In ITSM.50.030, the Canadian Centre for Cyber Security points out that "your organization is the data owner and is legally responsible for data security." It recommends defining your requirements and asking the right questions before you sign on, so that you "define an effective service level agreement." A help desk accesses your systems: its hours, service levels and access should be set out in writing.
Short answer
You describe your employees, your tools and your support needs: your request is reviewed by the Courtier TI team, then entrusted to the IT services company that will prepare your quote. The hours covered, the channels and the service levels are set with you.
What the quote should cover
- The hours covered and what happens outside those hours
- The channels for reaching the help desk: phone, email, portal, chat
- Service levels required in writing, with the definition of priorities
- The remote access method for workstations, and the employee's consent before a session takes control
- The ticket tracking tool and your business's access to the history
- The reports provided and how often
- What is included and excluded: devices, software, access requests, employee arrivals and departures
How a help desk works
- An employee reports a problem or makes a request through one of the planned channels
- The request is logged in a tracking tool, with a ticket number
- It is classified by priority, defined in advance with you
- A technician handles it, remotely or on site if the contract provides for it
- The employee is informed of the resolution and the ticket is closed
- Tickets are grouped in periodic reports
Hours, channels and service levels
Start from your actual needs: your business hours, your remote employees, your evening or weekend activities. The quote should state the hours covered, the channels offered and how to reach someone for an urgent problem outside those hours, if applicable.
Service levels should be required in writing in the quote: priorities, commitments for each, measurement and reports. Our guide to choosing a managed IT provider explains in detail what a service level agreement should contain. Here, the key point is that priorities must be defined for your business: a point-of-sale station that is down does not have the same impact as a secondary printer.
Remote access and security
On its page about malicious cyber activity targeting managed service providers, the Centre states that "granting remote access should be done with the same vigilance one would apply when granting physical access to systems and their sensitive information." It also advises determining how long the provider keeps logs of its activity, the level of detail of those logs and how they are protected.
According to ITSM.50.030, access control should be based on the principle of least privilege, and "service providers should only have the access that enables them to effectively manage their services." Have the quote specify the remote access tool, whether the employee must accept each session, who holds administrator accounts and how they are protected, for example with multi-factor authentication.
The help desk may have access to personal information on your employees' workstations or in your systems. When personal information is communicated to it to perform the contract, the Act respecting the protection of personal information in the private sector requires a written mandate or contract that specifies the measures to protect the confidentiality of the information (s. 18.3).
Ticket tracking and reports
Each request should receive a ticket number and remain accessible. Ask whether your business will have access to the ticket history, and whether that history will be handed over at the end of the contract. Periodic reports show recurring problems, devices to replace and whether service levels are met.
Also plan for routine requests: an employee arriving, leaving or changing roles. An employee's departure, in particular, should trigger prompt deactivation of their access. Have the quote specify who can make these requests on behalf of the business and how the help desk verifies the identity of the caller.
Questions to ask yourself before requesting a quote
- How many employees and devices will the help desk support?
- What hours do your employees work, and where?
- Which systems would stop your operations if they went down?
- Who in your business will be able to authorize access requests and changes?
- Should support be offered in French, English or both?
- Do you need on-site visits, or is remote support enough?
Pitfalls to avoid
- Service levels described only verbally, with no definition of priorities
- Hours covered that do not match your hours of operation
- Permanent, unsupervised remote access to every workstation
- Administrator accounts shared between several technicians
- No access to the ticket history, and no handover of that history at the end of the contract
- An employee departure procedure that does not include deactivating their access
What to specify in your request
- The number of employees, workstations and sites to support
- Your hours of operation and whether employees work remotely
- The main software and systems you use
- The language of support
- Whether on-site visits are needed
- Your current IT support and what needs to change
- Requirements from a client, an insurer or a contract that must be met
You can then describe your project: the team will contact you to clarify your needs and provide a quote.
Frequently asked questions
What is the difference between a help desk and managed IT?
A help desk responds to your employees' problems and requests. Managed IT is broader: it can include monitoring, updates, backups and network management. A help desk is often one component of a managed IT contract.
Which service levels should we require?
Require in writing priorities defined for your business, the commitments for each, how they are measured and the reports. The Canadian Centre for Cyber Security recommends defining your requirements before you sign on so that you establish an effective service level agreement.
Can the help desk take control of our computers?
Yes, with a remote access tool. The Centre recommends granting this access with the same vigilance as physical access. Ask whether the employee must accept each session and whether sessions are logged.
Is after-hours support included?
That depends on the quote. The hours covered and what happens outside them should be stated in it. Do not assume a problem reported in the evening will be handled before the next day.
What happens to our data at the end of the contract?
Have the contract specify the handover of the ticket history, documentation and administrator passwords, and the deletion of your data at the provider. The Act requires the written contract to ensure that the service provider does not keep personal information after the contract ends (s. 18.3).