1. How responsibility is shared

Modern IT services run across multiple layers. Even with managed services, no single party controls everything end-to-end. Responsibility is generally shared across:

• Call IT Mate: the services we’ve agreed to deliver and can access/control.
• You (Customer): your users, decisions, approvals, and anything outside the agreed scope.
• Third-party vendors: platforms and infrastructure we don’t own or directly control.

2. What Call IT Mate is responsible for

Where included in your plan or agreed in writing, we are responsible for:

• Support within scope: troubleshooting and assistance for covered users, devices, and services.
• Configuration and best practice: implementing practical settings and improvements aligned to agreed outcomes.
• Monitoring and alerts: monitoring systems covered by our tools and your active agreement (where included).
• Security administration: implementing and maintaining agreed security controls and recommendations (where included).
• Backups and restores: configuring agreed backup jobs and assisting with restores (within plan inclusions).
• Incident response support: containment steps we can perform and guidance during cyber or service events.
• Vendor liaison support: raising cases or escalating to vendors when relevant and when escalation paths exist.

Access requirement: We can only support and remediate systems we can access. If access is removed, restricted, or blocked, work may be delayed until access is restored.

3. What you (the customer) are responsible for

To achieve the best reliability and security outcome, you are responsible for:

• Approvals and decisions: timely approvals for changes, security rollouts, licensing, and remediation steps.
• User behaviour: staff following safe practices (especially around email links, attachments, and credential handling).
• Account hygiene: strong passwords/passphrases, MFA usage, and up-to-date recovery details.
• Access and administration: providing and maintaining required access (including vendor portals when needed).
• Out-of-scope items: personal/BYOD devices, third-party apps, or services not covered by your plan.
• Compliance needs: advising us of any retention, legal, or industry requirements you must meet.
• Physical security: securing premises, network equipment, and preventing unauthorised physical access.

4. Third-party vendors, platforms, and outages

Many services depend on third parties (for example: Microsoft 365, registrars, hosting networks, internet providers, and software vendors). While we can assist with investigation and escalation, these items are outside our direct control:

• Vendor outages and maintenance windows (including internet and cloud platform disruptions).
• Vendor restoration timelines and the order in which vendors resolve incidents.
• Product changes introduced by vendors that alter features, behaviour, or limitations.
• Vendor-side security incidents and their remediation timelines.

5. Endpoint Security (EDR) responsibilities

Endpoint Detection and Response (EDR) significantly improves protection and visibility, but it is not a guarantee of prevention. EDR effectiveness depends on correct deployment, device health, user behaviour, and timely response actions.

• Call IT Mate: deploy and manage EDR on covered devices (where included), maintain agent health where possible, review alerts (where included), and support containment steps we can perform.
• You: keep devices powered and connected regularly, avoid disabling or bypassing protection, approve required remediation steps, and report suspicious activity quickly.
• Third-party vendor: EDR platform availability, detection logic/updates, and product functionality.

Note: Devices that are unmanaged, offline for long periods, or unsupported/end-of-life may not be fully protected.

6. Managed Cyber Security (24/7) responsibilities

Managed cyber security services help detect and respond to threats faster, but they rely on the data available, access permissions, and an agreed response process. Some actions may require customer approval or may be limited by access, licensing, or vendor platforms.

• Call IT Mate: support the agreed monitoring and response process, coordinate incident handling, and apply response actions within scope and access (including escalation and guidance).
• You: maintain up-to-date contact details, ensure we have required access, respond to escalations when approval is needed, and accept that emergency containment actions (e.g., isolation) may temporarily disrupt work to reduce risk.
• Third-party vendor: monitoring platform availability, log ingestion reliability, integrations/connectors, and alert fidelity.

Note: If required logs, connectors, or agents are not present (or are blocked), visibility and response capability may be limited.

7. Common scenarios and shared ownership

Email compromise / phishing

• You: prompt reporting, user awareness, and following MFA and password requirements.
• Call IT Mate: support investigation, containment steps within access, and remediation guidance (within scope).
• Vendor: cloud platform availability and the features made available under your licensing.

Microsoft 365 settings, security, and policies

• You: approving changes, licensing where needed, and accepting usability impacts (e.g., MFA prompts).
• Call IT Mate: recommending, configuring, and tuning agreed settings within scope.
• Vendor: service uptime, feature availability, and platform behaviour.

Backups and restores

• You: confirming what must be protected, retention expectations, and restore priorities.
• Call IT Mate: configure agreed backups and assist with restores based on your plan inclusions.
• Vendor: backup platform availability and infrastructure.

Website hosting and domains

• You: content decisions, plugin/theme choices, and timely approvals for upgrades or changes.
• Call IT Mate: support within scope and coordination where applicable.
• Vendor: hosting uptime, registrar systems, upstream connectivity, and maintenance windows.

Internet and Wi-Fi issues

• You: choosing your ISP plan and ensuring your environment/cabling is fit for purpose.
• Call IT Mate: troubleshooting local network issues within scope, and liaising with the ISP where authorised.
• Vendor: ISP/NBN faults, upstream congestion, and carrier outages.

8. What this model does not guarantee

This model clarifies roles. It does not guarantee that incidents, outages, data loss, or cyber events will never occur. Security and uptime depend on multiple factors, including user behaviour, vendor platforms, and the speed of approvals and remediation.

• No provider can guarantee 100% prevention of malware, fraud, ransomware, or account compromise.
• Vendor outages and upstream failures can still impact service availability.
• Restore outcomes depend on what was backed up, retention settings, and the condition of data at the time of backup.

9. Recommended customer checklist

If you want the strongest outcome, we recommend the following minimum standard:

• MFA enabled for all users (especially admin accounts) and no shared logins.
• Use of a password manager and unique passwords everywhere.
• Timely approvals for security changes and remediation steps.
• Clear backup/retention priorities for critical business data.
• Basic phishing awareness and a “report, don’t click” culture.
• Replacement of end-of-life devices and keeping systems up to date.

10. Questions

If you’d like us to confirm what’s covered under your current plan, or you want a practical checklist for your environment, please contact us via our website contact page.

Last updated: 30 December 2025