Your questions about managed IT
services for SMEs

Cyber-incident impact depends on downtime, restoration, legal obligations and customer effects. Estimate it from the organisation's own processes and verify current national statistics from authoritative sources rather than applying a universal cost or closure rate.

Yes, and increasingly so. 43% of cyberattacks target SMEs (ANSSI 2024). Hackers target them precisely because they are less protected than large corporations, yet hold exploitable data (customers, accounting records, intellectual property). 144 ransomware compromises were reported to ANSSI in 2024, the majority involving organisations with fewer than 250 employees.

4 immediate actions: 1) Disconnect infected machines from the network (do not switch them off). 2) Notify your IT provider and report to the relevant cybercrime authority (cybermalveillance.gouv.fr in France). 3) Never pay the ransom — there is no guarantee of data recovery, and you are funding criminals. 4) File a police report. ANSSI recommends never negotiating directly. The best protection remains prevention: tested off-site backups and EDR on every workstation.

A traditional antivirus detects known threats using signatures (a database of viruses). An EDR (Endpoint Detection & Response) analyses suspicious behaviour in real time using artificial intelligence. It can detect an unknown ransomware, automatically isolate a compromised workstation and enable post-incident investigation. In 2025, antivirus alone is no longer sufficient against current threats.

The NIS2 directive (transposed into French law in October 2024) applies to companies with 50+ employees or €10M+ turnover in 18 sectors (healthcare, energy, transport, digital, food…). However, even if your SME is not directly in scope, your principal clients may require compliance from their subcontractors. Achieving compliance is an opportunity to structure your cybersecurity posture properly.

The 3-2-1 rule recommends keeping 3 copies of your data, on 2 different media (local disk + cloud, for example), with 1 copy stored off-site (remote datacentre). This is the minimum standard recommended by ANSSI. In 2025, the 3-2-1-1-0 rule is becoming the norm: add 1 immutable copy (unmodifiable, even by an administrator) and target 0 errors in restoration tests.

A DRP aims to restore operations after an incident, while a BCP plans how critical activities continue. RTO, RPO, architecture, cost and continuity targets depend on the organisation and become commitments only after sizing, testing and contractual confirmation.

ANSSI recommends a restoration test at least once per quarter. 34% of companies never test their backups — and discover the problems when a disaster actually occurs. For an ECLAUD IT service, the restoration-test scope, frequency, evidence and comparison with the contractual RTO must be specified in the contract.

This is the primary risk if your backups are on the same network as your workstations. The solution: immutable backups stored off-site. Veeam and Acronis offer air-gapped or immutable copies that even a compromised administrator cannot delete. The rule: if your backup is accessible from any workstation on the network, it is not secure.

ECLAUD IT structures managed IT proposals for SMEs that need an external operating model. The relevant scope depends on the organisation's business software, data sensitivity, regulatory duties, internal skills and continuity requirements.

ECLAUD IT is headquartered in Saint-Paul, Reunion Island. The proposal confirms the locations covered for on-site work and the conditions that apply to remote support, administration and monitoring.

A repair shop focuses on individual incidents. An MSP can combine maintenance, monitoring, backups, cybersecurity and service governance within one documented scope. For ECLAUD IT, the monitored systems, contacts, responsibilities and escalation process are those stated in the contract.

The first conversation is used to understand the number of workstations and sites, servers, business software, current issues and regulatory constraints. If an audit is required, its scope, price and deliverables are confirmed before work begins. The proposal then defines the service scope and any transition plan.

The contract must define reversibility: the data, credentials and technical documentation to be transferred, the applicable notice period, each party's responsibilities and any transition support. These terms are confirmed in writing for the selected ECLAUD IT scope.