Managed IT services: what does an IT maintenance (MCO) contract really include?

Monitoring, maintenance, support, cybersecurity, backup… Maintaining operational readiness is not just about stepping in when a failure occurs.

Discover what an MCO contract really covers and the key points to consider in order to tailor it to your organisation’s needs.

What is IT MCO?

Maintaining Operational Readiness (MCO, from the French Maintien en Condition Opérationnelle) covers all the actions that keep an IT system available, secure and suited to the organisation’s needs.

Unlike a purely corrective approach, which consists of stepping in when a failure occurs, MCO also relies on a preventive and proactive approach.

The goal is therefore not only to resolve incidents: it is also to anticipate them as much as possible and to ensure the continuity of the information system over time.

Depending on the environment, an MCO contract can cover workstations, servers, network equipment, security solutions, backups, Microsoft 365 environments or certain Cloud infrastructures.

Key takeaway

MCO is not simply about “fixing IT”. It aims to keep the information system operational, secure and under control over the long term.

Monitoring to detect incidents early

IT monitoring is one of the pillars of MCO.

It makes it possible to watch various components of the information system in order to detect anomalies before they lead to a significant service interruption.

Depending on the infrastructure, this monitoring may cover in particular:

• the status of servers and equipment;
• available disk space;
• essential services;
• network equipment;
• the status of backups;
• various availability and operating indicators.

The goal is simple: not to wait for a user to notice that a service is no longer working before starting to act.

Preventing rather than merely repairing

An IT environment is constantly evolving.

Operating systems, software and equipment require updates, while new vulnerabilities may appear.

MCO therefore includes various preventive maintenance operations: tracking updates, checking the condition of equipment, verifying backups, monitoring available capacity or identifying situations likely to cause a failure.

This approach helps improve the stability of the information system and limit the risk of incidents.

Providing support and incident management

Even with a properly monitored and maintained infrastructure, no IT system is entirely immune to incidents.

The MCO contract therefore makes it possible to define precisely the provider’s terms of intervention: scope covered, support hours, handling procedures and expected service levels.

Depending on needs, interventions can be carried out remotely or on site and concern workstations, servers, the network or the various IT services covered by the contract.

Integrating cybersecurity into MCO

Keeping a system available without ensuring an appropriate level of security would expose the organisation to many risks.

MCO is therefore closely linked to cybersecurity today.

Depending on the chosen scope, various protection components can be integrated into or associated with the setup:

• workstation protection;
• EDR and security solutions;
• firewalls;
• access security;
• multi-factor authentication (MFA);
• security updates;
• equipment monitoring;
• backup policies.

The level of protection must however be defined according to each organisation’s activity, architecture, uses and specific risks.

Monitoring backups and preparing for restoration

Making a backup is not enough: you also need to make sure it works and that the data can be restored when needed.

An MCO contract may thus include monitoring backup execution, checking for errors, tracking storage capacity and assisting with restoration.

For environments with significant availability requirements, this approach can be complemented by a Disaster Recovery Plan (DRP) or a Business Continuity Plan (BCP).

Evolving the information system

The role of an MCO provider should not be limited to keeping an infrastructure unchanged indefinitely.

The IT estate evolves, uses change and some equipment or systems gradually become obsolete.

Ongoing follow-up therefore also makes it possible to identify renewal needs, risks linked to obsolescence or the changes required to support the organisation’s activity.

This dimension is particularly important for an organisation without in-house IT skills. But MCO can also complement an existing IT department or IT team, by providing additional resources or expertise.

MCO, maintenance and managed services: what are the differences?

These three terms are similar, but do not necessarily cover the same scope.

IT maintenance concerns the operations required for equipment and systems to work properly.

MCO takes a more global approach, with the aim of keeping the IT environment operational over time.

Managed IT services (infogérance), for their part, refer to outsourcing all or part of the management of the information system to a provider. They can therefore encompass MCO, user support, IT asset management, cybersecurity and other services.

In all cases, the actual scope must be clearly defined in the contract.

How to choose the right MCO contract?

There is no one-size-fits-all MCO contract.

A company with a handful of employees, a manufacturer with several sites, a local authority or an organisation with its own IT team will not have the same infrastructures, the same constraints or the same levels of criticality.

Before setting up a contract, several elements must therefore be examined: the IT estate, critical equipment, user needs, solutions already in place, security requirements and expected service levels.

The goal is to determine what really needs to be maintained, monitored and secured, rather than piling up services that do not meet the organisation’s needs.

Need to take stock of your IT environment?

Emerging-IT’s teams support companies, local authorities and organisations in maintaining, monitoring, securing and evolving their information system.

Whether or not you have an in-house IT team, we work with you to define a scope of support suited to your environment and your challenges.

→ Talk to our team

Frequently asked questions about IT MCO

What is an IT MCO contract?

An MCO contract defines the services implemented to keep an IT environment operational over time. Its scope may include monitoring, maintenance, support, security and backup follow-up.

What is the difference between MCO and managed services?

MCO mainly aims to keep the IT system in operational condition. Managed services refer more broadly to outsourcing all or part of IT management to a provider.

Is MCO only for small businesses?

No. The scope of an MCO contract can be adapted to organisations of very different sizes and sectors. It can also complement an IT department or an in-house IT team.

Does an MCO contract include cybersecurity?

It depends on the contractual scope. Cybersecurity is nevertheless closely linked to maintaining operational readiness and may include workstation protection, access security, firewalls, EDR, security updates or the monitoring of certain infrastructures.

Philippe

Sources and further resources

• ANSSI – 10 golden rules for digital security (in French): in particular for regular updates, access security and multi-factor authentication. Read the ANSSI recommendations
• ANSSI – Backup of information systems (in French): a guide dedicated to backup best practices, particularly relevant to the “monitoring backups and preparing for restoration” section. Read the ANSSI guide on backups
• NIST – Contingency Planning Guide for Federal Information Systems (SP 800-34 Rev.1): a reference on the continuity and recovery of information systems. NIST notably links impact analysis to recovery objectives, backup frequency and redundancy mechanisms. Read NIST SP 800-34 Rev.1
• Microsoft – Shared responsibility in the cloud: useful to support the passages on the organisation’s responsibility for its data, devices, accounts and access management, notably MFA and Conditional Access. Read the Microsoft documentation