.
| Line item | What it buys | How to read it in a quote |
|---|---|---|
| Productivity licensing | Microsoft 365 or Google Workspace seats | Confirm the exact edition and plan name. The security features most buyers assume they have live only in the higher tiers. |
| Software on every laptop and server | Watching for attacker behavior, applying updates, reporting faults, and keeping a list of what you own | Ask which product does the watching, and whether a person reads its alerts or it is merely installed. |
| Email and identity controls | Mail filtering, a second step at login beyond the password, rules about which devices may sign in, and tight control of administrator accounts | Often the whole difference between a low-band and a mid-band quote. |
| Backup and recovery | Copies of every laptop, server and Microsoft 365 account, kept for a stated length of time | Ask whether restore testing on a schedule is included or billed as a project. |
| Ticketing and documentation tooling | The system that tracks your requests, the place your systems are written down, and safe keeping of your passwords | Overhead, and part of the reason the floor sits where it does. |
| Engineering labor | Help desk, escalation, project work, account management | The variable that differs most between providers. |
The arithmetic follows from the stack. A provider quoting well below the small-business band is running a thinner tool set, carrying more users per engineer, or expecting to recover the difference through project and incident billing. None of those is dishonest on its face. Each changes what you receive, and you are entitled to know which one you are buying.
What moves the number
- A firm with compliance obligations, one that certifies under NYDFS Part 500 (the regulator’s own resource center), operates under the HIPAA Security Rule, or falls under the FTC Safeguards Rule, is paying its provider to produce evidence as well as close tickets. Risk assessments, records showing the second login step is actually enforced, monitoring reports and incident documentation are billable hours in somebody’s month.
- Antivirus and patching sit at the bottom of every band, and security depth is what lifts a quote out of it: detection and response, and watching for signs that someone’s login has been stolen, move it upward.
- Whether the scope is fully managed or co-managed matters too: buying escalation depth, and someone to read the security alerts, around an internal team usually prices below a full-service scope. The saving holds only if the duty split is written down; otherwise both sides assume the other owns patching.
- On-premises servers and multi-site networks generate device line items that a headcount does not capture.
- A standing on-site commitment in New York City means travel time in a vertical city. Remote-first support with scheduled visits prices differently from that commitment.
The out-of-scope schedule decides the term
The headline per-user rate is the most comparable and least informative number in a proposal. What separates two providers quoting the same rate is what happens when work falls outside the base agreement.
| Common out-of-scope item | How it usually bills | Get this in writing |
|---|---|---|
| Projects: migrations, office moves, server replacement | Hourly, above the retainer | The rate, and the threshold at which routine work becomes a project |
| After-hours work | A multiplier on the standard rate | The multiplier, and the point in the day at which it begins |
| New-hire setup and departures | A per-event fee | Whether the fee covers identity, device, licensing and data handling |
| Security incident response | A billable emergency at premium rates | Whether triage, containment and the written report are covered work |
| Hardware and license procurement | Cost plus markup | The markup, stated as a percentage |
| Coordinating your other vendors | Consulting time | A named allowance, or explicit inclusion |
| Offboarding and documentation handover | Charged at exit | A fixed figure agreed at signature, while you still have leverage |
None of these is illegitimate; a migration is separate work. The defect is discovering the schedule after signature. Ask for it as an appendix, and read it before you read the rate.
Four pricing models
- Per user per month is the model the published guides describe at most length, though, as above, they disagree about how widely it is used. It is predictable and scales with headcount, and it is comparable only once you have matched the scopes behind the two rates.
- Per device is common where infrastructure outweighs headcount, or layered onto per-user pricing for data center equipment. Check how a person carrying a laptop and a phone is counted.
- Tiered pricing puts bronze, silver and gold on the page, and the names are marketing. The gap between tiers is usually security and reporting depth; ask for the written list of what each tier includes, then confirm which tier the quoted price refers to.
- An all-in fixed fee is one number covering support and security with a defined project allowance. It is the easiest of the four to budget, provided the definition of “all” is written down.
No model is inherently more honest than another. The honest version of each is the one where the inclusion list, the out-of-scope schedule and the incident terms sit inside the agreement.
Comparing two quotes on equal terms
- Compare scope first and rate second. For each proposal, write down what is covered for detection and response, backup restore testing and compliance reporting, then compare the per-user figures.
- Price the worst day. Ask what a ransomware incident costs under each agreement; the figure may not appear in the proposal at all.
- Ask how many users each engineer supports. The ratio predicts what happens in a bad week better than any figure in the service-level table.
- Price the exit. Documentation and credentials should be yours throughout, and an exit schedule tells you how a provider expects the relationship to end.
- Work through the twelve questions to put to any New York MSP. Several exist to surface pricing behavior before it surfaces on an invoice.
Where compliance changes the arithmetic
Regulated firms are buying documentation as much as tooling. Under NYDFS Part 500, a certification of material compliance must be signed by the firm’s highest-ranking executive and its chief information security officer, or, absent such an officer, the senior person responsible for the cybersecurity program. A smaller firm holding a limited exemption under Section 500.19(a) still has to meet the multi-factor authentication requirement in Section 500.12, so the second login step is not something the exemption buys you out of. The FTC Safeguards Rule, by the regulator’s own count, identifies nine elements an information security program must include, set out in 16 CFR 314.4. The HIPAA Security Rule requires “an accurate and thorough assessment of the potential risks and vulnerabilities” to electronic health information. Someone has to write, maintain and defend those artifacts, which is why regulated scopes sit in the upper bands. If a quote for a licensed New York firm lands on the small-business band, ask which artifact is missing.
Getting a number for your own firm
The precise figure for any firm is a function of its environment, which is why no published band settles it. What turns a band into a figure is a documented baseline of the environment: an inventory, the gaps, and a priced plan in writing, which is what a scoped IT and security assessment produces. For what the rate is buying in each category, the comparison of MSP, MSSP and MDR is the companion piece.