Service tiers
Three tiers, one operating discipline.
The tier you need depends on what IT means to the deal thesis and how much of the portco's IT decision making the CFO wants off their desk.
Pricing is engagement led. Portfolio bundle pricing available.
Tier 1
IT Management
For portcos that already have IT in place but need senior oversight on top. We take responsibility for IT being run properly without taking over delivery. The MSP, internal IT team, reseller and other suppliers stay where they are. We sit above them.
What gets done each month
- Health check across infrastructure, identity, endpoints and core applications
- Patch and update status reviewed against policy
- Backup runs verified, with a recovery test scheduled at least quarterly
- Joiner, leaver and mover activity audited for hygiene
- Licence usage compared against entitlement
- Open tickets and incidents reviewed with internal IT or the MSP
- Risk log updated with any new exposures
- Renewal calendar checked for the next 90 days
What the monthly report covers
The CFO receives a written report each month. Same shape every month, so trends are visible.
- Headline status against the prior month
- Open risks with owner and target date
- Supplier performance against SLA
- IT spend against budget
- Any item the board should know
Four pages, never more. Written for the CFO, not for IT.
What supplier oversight looks like in practice
Most portcos run IT through a mix of suppliers. An MSP for day to day support, a reseller for licences, a connectivity provider, and one or two specialist tools.
We sit between the portco and those suppliers. We attend supplier review meetings on the portco's behalf. We track SLA performance. We validate invoices against the contracted scope. We hold suppliers to their renewal commitments.
When a supplier underperforms, we escalate. The CFO does not have to chase.
What "security baseline" means here
Operational security hygiene. Not penetration testing. Not red teaming.
- MFA coverage across user accounts
- Privileged and admin account inventory
- Endpoint protection coverage and alert posture
- Backup verification and tested recovery
- Patch compliance against policy
- Conditional access configuration
- Joiner, leaver and mover discipline
If a control slips, it shows up in the next report with an owner and a target date. Baseline drift does not accumulate quietly.
What licence optimisation actually involves
Most portcos overspend on licences. The pattern is consistent. Dormant accounts still licensed. The wrong tier purchased for the actual usage. Overlap between tools that do similar things.
- Licences assigned to inactive users
- Tier mix against actual usage
- Duplicate tooling across functions
- Unused seats on annual contracts
- Upcoming renewals where rightsizing is possible
Recommendations are presented at renewal points. The portco decides. We do not move licences without authorisation.
What contract review covers
We hold a register of every IT and software contract the portco is bound by. For each contract we track:
- Renewal date
- Auto renewal clauses
- Termination notice period
- Price escalation terms
- Scope and any deviation from it
- Exit and data return obligations
Exit obligations matter at sale. Missed termination windows and unclear data return terms create friction in due diligence. We surface them long before the diligence room opens.
Tier 2
IT Direction
For portcos where IT decisions carry weight. Where the deal thesis depends on IT being a contributor, not a constraint. We act as the IT decision making layer at the board.
What Tier 2 adds beyond Tier 1
Tier 1 keeps IT running properly. Tier 2 decides where IT is going.
Tier 2 includes everything in Tier 1 and adds:
- Ownership of the IT roadmap
- Board level reporting
- Investment case for material IT spend
- A risk framework, not just a risk log
- Project governance across the portco's IT initiatives
- IT input into M&A activity
A senior director attends the board on a regular cadence and answers IT questions directly to the chair, the CFO and the deal partner.
What "technology roadmap" means for a portco
An 18 to 24 month view of IT change. Sequenced. Budgeted. Anchored to the deal thesis.
- What needs to be done and by when
- What it will cost in capital and operating spend
- What happens if it is not done
- Dependencies between items
- Decision points and who owns them
The roadmap is a living document. Reviewed at every board meeting. Updated when conditions change.
What board level IT reporting looks like
A quarterly board paper of no more than four pages covering:
- Roadmap progress against plan
- IT spend against budget for the period and the year
- Top risks and what is being done about them
- Cyber posture in plain language
- Supplier concentration and any change to it
- Readiness for any planned M&A activity
The paper is written for the board, not for IT. It tells the chair and the deal partner what they need to know to govern, decide and challenge.
How IT direction aligns with the investment thesis
The thesis sets the direction. IT supports the thesis or it gets in the way.
For a buy and build, the priority is integration. We build a target operating model for IT and apply it on each acquisition.
For a cost out thesis, the priority is rationalisation. We consolidate suppliers, rightsize licences and remove duplicate tooling.
For a growth thesis, the priority is removing constraints. Identity, scale and operational resilience get attention before they become limits.
For a carve out, the priority is independence. We plan the exit from the parent's TSA and stand the portco up on its own footing.
What risk management covers at this level
A formal risk register reviewed at the board, not an internal log buried in a SharePoint folder.
- Cyber incident exposure and tested response
- Business continuity and tested recovery
- Supplier concentration and key person risk
- Data protection and regulatory exposure
- Insurance alignment with actual risk position
- IT exposure to known M&A activity
Each risk has a named owner, a target date and a current trajectory. The board sees the same view we do.
What project governance involves
Most portcos run IT projects without a real governance frame. Scope drifts. Benefits go untracked. Sponsors lose interest.
We put a frame round every material IT project:
- A short business case that names the benefit and the owner
- Stage gates with clear criteria
- A sponsor and a steering forum
- Benefits tracked against the case for at least six months after delivery
- A post implementation review with lessons captured
Projects under a defined threshold do not need this. Projects above it do not proceed without it.
Tier 3
IT Build-Out
For portcos where IT needs to be stood up, replaced, separated or rebuilt. Time bound. Scoped. Delivered with a clear handover.
What triggers a Tier 3 engagement
- Carve out from a parent group, with a TSA running down
- Post acquisition integration into a target operating model
- Replacement of legacy infrastructure at end of life or no longer supportable
- Standing up IT for a newco
- Recovery of a stalled or failed prior programme
- Regulatory change forcing a structural shift in how IT operates
The trigger is usually visible to the deal partner before it is visible to internal IT. By the time it reaches IT, the timeline is already compressed.
What a typical project scope looks like
Scope is set at the start, in writing, with the sponsor. A scope might cover:
- M365 tenant stand up or migration
- Identity platform implementation
- Endpoint management deployment
- Network refresh
- Security baseline implementation
- Backup and recovery platform
- Supplier transition from a parent or an incumbent
- Office relocation IT scope
- TSA exit programme
We do not take on undefined scope. Where the work is exploratory, we run a short discovery first and then scope the build.
What gets built before TechSteady hands over
Handover is concrete. Before we leave, the following are in place:
- Architecture documented and signed off
- Operational runbooks for routine activity
- Supplier contracts signed and in force
- Identity, endpoint, network and security configurations at the agreed baseline
- Backup verified and recovery tested
- Joiner, leaver and mover process documented and rehearsed
- Risk register populated with named owners
- Internal IT or the MSP demonstrably running BAU
Handover is not a document drop. It is an operational acceptance.
How long a typical engagement runs
Most Tier 3 engagements run between three and six months. Complex carve outs can run to nine. We give a clear estimate at the start, with the assumptions named. If something material changes, we say so and revise the estimate. We do not let an engagement drift.
What "exit criteria" means
Tier 3 ends when defined criteria are met, not when the budget runs out.
- Sponsor sign off on each contracted deliverable
- Documentation handed over and validated by the receiving team
- Internal IT or the MSP running BAU for at least 30 consecutive days
- Open risks logged with named owners and review dates
- Any handover to Tier 1 or Tier 2 agreed in writing
If the criteria are not met, we do not exit. If they are met, we do.
Common questions
Different portcos need different things. A stable Year 3 portco needs T1 oversight. A post acquisition portco needs T2 strategic leadership. A scale up portco needs T3 to build a real IT function. Tiers move with the company.
Multiple portcos on T1 IT Management at a single point of contract, single point of contact, single reporting standard for the PE house. Portfolio bundle pricing is available on enquiry.
TechSteady sits above the support layer, not beside it. It does not replace the MSP or internal team. It manages that relationship on behalf of the portco board. Where suppliers underperform, TechSteady recommends a change.
Inquilion provides independent assurance over Microsoft 365 configuration. TechSteady manages IT operations and supplier delivery. They are separately contracted, separately delivered, and complementary.
Yes. The bundle is sized to your active portfolio at any point. Acquisitions are added on a pro rata basis. Exits drop out at the end of the relevant month.