Worked estimates and choosing a host
Managed cloud vs self-managed servers: what the management fee buys and when it pays
How managed cloud and managed VPS services are priced, what a management scope usually includes and excludes, and an illustrative comparison with running servers yourself.
A managed cloud or managed VPS service adds a fee for someone else to patch, monitor, back up and fix your servers. Whether it pays depends on the honest cost of doing that work yourself: your own or a contractor's hours, the tools you need, and the risk of nobody being available when a server fails at night. In the illustrative example below, four servers cost about $1,440 a month self-managed when a contractor's time is counted, against about $1,140 managed; with an in-house staff member at a lower hourly cost, self-managing is cheaper at about $1,020. The deciding questions are what exactly the scope covers, how fast the provider responds, and who is accountable for security.
This guide supports the selection method. It links to support plans and licences, hosting contract terms and the hosting types comparison. Figures are illustrative, ex GST.
How managed services are priced
| Pricing model | How it works | Watch out for |
|---|---|---|
| Per server per month | A fee for each server under management, sometimes tiered by size | Small helper servers can cost as much to manage as big ones |
| Percentage of infrastructure spend | A fee of a set percentage on top of the cloud bill | The fee grows with the bill, so it does not reward savings unless capped |
| Bundled managed VPS or managed hosting | Server and management in one price | Harder to see what you pay for each part |
| Tiered service levels | Bronze/silver/gold style tiers with different response times and hours | Check which tier includes after-hours response |
| Hours-based retainer | A block of hours each month for changes and support | Unused hours may expire; overage rates |
| Mark-up on resold infrastructure | Partner resells cloud at a margin and adds services | Ask whether you can see the underlying bill |
What "managed" usually covers, and what it often does not
Commonly included (check the scope document):
- operating system patching on a schedule;
- monitoring of availability, CPU, memory and disk, with alerts;
- backups on a defined schedule, and restores on request;
- incident response for server faults within stated response times;
- basic security hardening and firewall management.
Commonly excluded or charged extra:
- application support (your website software, plugins, business apps);
- database tuning and upgrades between major versions;
- migrations and new projects;
- security incident investigation beyond the server;
- changes outside business hours unless an emergency;
- licences and third-party tools.
Ask for the scope as a list, with each item marked included, optional (with price) or excluded. Anything not on the list should be assumed excluded.
An illustrative cost comparison
A small business runs four Linux cloud servers. Infrastructure on demand costs about $600 a month.
| Cost line | Self-managed (contractor) | Self-managed (in-house) | Managed service |
|---|---|---|---|
| Infrastructure | $600 | $600 | $600 + 10% partner margin = $660 |
| Management | 6 h × $130 = $780 | 6 h × $60 = $360 | 4 × $120 = $480 |
| Monitoring and backup tools | $60 | $60 | Included |
| Monthly | $1,440 | $1,020 | $1,140 |
| Annual | $17,280 | $12,240 | $13,680 |
The in-house figure assumes a staff member with the skills and spare hours, at an illustrative fully loaded $60 an hour. It does not price the risk that this person is on leave when a server fails, or that patching slips when they are busy. The contractor figure assumes the contractor is available within your recovery time. If neither is reliably true, the managed service's response commitment has value beyond the arithmetic.
Questions that separate a good-fit managed service from a poor one
- Response times by severity, in Australian time, and who is on call after hours.
- Patching window and policy: how quickly critical security patches are applied, and how you are told.
- Backup schedule, retention, location and restore testing: how often a restore is tested and whether you get the result.
- Security responsibilities: a written split of tasks between you and the provider (multi-factor authentication, access reviews, logging, vulnerability scanning).
- Access: who at the provider can access your servers, from which countries, and how access is logged. This matters for Privacy Act APP 8 and APP 11.
- Reporting: a monthly report of patches, incidents, backups and costs.
- Exit: handover of credentials, documentation and configuration when you leave, and any fee for it.
- Account ownership: whether the cloud account is in your business's name or the provider's. Owning the account makes exit far easier.
Hybrid options
- Co-managed: the provider handles patching, monitoring and backups; your contractor handles the application. Clear hand-offs are essential.
- Managed database or platform services: the cloud provider runs the database or platform software, so you manage less. They are priced differently from virtual machines; price both.
- Managed only for production: self-manage test and development servers, buy management for production.
Frequently asked questions
Is managed hosting the same as a support plan from the cloud provider?
No. A cloud provider's support plan typically helps with its platform, while a managed service operates your servers. See support plans and licences.
Should the cloud account be in my name?
Generally yes, so that you control the data and can change partners. Some resale arrangements put it in the partner's account; understand what happens on exit.
Does a managed provider take on my privacy obligations?
No. If you are covered by the Privacy Act, you remain responsible for the personal information you hold. Contract terms should support your obligations.
Can I negotiate the management fee?
Often. Scope, term, number of servers and response tiers all affect the price. Get two quotes on the same scope.
Sources
- Australian Cyber Security Centre (ASD) — guidance on managed service providers and patching
- Office of the Australian Information Commissioner — privacy obligations when outsourcing
- Australian Competition and Consumer Commission — consumer guarantees for services and unfair contract terms
- business.gov.au — engaging contractors and IT service providers
