The word “maintain” in server offers means very different things. For one provider it means that the physical server is switched on and the network works. For another it means that backups are checked every night, security updates are installed every month and, when a service degrades, an engineer responds within half an hour without waiting for your call. Both offers are called a “managed server”, and the prices may differ only slightly.
The difference shows only when something happens: files get encrypted, an update breaks, a full disk stops your accounting. Then it turns out that “maintenance” was just a running server, and everything else was your responsibility, which nobody told you about.
In this article we break down what real server maintenance consists of, how to define it in a contract and which questions to ask so that there are no surprises later.
Resource rental and a managed server are two different products
Resource rental (often called an “unmanaged” or “self-managed” server) means you receive a virtual machine with an installed operating system and administrator access. The provider is responsible for the physical hardware, power, network and the virtualisation platform. Everything that happens inside the operating system, such as updates, protection, backups and application configuration, is your job.
That is the right model when you have your own server administrator who has time for it. For most small and mid-sized companies, where one person looks after IT or nobody does, it means that after the first month the server is left without updates and without verified backups.
A managed server is the same resource, but with a team that is responsible for the operating system and the basic services running properly. You use the applications, and the provider makes sure the platform underneath is updated, protected, monitored and recoverable.
What real maintenance consists of
When you request a quote, insist that each of the following items is clearly labelled as included, not included or available for an extra fee.
Updates
Security updates for the operating system and base software must be installed regularly, at an agreed time, with the ability to roll back. Questions: how often, whether it is done outside working hours, what happens if an update breaks the system, and whether a snapshot is taken before installation.
Monitoring
Monitoring means the provider learns about a problem before you do. Not only server availability must be monitored, but also disk space, CPU and memory usage, service status, certificate expiry and backup success. An important question: who receives the alert at night and what do they do with it.
Backups
A backup that nobody has tried to restore is not a backup. Insist on a defined frequency, retention period, location (is the copy in a different physical site), whether it is protected from deletion from an infected server, and how often restores are tested. In our practice backups are stored in our data centre in Lithuania (EU) and, if needed, also in an Amazon data centre in Germany, so that a disaster at one site does not mean data loss. We write separately about server backup options.
Malware protection
A server without modern protection is an open door. The standard protection of an operating system is not enough against ransomware attacks. Our managed servers have Bitdefender GravityZone installed, centrally managed from our console: it blocks malicious processes, watches for signs of file encryption and alerts our team, rather than only writing to a log. Ask the provider what protection is installed, who manages it and whether anyone reads the alerts.
Access and password management
Who has administrator access to the server, how it is granted and revoked, whether two-factor authentication is used and whether logins are recorded. These are the questions auditors also ask under ISO 27001 or DORA requirements.
SLA: what it really promises and what it does not
The service level agreement (SLA) is where “we maintain it” turns into numbers. The most common sources of confusion:
- The availability percentage is often applied only to the physical platform, not to your server or application. A platform availability of 99.9 percent says nothing about how long your accounting will be down after a disaster.
- Response time is not resolution time. A response within 30 minutes means an engineer has started working, not that the problem is solved. Both metrics must be in the contract, and they should differ by incident priority.
- Support hours. Does the SLA apply on weekends? If your accounting is needed only on weekdays, business-hours support may be enough, but that must be a conscious choice.
- Recovery objectives (RTO and RPO). How quickly the server will be restored from a backup and how much data may be lost. If these two numbers are not in the contract, the backup promise is only a promise.
We publish our service level description so that you can compare these numbers before a conversation.
A responsibility matrix: one page that settles disputes
The best tool you can demand from a provider is a responsibility matrix: a table in which each activity is assigned to one side. An example of how it looks for a managed server:
| Activity | Provider | Customer |
|---|---|---|
| Physical hardware, power, network, virtualisation | Responsible | – |
| Operating system updates | Responsible | Agrees the timing |
| Monitoring and responding to alerts | Responsible | – |
| Backups and restore tests | Responsible | Specifies what to protect |
| Malware protection | Responsible | – |
| Business application (accounting, CRM) updates | By agreement | Often responsible |
| User accounts in the application | – | Responsible |
| Data content and its legality | – | Responsible |
Once such a matrix is signed, the question “who was supposed to do this” disappears. If a provider cannot or will not produce one, that is already an answer about how incidents will be handled.
Questions to ask the provider
Before signing a contract, we recommend asking these questions and writing down the answers:
- What exactly is included in “maintenance”? Ask for a list.
- How often are updates installed and what happens if they break the system?
- Where are backups physically stored, are they unreachable from the server itself, and when was a restore last tested?
- What malware protection is installed and who reads its alerts?
- What are the response and resolution times by priority, and do they apply outside business hours?
- What are the RTO and RPO commitments?
- Who has administrator access to my server and how is it logged?
- Do you work in line with ISO 27001 requirements and can you provide documents for an audit?
- How does exit work: can I take a server image and my data, and how quickly?
A provider that answers all nine without evasion probably does maintain servers. A provider that says “don’t worry, we’ll take care of everything” but produces no document probably does not.
Where to start
- List the systems that run on the server and how many hours of downtime each can tolerate. These are your SLA requirements.
- Ask your current provider for a responsibility matrix. If there is none, draw one up yourself and propose that it be signed.
- Check when a file was last restored from a backup. If nobody remembers, that is the first job.
- Compare offers by what is included, not by the monthly price.
- If you want to see how this looks in practice, read the description of our managed CLOUD servers: updates, monitoring, backups and Bitdefender GravityZone protection are included, and if you prefer to keep a server in your own office, we offer server management under the same matrix.
