Frequently asked questions Page 15 of 27

Frequently asked questions — page 15

• Do you offer managed services or just occasional support?

  Many providers offer managed services, combining continuous operation (monitoring and proactivity) with maintenance and support. Others limit themselves to occasional support; it is advisable to compare which tasks are included and how the service is measured.
• Do you manage networks, WiFi, and cybersecurity within the national IT service?

  In a comprehensive approach, yes: it covers deployment and maintenance of wired and wireless networks, connectivity certification and auditing, and cybersecurity with prevention and response. The exact scope depends on the contract and the SLA.
• What nationwide coverage do IT services typically include, and how is delivery managed across regions?

  Nationwide coverage usually combines local on-site support for critical incidents with remote resolution for routine operations. Delivery is managed through centralised ticketing, triage, escalation routes and consistent reporting so quality remains stable across locations.
• Which IT capabilities are usually needed for a full programme: cloud, enterprise IT, cybersecurity, and software/DevSecOps?

  A full programme typically includes enterprise IT maintenance, cloud operations (such as Microsoft 365/Azure), cybersecurity controls, and software delivery support (including secure development practices). The key is mapping capabilities to your lifecycle: run, improve and secure.
• How do methodologies like PMBOK, SDLC, and ITIL affect timelines and deliverables?

  They shape how work is planned, executed and operated. ITIL supports service management and incident/change handling, SDLC structures software delivery, and PMBOK improves programme planning and governance—together they make timelines and deliverables more predictable.
• What compliance and security frameworks should we expect to be supported (e.g., RMF, FISMA, A&A)?

  You should expect support for security controls and assessment practices aligned to your regulatory context. Ask how the provider implements controls, documents evidence, and integrates security into day-to-day operations and change management.
• What quality assurance standards and maturity models are relevant when selecting a nationwide IT services provider?

  Look for evidence of structured service management and quality practices, often reflected through ISO-style management systems and maturity approaches such as CMMI concepts. The practical test is whether they can demonstrate stable service outcomes, reporting and continuous improvement.
• What does preventive maintenance of Windows servers at the hardware and software level exactly include?

  It includes inspection and cleaning of critical components (ventilation, power supply, and physical condition), security verification (antivirus and firewall), and operational control (patches and services). Additionally, evidence and changes are documented to validate the outcome.
• How often is it recommended to perform maintenance on WSUS in Windows servers with Configuration Manager?

  A planned frequency is recommended to avoid accumulation and degradation of the repository. The frequency is usually monthly in typical environments, adjusting to the load and the client's patch strategy.
• Can WSUS maintenance be automated and what tasks are excluded from automation?

  Part of the process can be automated, especially the recurring execution of defined tasks. However, it is advisable to maintain verification and validation (for example, evidence of cleaning and service status) to ensure results.
• What should I prepare before executing maintenance on a Windows server?

  Prepare backups, confirm maintenance windows, and review the prior state of the system. In WSUS, it is crucial to ensure a backup of the database and plan synchronization to minimize impact.
• How is corrective maintenance of a Windows server quoted when there is a specific problem?

  It is usually quoted based on the scope of the diagnosis, containment and recovery actions, and preventive measures to avoid recurrence. The estimated time, level of criticality, and type of intervention required are defined.
• How often should I perform Windows Server maintenance to reduce downtime?

  Use a layered cadence: daily monitoring checks, weekly log review, monthly storage and backup validation, and regular patch cycles aligned to your risk profile. For critical roles like Active Directory, add extra health checks after changes.
• What’s the safest way to schedule Windows updates and reboots for business hours?

  Define maintenance windows with clear start/end times, expected reboot behaviour, and a rollback plan. Test updates in a staging environment where possible, then roll out in phases and validate role health before expanding.
• Do I need WSUS or can I rely on Windows Update for Windows Server patching?

  Windows Update can work for smaller environments, but WSUS (or an equivalent update management approach) is often better for control, reporting, and phased rollouts. The right choice depends on compliance needs and how many servers you manage.
• What should be included in a server maintenance plan for Active Directory and server roles?

  Include AD health checks, replication monitoring, DNS validation, role service status checks, and post-patch verification. Pair these with backup coverage for the system state and a documented process for controlled changes.
• Can you help validate backups and test restores as part of Windows Server maintenance?

  Yes. A strong maintenance plan includes restore testing—not just backup completion. We can help define restore procedures, validate RPO/RTO targets, and ensure backups support the recovery of your key services.
• How long does an IT strategic planning engagement usually take and how often is it reviewed?

  The time depends on size and maturity, but it typically starts with a diagnosis and a prioritisation cycle that sets the pace. The review should be periodic (for example, quarterly or every six months) to adjust the roadmap based on risks and results.
• What roles should lead IT strategic planning and who should participate from business and finance?

  Typically, the CIO/CTO leads, but key participation includes business leadership, finance, and operations management. The idea is that the criteria for value, budget, and risk are decided using shared information.
• What must the IT strategic planning document include to serve as a basis for investment?

  It must include objectives, scope, roadmap, prioritised initiatives, dependencies, risks, assumptions, the architecture/operating model where applicable, and KPIs. Without metrics and governance, the document doesn’t translate into investment decisions.
• How do I define KPIs to measure the progress and value of IT initiatives?

  Combine progress KPIs (deliverables, milestones, deadline compliance) with value KPIs (incident reduction, time improvement, savings, and compliance) and risk KPIs (cybersecurity, continuity, and availability).
• What framework is suitable to use if the main issue is governance and risks or enterprise architecture?

  For governance and control, COBIT usually fits. For enterprise architecture and structural alignment, TOGAF. For continuous improvement and operations, ITIL and PDCA help turn strategy into sustainable practices.
• What deliverables do you produce in an IT strategic planning engagement?

  Typically, you receive an IT strategic plan structure, a 12–24 month roadmap, prioritised initiatives with KPIs, and a governance/operating model outline. Many engagements also include a portfolio view that links funding to outcomes.
• How do you align IT strategic planning with business strategy and measurable outcomes?

  Start from business objectives, translate them into IT value themes, and then define measurable targets and initiatives that address capability gaps. Alignment is reinforced through governance and KPI ownership.
• How do you prioritise technology investments under budget constraints?

  Use repeatable criteria such as value, risk reduction, dependencies, compliance impact and delivery capacity. Scenario thinking helps justify trade-offs when priorities shift.
• How long does it take to create an IT strategic plan and roadmap?

  A common approach is to run a structured discovery and analysis phase, then define direction, initiatives and a roadmap. Timelines vary by complexity, stakeholder availability and data readiness.
• What governance keeps the IT strategic plan current over time?

  Set a continual review rhythm with clear decision rights, KPI reporting and two scanning lenses: context changes and execution progress. This reduces drift and keeps the roadmap realistic.
• What steps should I follow to implement cloud without losing data or interrupting business?

  Start by planning use cases, dependencies, and success criteria. Design for security and continuity (backups and recovery), integrate data with governance, and deploy in waves with testing and operational validation.
• How do I decide if public, private, or hybrid cloud is best for my applications?

  Evaluate the level of control required, risk profile, data criticality, and connectivity dependency. Hybrid cloud often fits when you need to combine flexibility with control or compliance requirements.
• What should I consider when selecting a cloud provider for a professional and secure implementation?

  Look at technical capabilities, the security model, operational support, monitoring and recovery tools, and total cost including connectivity. Ensure the provider aligns with your operational and governance strategy.
• Is it advisable to start with a trial period or a phased migration? Why?

  Phased migration reduces impact and allows learning with real data. A trial period helps validate performance, security, and integration before expanding scope, with clear acceptance criteria.
• What training does the team need to operate and make the most of the new features in the cloud?

  You need training in operations (monitoring, incident response), security (identity, policies, and backups), and data integration. It is also advisable to train on the specific tools used in the project to maintain consistency.
• What information should we gather in a cloud readiness assessment before planning Cloud Solutions Implementation?

  Collect workload inventory, data classification, integration dependencies, current performance baselines, identity/access model, and compliance requirements. Also capture peak usage patterns and operational constraints so capacity, throttling risk, and support handover can be designed accurately.
• How do we design for security in the shared-responsibility model between provider and customer?

  Define what the provider secures versus what your organisation must configure: identity and access controls, data protection, logging, governance, and deletion/consent processes. Then implement monitoring and review workflows so compliance evidence is produced continuously.
• How can we plan for scalability without assuming the cloud has unlimited capacity?

  Use capacity-based limits and expected peak volumes to size architectures and integration patterns. Design for horizontal/vertical scaling where applicable, add service protection, and ensure throttling-aware retries and prioritisation for critical APIs.
• What should we include to prevent performance issues caused by latency and poor design?

  Select regions/datacentres based on latency requirements, choose appropriate connectivity (including private options where needed), and monitor end-to-end paths. For integration-heavy systems, prioritise efficient data access patterns and avoid chatty calls that amplify latency.
• How do we integrate cloud applications with on-premises systems while keeping access secure and controlled?

  Use controlled connectivity paths such as gateways/proxies and strict allow-listing of endpoints (URLs/IPs). Align identity with your access model, enforce least privilege, and ensure traffic is logged and monitored for auditability.
• How long should an IT security plan for a small business be and what size should it have?

  There is no single length: the important thing is that it is executable. For a small business, a structured document by sections (scope, risks, controls, response, review) and annexes with evidence and procedures is usually sufficient.
• What are considered 'critical assets' and how do I identify them to prioritize the plan?

  These are the systems, data, and processes whose failure or exposure directly impacts operations, billing, or continuity. They are identified by mapping dependencies, business criticality, and the impact of unavailability or data loss.
• What minimum policies should an IT security plan include?

  As a baseline, access control policies (including passwords and MFA), data protection (classification and encryption where applicable), acceptable use, and backup management. Complement with roles and operational procedures.
• How should incident response be managed: who does what and how is recovery coordinated?

  Define roles (security officer, IT, management, communication), escalation criteria, containment steps, and a recovery flow. Include internal/external notification as applicable and a post-analysis with corrective actions.
• How often should the IT security plan be reviewed and updated to remain effective?

  As a practice, review periodically and also in response to significant changes: new systems, personnel changes, incidents, audits, or variations in risk. The review should update risks, controls, and procedures, and provide evidence.
• What should an IT Security Plan include to satisfy NIST-style expectations?

  It should describe the system’s security requirements and the security controls that address them, including whether controls are in place or planned. It must also cover scope details such as boundary, environment, and key interfaces, plus responsibilities and evidence expectations.
• How do I structure an IT Security Plan for multiple systems and third parties?

  Use a consistent template per system, then link shared controls and dependencies across systems. For third parties, document interfaces, data flows, and control ownership, and include how you will verify third-party control effectiveness.
• How often should risk assessments and security testing be performed?

  Risk assessment should be performed on a defined cadence and whenever major changes occur. Security testing (vulnerability assessments and penetration tests) should be scheduled based on risk, exposure, and the criticality of systems and data.
• What evidence should we keep to support compliance and auditor review?

  Keep evidence that proves control operation: configuration baselines, monitoring logs, vulnerability remediation records, access reviews, training completion, and incident response documentation. Ensure evidence is traceable to requirements and controls in the plan.
• How can we integrate incident response and disaster recovery into the same IT Security Plan?

  Map incident types to response actions and owners, then link recovery objectives to backup and restoration procedures. Include how the plan supports business continuity goals, roles, communication paths, and testing of recovery readiness.
• What does the budget for Network Installation in Madrid (cabling, WiFi, rack, and certification) include?

  It usually includes planning, installation of structured cabling for voice and data, rack/cabinet assembly, WiFi configuration when applicable, testing, and documentation with labeling. The exact scope depends on the number of points, floors, and type of conduits.
• Do you work with UTP and FTP cabling, and what category do you recommend for office or home?

  Yes, we work with UTP and FTP depending on the environment and level of interference. The category (Cat.6, Cat.6A, or Cat.7) is recommended based on required speed, distances, and future expansion considerations.
• Do you provide certification for voice and data networks, and what documentation do you deliver?

  We conduct testing and prepare the installation for operation and maintenance, with documentation and labeling of points. The type of certification and the delivery format are specified in the project according to the scope.
• How long does a typical installation take depending on the number of points and floors?

  The time depends on the volume of points, the complexity of the conduits, and access to areas (false ceilings, raised floors, or conduits). After a visit or review of the plan, a realistic schedule is estimated by phases.
• Do you offer maintenance and support once the network is installed?

  Yes. We can include support for incidents, changes, and updates, with a managed service approach. This helps keep the network stable and reduces downtime.
• What does a computer network installation service in Madrid include from start to finish?

  A complete service typically covers site survey, network design, structured cabling (voice/data and fibre where needed), installation, certification, and on-site commissioning. You should also receive documentation and a clear handover plan.
• Do you perform structured cabling (voice and data) and network commissioning on-site?

  Yes. Structured cabling is installed with proper routing and cable management, then verified through cabling certification. Commissioning includes validating network services and performance so the network is ready for users.
• Can you design the network based on my current devices and expected workload?

  You can. We start by understanding your business needs, device inventory, and workload expectations, then propose an infrastructure that supports today’s connectivity and future growth. The design is aligned with practical constraints like floors, racks, and cabling routes.
• Do you offer network maintenance after installation?

  Yes. Maintenance options can include monitoring, troubleshooting, rapid resolution of cabling issues, and controlled updates. This helps keep performance stable and reduces downtime risk over time.
• How can I schedule an on-site visit in Madrid, free when you contract the installation, and request a quote?

  Request a consultation and we will coordinate an on-site visit to confirm scope, access conditions, and deliverables. After the survey, you receive a network cabling quote with the agreed installation plan.
• What preliminary steps should I follow to install servers without losing data?

  Define a verified backup plan, establish a maintenance window, and prepare a disaster recovery plan. Before touching the system, validate that the media and restorations work.
• How do I plan a maintenance window and a disaster recovery plan?

  Calculate the expected downtime per component and define an execution order to minimize interruptions. Include a rollback plan and, if applicable, a temporary server or failover strategy.
• What requirements should I review in the operating system, network, and security before installation?

  Confirm hardware compatibility and software dependencies, review IP, DNS, ports, and routes, and harden access with policies and firewalls. Ensure that antivirus and controls do not block critical services.
• Do I need specific licenses depending on the software I am going to deploy?

  Yes: licensing depends on the product, edition, and in many cases, the deployment model. Before installation, validate versions, terms, and capacity to avoid extra costs or functional limitations.
• What tests should I run after installation to ensure that the servers are functioning correctly?

  Perform functional tests by service, validate network connectivity, review logs, and check basic performance. Conclude with acceptance criteria that include security and operational stability.
• Which server installation approach is best for my environment: Windows Server or Ubuntu Server?

  Choose based on your required services, administration preferences, and licensing/operational model. If you rely on Windows-centric tooling or specific enterprise workflows, Windows Server may fit better; for flexible Linux administration and common open-source stacks, Ubuntu Server is often a strong option.
• What’s the safest way to prepare USB/DVD installation media and verify it before installing?

  Create boot media using the correct formatting and write method, then verify the ISO/disc integrity before starting the installer. This prevents corrupted images from causing installer errors or partial setups.
• How do I troubleshoot when my computer doesn’t boot from the installation USB/DVD?

  Check boot order/boot menu selection, confirm the correct device is chosen, and verify whether the system expects UEFI or legacy boot. Also ensure the media is actually bootable and not mismatched to the firmware mode.
• During installation, how should I choose storage/partitions to avoid data loss or a failed setup?

  Identify the correct disk carefully, avoid confirming destructive partition changes, and confirm the installer is targeting the intended drive. If in doubt, pause and validate disk selection before proceeding.
• After installation, what checks should I run to confirm the server is ready for production workloads?

  Validate network connectivity, confirm updates and baseline security settings, test remote access requirements, and verify backup/restore readiness. Run a short acceptance checklist so the server is usable and protected before production use.
• Do you repair Panasonic analog, hybrid, and IP PBXs?

  Yes. We manage incidents in analog, hybrid, and IP PBXs, as well as mixed environments. The approach changes depending on whether the issue is with hardware, connectivity, or programming.
• Which Panasonic models do you handle?

  We work with common families such as TDA series (hybrid), TDE series (IP), and unified communications like NCP/NS. If you provide the model and series, we will validate compatibility and action plan.
• If the fault is hardware or configuration-related, how do you diagnose it?

  We start with symptoms and the impact on extensions/services. We check for failure signals in power supply, boards, and connectivity, and then verify the programming logic and routing.
• Do you offer remote support in addition to on-site visits?

  Yes. For incidents that allow diagnosis and adjustments via remote access, we prioritize this method to reduce response times. For cases that require physical intervention, we coordinate on-site visits.
• What information should I provide when requesting Panasonic PBX Technical Service?

  Please provide the model and the series, specific symptoms, affected extensions, any error messages, and whether the fault is related to the network or incoming/outgoing calls. This will speed up the diagnosis.
• What information do I need to request Panasonic switchboard technical service (model, serial number, fault details)?

  Provide the switchboard model and serial number, your system topology (analogue/digital/VoIP), and a clear fault description with timestamps. Include any error codes, recent changes, and supporting evidence such as call quality examples or logs.
• How do I open a ticket or get connected to the right support team for a Panasonic switchboard?

  Start with a structured ticket or support contact route and include the checklist details (model, serial, symptoms, and impact). Ask for remote triage first, then escalate to onsite intervention if the fault cannot be isolated remotely.
• What are the typical repair and turnaround expectations for switchboard service requests?

  Turnaround depends on diagnostic depth and parts availability, plus integration complexity in hybrid setups. A structured triage should quickly isolate the fault source, then move to targeted repair or service depot coordination.
• Do you provide parts support and module/board-level repair options for switchboards?

  Parts support usually includes identifying compatible components, coordinating sourcing, and managing repair workflows through a service depot approach when required. Module/board-level options depend on the diagnosed fault and compatibility constraints.
• Can Panasonic provide managed support coverage (e.g., 24/7/365) for switchboard-related operations?

  Managed coverage can be structured in different ways depending on your operational risk and architecture. Many organisations choose a mix of remote monitoring, preventive maintenance, and defined response windows to minimise downtime.
• What IT services does a maintenance contract for companies include?

  It typically includes technical support, preventive and corrective maintenance, incident management, and, depending on the agreement, network and equipment maintenance. It may also include monitoring, inventory, and activity reporting.
• Do you offer remote and/or on-site technical support throughout Spain?

  Yes, support can be provided remotely, by phone, or on-site depending on the type of incident and its criticality. For companies with multiple locations, service is coordinated to maintain a consistent level of service.
• Do you manage backups and how is their proper functioning verified?

  Local and remote backups with online backup are managed, and verification processes are in place to ensure recovery is possible. The goal is to reduce the risk of data loss and shorten recovery times.
• Does the cybersecurity solution include hardening and user training?

  Cybersecurity is addressed with hardening measures, protection, and awareness/training for users. Additionally, an operational response to incidents is defined to minimize impact and downtime.
• Can you act as a single provider to simplify IT management?

  Yes, it is possible to centralize support, maintenance, networks, backups, and infrastructure projects under a single provider. This reduces complexity, improves coordination, and facilitates expense control.
• What IT services in Spain are best for a growing business: managed support, consultancy, or both?

  Most growing businesses benefit from both: managed support to stabilise day-to-day operations and consultancy to plan upgrades, migrations, and security improvements. The right mix depends on your current maturity and risk level.
• How do I choose between onsite IT support and a 24/7 remote helpdesk?

  Choose onsite when you need frequent hardware/network work or rapid physical intervention. Choose 24/7 remote helpdesk when incident response, monitoring, and ticket handling must continue outside business hours.
• What should a good SLA include for IT Services Spain (response times, resolution, reporting)?

  A strong SLA defines response and resolution targets, escalation paths, maintenance windows, and reporting cadence. It should also clarify responsibilities for user issues versus infrastructure faults.
• How can I verify that an IT provider is legitimate and not inflated by fake reviews?

  Ask for evidence of delivery capability: references, case summaries, service methodology, and how reviews are verified. Look for consistent scope descriptions and transparent processes rather than only star ratings.
• What questions should I ask about cybersecurity and data management before hiring an IT services company?

  Ask how they handle layered controls (firewalling, email/web filtering, endpoint protection), vulnerability and patch management, backup strategy, and secure remote access. Also request how they report risks and support compliance needs.
• What does a fixed IT outsourcing fee include and how can I avoid incident charges?

  A fixed fee should include the defined scope by modules (helpdesk, preventive maintenance, monitoring, and support) and the SLA conditions. To avoid extra charges, validate what is considered an incident, what is included in maintenance, and what exclusions exist in the contract.
• Can I outsource only part of the IT department (for example, helpdesk, networks, or security) and keep the rest?

  Yes. It is common to outsource by areas: level 1 helpdesk, network administration and security, or backup and access management. The key is to define interfaces, responsibilities, and escalation processes to ensure continuity is not broken.
• What is the difference between hiring a resident team and an MSP or co-management model?

  The resident team assigns profiles to cover needs with operational continuity. MSP or co-management focuses on managed services with processes, monitoring, and service governance. The choice depends on the level of control you want to maintain and the specialization required.
• How do you manage permissions, onboarding, and offboarding to reduce risks?

  A documented process is recommended: request and approval of access, periodic review of permissions, and traceability. For onboarding/offboarding, the flow of onboarding/offboarding, change windows, and validations are defined to minimize errors and unauthorized access.
• What compliance and data protection requirements does the provider cover (GDPR, information security, occupational risk prevention)?

  A serious provider should consider data protection (GDPR), information security measures, and occupational risk prevention requirements according to the type of service. Request evidence, applicable policies, and how access, records, and responsibilities are managed.
• What KPIs should we define before starting IT outsourcing in Madrid?

  Start with outcome-based KPIs such as response time, resolution time, ticket quality, backlog reduction, and service availability. Make them SMART with baselines and agreed measurement methods so you can compare providers fairly.
• How do SLAs work in an IT support outsourcing contract?

  SLAs define service tiers, response and resolution targets, and escalation rules when targets are missed. A practical SLA also clarifies how incidents vs requests are handled and how reporting is delivered.
• Can preventive monitoring reduce incidents and business interruptions in our case?

  Yes—when monitoring is paired with timely actions such as updates, configuration checks, and early incident detection. The key is to agree on what is monitored, how alerts are handled, and how prevention is measured.
• How often should we run performance reviews with our outsourcing partner?

  Use a cadence that matches your risk level and volume of incidents—typically with regular scheduled reviews and escalation governance. The goal is to turn metrics into improvement actions, not just reporting.
• What is the best way to measure ROI and user satisfaction after outsourcing?

  Combine operational metrics (solved tickets, time-to-resolution, reduced downtime) with user satisfaction feedback. Translate improvements into cost and productivity impact to build a clear ROI narrative.
• Where should a company start to improve its IT infrastructure if it does not have a mature IT area?

  Start with a basic but comprehensive diagnosis: inventory of assets, review of incidents, security status, and network capacity. With that data, define a roadmap by priorities (availability, security, and costs) and execute changes in phases.
• What security measures are essential when modernizing infrastructure?

  Prioritise segmentation and firewall, remote access with VPN, data encryption, and controls to prevent information leakage. Complement with event monitoring and response policies to reduce the impact of incidents.
• Is it better to rent or buy infrastructure, and how to decide based on budget and growth?

  The decision depends on total cost, required flexibility, and operational risk. If you need to scale quickly or reduce initial investment, an as-a-service model usually fits; if you seek total control, on-prem may be viable with a maintenance plan.