Managed Network (LAN/Wi‑Fi/WAN) (B/S/G)

Summary. Practical network management for LAN/Wi‑Fi/WAN—change governance, health, and right‑sized security controls.

Who it's for. SMEs with branch sites needing reliable connectivity and sensible security without heavy overhead.

What’s Included

Scope	Description
Core Inclusions	Config backups and change governance Health monitoring and link checks SWG/DNS/Firewall posture alignment
Optional Add‑Ons	SD‑WAN design uplift as a project After‑hours change windows Vendor circuit coordination

Note: timelines depend on size and current tooling.

Phase	Activities	Deliverables	Indicative Duration
01 — Baseline	Config import & backups Policy/ACL snapshot	Network baseline & first posture snapshot Change plan	1 week
02 — Stabilise	Policy tidy‑up Monitoring thresholds	Stable posture Exception register (owner + expiry)	1–2 weeks
03 — Operate	Monthly health & changes Quarterly posture review	Monthly scorecard (health/changes/incidents) Change notes	Ongoing

Plan	Coverage	Response / Restore	Governance
Bronze	Business hours (Mon–Fri 08:00–17:00 NZT, except Public Holidays)	P1: 2h / NBD • P2: 4h / 2BD	Monthly summary
Silver	Extended hours (Mon–Fri 07:00–19:00 NZT, except Public Holidays)	P1: 1h / Same day • P2: 2h / NBD	Monthly review
Gold	BH + after‑hours (24×7 P1)	P1: 30m • P2: 1h	Monthly review + roadmap

For pricing, terms and conditions see the Pricing Annex.

Safer internet access established: core categories enforced (malware/phishing/newly-registered) with no critical business disruption
Change governance in place: approved windows and an exception register with owners and expiries
Measured improvement: reduction in bypasses/high-risk categories; MTTR within SLA for P1/P2
Telemetry visible: monthly posture report (policy changes, exceptions ageing, DNS/SWG highlights) accepted

Admin/delegated access as applicable
Maintenance windows agreed
Tagging/records where required
Firewall/DNS allow-list for controller/SWG egress and management endpoints
Agreed deployment mode (agent, PAC/proxy, DNS forwarding) for the initial cohort

Legitimate site/app blocked: exception workflow with expiry; weekly review; staged policy rollouts
Agent/PAC/DNS conflicts: ringed deployment; latency checks; rollback script
Shadow bypass (external DNS/direct-to-IP): block external resolvers; enforce proxy/PAC; monitor egress

Prefer to stabilise first? Run a short pilot to establish a clean baseline; then roll into this managed service.