Straight answers to the IT questions Central PA businesses ask us

Managed IT means an outside team takes ongoing responsibility for your technology for a predictable monthly fee, instead of billing you hour by hour when something breaks. That covers help desk support, monitoring, patching, security, backup and vendor coordination. The goal is fewer problems in the first place, because issues are caught and fixed before your staff notices them.

Our plans are priced on what you actually have: the number of computers, cloud users, network devices and servers. That means a 10-person office and a 60-person firm pay very different amounts, and you never pay for capacity you don't use. A free assessment counts your environment and gets you an exact monthly quote, with no obligation.

Monitoring gives you proactive monitoring and protection behind the scenes, with support when you need it, and suits businesses with their own IT staff. Managed is a full outsourced IT department: help desk, security, backup and vendor coordination. Compliance is everything in Managed, plus the monitoring, training, policies and reporting regulated industries need to stay audit-ready.

No. Every service we offer is delivered through one of our three plans. That is deliberate: security, backup and support only work well when one team is accountable for all of it. Plans that cover the whole environment also stop gaps from opening between "the part we manage" and "the part nobody watches."

Often, yes, as a partner rather than a replacement. Our Monitoring plan is built to work alongside in-house IT: we provide the monitoring, security tooling and after-hours coverage one person can't, and your IT staff stays focused on projects and your people. It also means there is a documented backup when they are on vacation.

Break-fix looks cheaper until something goes wrong, and then you pay for the emergency, the downtime and the rushed fix all at once. A managed plan turns that into a flat, budgeted cost and changes the incentive: we earn more when your systems run smoothly, not when they fail. For most businesses the bigger savings are in avoided downtime and avoided incidents.

Yes. Most attacks are automated and opportunistic: criminals send phishing emails and scan for weak logins at huge scale, and small businesses are attractive because they usually have the least protection. Ransomware, business email compromise and invoice fraud hit offices of every size. The good news is that a few basics stop most of these attacks.

Multi-factor authentication (MFA) asks for a second proof, usually a code or an approval on your phone, on top of your password. Stolen passwords are the most common way attackers get in, and MFA blocks the vast majority of those attempts. It is part of our security baseline for every client, and most cyber insurance applications ask whether you have it on email and remote access.

Not on its own. Traditional antivirus looks for known bad files, and modern attacks often use legitimate tools or brand-new code that slips past it. Managed endpoint detection and response (EDR) watches for suspicious behavior, quarantines threats automatically and is backed by security analysts. Every computer on our plans gets EDR, not just antivirus.

Combine filtering with training. Email security catches most malicious messages before they reach the inbox, and SPF, DKIM and DMARC stop criminals from spoofing your own domain. For what gets through, short ongoing training and simulated phishing tests teach staff what to look for, and a report button makes it easy to flag something suspicious instead of clicking it.

Requirements vary by carrier, but applications commonly ask about multi-factor authentication on email and remote access, endpoint detection and response, tested and off-site backups, regular patching, and security awareness training. Answering "yes" when the control isn't really in place can put a claim at risk, so it pays to verify. We help clients complete these questionnaires accurately and close the gaps first.

Disconnect the affected computer from the network (unplug the cable or turn off Wi-Fi) but don't power it off, and don't pay or reply to anyone. Then call us right away at (717) 695-8611. Acting quickly limits the damage, preserves evidence your insurer may need, and lets us start recovery from clean backups.

When other websites are breached, usernames and passwords are often sold or published on criminal marketplaces. Dark web monitoring watches for your company's email addresses in those leaks, so we can force a password change before an attacker tries those credentials against your systems. It is part of our security awareness services.

The HIPAA Security Rule requires a documented risk analysis, written policies, access controls, audit logging, encryption where appropriate, workforce training, backup and contingency plans, and business associate agreements with vendors that touch patient data. Compliance is ongoing, not a one-time checklist. Our Compliance plan covers the risk analysis, the technical safeguards and the documentation you need if you are ever audited.

Yes, with the right setup. Microsoft 365 can encrypt outbound email automatically or on demand, and rule-based encryption can catch messages that contain sensitive information before they leave. Pair that with MFA, audit logging and a signed business associate agreement with Microsoft, and email becomes a defensible way to share protected health information.

Yes. Tax preparers, accountants, mortgage brokers and many other non-bank financial businesses are covered under the Gramm-Leach-Bliley Act. The rule requires a written information security program, a qualified person in charge of it, a risk assessment, MFA, encryption of customer information, and reporting certain breaches to the FTC. We build and maintain that program for you.

Regulators expect written cybersecurity policies, protection of customer information, email and record retention, vendor oversight and an incident response plan. The SEC's amended Regulation S-P also requires a program for detecting and responding to unauthorized access to customer information and notifying affected customers. Our Compliance plan maps controls and documentation to these requirements so you are ready for an exam.

If you handle controlled unclassified information (CUI) for the Department of Defense, your contracts require the NIST SP 800-171 security controls, and CMMC is the program that verifies them. Start with a gap assessment against the controls, then a system security plan and a remediation roadmap. We perform the assessment and implement the technical controls, monitoring and documentation.

Start with what data you handle: patient records, financial or tax data, card payments, defense information or personal data of customers. Each points to a framework. The industry picker on our compliance section shows the usual ones, and a free assessment confirms exactly what applies to your business and where your gaps are.

It depends on what you need to protect. Business Basic covers email and Teams in the browser, Business Standard adds the desktop Office apps, and Business Premium adds advanced security and device management, which is what we recommend for most businesses handling sensitive data. We license Microsoft 365 at market rate and match each user to the plan they actually need.

Not in the way most people assume. Microsoft keeps the service running and retains deleted items for a limited time, but it is not designed to restore everything after ransomware, a malicious insider or a mistake discovered months later. That is why our plans include a separate Microsoft 365 backup for email and files.

That is domain spoofing, and the fix is three DNS records: SPF lists which servers may send mail for your domain, DKIM signs your messages, and DMARC tells other mail systems to reject anything that fails those checks. Set up correctly, they stop criminals from impersonating you and also improve the delivery of your legitimate email.

Yes. We plan the move, migrate mailboxes, calendars and contacts, update your domain records, and set up phones and computers so staff can pick up where they left off. We schedule the cutover to minimize disruption and configure security from day one, rather than migrating first and securing later.

Follow the 3-2-1 approach: keep three copies of your data, on two different types of storage, with one copy off-site or in the cloud. Just as important, test restores regularly. A backup that has never been restored is a guess. Our backups are monitored daily and restore-tested, and we include Microsoft 365 data, which many businesses forget.

Backup is having copies of your data. Disaster recovery is the plan for getting the business running again: which systems come back first, how long you can afford to be down (your recovery time objective), and how much recent work you can afford to lose (your recovery point objective). We help define those targets and test that the plan actually meets them.

It depends on how much data there is and how the backup is designed. Restoring a single file takes minutes. Recovering a whole server can take hours to days, unless the backup supports fast or cloud-based recovery. We size the backup design to how long your business can realistically be down, and document that so there are no surprises.

Windows 10 reached end of support in October 2025, and the first year of paid Extended Security Updates ended October 13, 2026. Businesses can buy up to two more years of updates, but the price rises each year and it only delays the inevitable. For most machines, replacing or upgrading to Windows 11 is the better investment. We review each computer and help you budget the transition.

Plan on roughly every four to five years. Older machines fail more often, slow staff down, and may not support current security features or the latest version of Windows. Our security baseline calls for supported hardware under five years old, and we track the age and warranty of every device so replacements are budgeted rather than emergencies.

Yes. We quote business-grade computers, servers, firewalls and networking through our distribution partners, then configure, secure and deploy them to your standards. That means new machines arrive with security, management and backup already in place, instead of a box your staff has to set up themselves.

For most businesses, yes. A cloud phone system like Intermedia Unite replaces the on-site phone box with business numbers, voicemail, video meetings and team chat in one service. Staff can take calls on a desk phone, computer or mobile app with the same number, and adding users or moving offices becomes a settings change, not a project. We set it up and support it.

Yes. We start with a network audit that maps your firewall, switches and Wi-Fi coverage and finds the bottleneck, which is often aging equipment, poor access point placement or an internet issue. Then we fix it and monitor the network devices so problems are caught early. For remote staff we provide secure access to the office.

We are based at 5520 Derry Street in Harrisburg and provide on-site support across Central Pennsylvania, with remote support available wherever your team works. Most requests are resolved remotely in minutes, and field technicians handle setups, network work and hands-on troubleshooting.

Our office is open Monday to Friday 8am to 6pm and Saturday 10am to 5pm. Outages that stop your business can be handled after hours on our plans. Current clients can reach support at help@alliancecomp.com or (717) 695-8611.

Less disruptive than most people expect. We start by documenting your environment, then collect admin credentials, licenses and vendor contacts, deploy monitoring and security, and verify backups, coordinating with your current provider where possible. Your staff mostly notices a new support number and faster answers.

Yes. On our plans we act as your single point of contact for your internet provider, copier vendor and line-of-business software. We open the case, coordinate the troubleshooting and push it to resolution, so you make one call instead of sitting on hold with five vendors.

No. We focus entirely on managed IT for businesses: support, security, compliance, Microsoft 365, backup, phones and networking. We don't build websites, run point-of-sale or payment systems, or support home and personal computers. Staying focused is how we stay good at what we do.