RECORD
MLMS — MANAGED IT
PREPARED BY
MAIN LINE MANAGED SERVICES LLC
LOCATION
RADNOR, PA
ISSUED
2026 · REV A
FIG. 01 — ASSEMBLY

Devices carry a coverage level. People carry their own services.

Every managed device takes one of three coverage levels at a flat figure per device; workplace services are itemized per user; add-ons are elected where the firm's obligations call for them. One agreement, one invoice.

DEVICES · D-01–03
Every machine monitored, protected, and supported at one of three levels.
PER DEVICE / MO
PEOPLE · P-01–02
Email security on every user; cloud backup added per user where it's needed.
PER USER / MO
ADD-ONS · A
Optional protection, quoted and elected against a firm's obligations.
AS QUOTED
INFRASTRUCTURE
Servers, network, storage, and standalone backup, as separate stated lines.
STATED LINES

Below: the exploded view, card by card. Flip any card for what's inside.

FIG. 02 — COVERAGE

The exploded view.

D — PER-DEVICE COVERAGE LEVELS
D-01
Core
THE FLOOR — EVERY DEVICE
  • Round-the-clock monitoring, patching, and maintenance.
  • Managed detection and response, backed by a 24/7 SOC.
  • DNS and web filtering, on and off the network.
  • Support from prepaid hour blocks.
MONTH-TO-MONTH OR ANNUAL
FLIP ⟲
D-01
INSIDE CORE
  • Health, capacity, services, and events watched around the clock, with a live device inventory.
  • Behavior-based endpoint protection that can isolate an infected machine on its own.
  • A 24/7 SOC investigates detections and remediates active threats for you.
  • DNS and web filtering, plus OS and app patching in announced windows.
BACK ⟲
D-02
Secure
EVERYTHING IN CORE, PLUS
  • Included helpdesk: thirty minutes of remote support per device, monthly.
  • Committed response times by priority, in writing.
  • An annual agreement, with your rate held for the term.
ANNUAL
FLIP ⟲
D-02
INSIDE SECURE
  • Thirty minutes of included support per device each month, pooled across your team.
  • Committed business-hours response windows by priority, first alert to closed ticket.
  • Overage drawn from prepaid blocks at a reduced managed-client rate.
  • Annual term locks your rate; a longer commitment locks a better one.
BACK ⟲
D-03
Resilient
EVERYTHING IN SECURE, PLUS
  • Daily workstation backup to immutable offsite storage.
  • Fourteen restore points — two weeks of recovery history.
  • File-level or whole-machine restores, run by us.
ANNUAL
FLIP ⟲
D-03
INSIDE RESILIENT
  • Every workstation backed up daily to offsite storage you never manage.
  • Immutable copies — unchangeable and undeletable, ransomware included.
  • Fourteen restore points; recover a file or the whole machine.
  • We run the restore on request — no portal, no homework.
BACK ⟲
P — PER-USER SERVICES
P-01
Email security
THE BASELINE — EVERY USER
  • Phishing, impersonation, and BEC caught; bad links and attachments stopped before they land.
  • Encryption for sensitive mail, plus continuity through a provider outage.
  • Phishing-awareness training and simulations.
PER USER / MONTH
FLIP ⟲
P-01
INSIDE EMAIL SECURITY
  • Spam, malware, phishing, and BEC filtered; links rewritten and attachments sandboxed before delivery.
  • Warning tags on suspicious mail; encrypted delivery for sensitive messages.
  • Thirty-day continuity keeps mail reachable through an outage.
  • Phishing simulations, with short training for whoever slips.
BACK ⟲
P-02
Cloud data backup
EVERYTHING IN EMAIL SECURITY, PLUS
  • Microsoft 365 mail, OneDrive, SharePoint, and Teams backed up daily, offsite and immutable.
  • An independent copy of your data, held outside Microsoft.
  • Recover one item, a mailbox, or a whole account, run by us.
PER USER / MONTH · ANNUAL
FLIP ⟲
P-02
INSIDE CLOUD DATA BACKUP
  • Includes everything in Email security, plus a full daily Microsoft 365 backup.
  • Exchange, OneDrive, SharePoint, and Teams, held immutable and independent of Microsoft.
  • Microsoft runs the service but doesn't back up your data; this is that layer.
  • Recover a file, a mailbox, or a whole account on request — no homework.
BACK ⟲
A — ADD-ONS
A-01
Identity protection
  • Round-the-clock watch on every Microsoft 365 account, flagging the sign-in that doesn't fit and the takeover in progress.
  • Business email compromise, rogue app consents, and malicious inbox rules caught and shut down.
  • A compromised account locked and its sessions cut fast, before anything spreads.
QUOTED · PER IDENTITY
FLIP ⟲
A-01
INSIDE IDENTITY PROTECTION
  • Microsoft 365 sign-in and account activity watched continuously for takeover, impossible-travel, and abnormal authentication.
  • Business email compromise, stolen sessions, rogue OAuth consents, and malicious inbox rules detected and stopped.
  • On a compromise: active sessions revoked, the account disabled, and the event documented.
  • A 24/7 security operations team investigates and responds to identity threats on your behalf.
BACK ⟲
A-02
Retention & legal hold
  • Email archived and retained to your bar and regulatory obligations.
  • Litigation and compliance holds configured to counsel's instructions.
  • Search and export across the firm's mail when a matter requires it.
PER USER / MONTH · ADD-ON
FLIP ⟲
A-02
INSIDE RETENTION & HOLD
  • Retention rules by content type and age across email.
  • Litigation hold per person and per matter — held mail can't be deleted.
  • Firm-wide mail search tied to a specific matter.
  • Exports delivered in a format your counsel can use.
BACK ⟲
A-03
Mobile device management
  • Company and personal phones and tablets enrolled under your firm's rules.
  • Work data kept separate and protected on personal devices.
  • Lost or departed devices wiped of firm data remotely.
PER ENROLLED DEVICE · ADD-ON
FLIP ⟲
A-03
INSIDE MDM
  • Passcode, encryption, and a minimum OS version required to connect.
  • Work data kept in its own container; a selective wipe removes firm data and leaves personal data alone.
  • Required apps pushed automatically; risky apps blocked.
  • Lock or wipe a device on loss or when someone leaves.
BACK ⟲
A-04
Vulnerability management
  • Continuous vulnerability assessment across every covered endpoint.
  • Risk-based prioritization of what to fix first.
  • Remediation guidance and progress tracking.
PER ENDPOINT / MONTH · ADD-ON
FLIP ⟲
A-04
INSIDE VULNERABILITY MANAGEMENT
  • Always-on assessment of operating-system and application vulnerabilities on every device.
  • Exploit-aware prioritization surfaces the highest-risk exposures first.
  • Recommended remediations mapped to each finding, with progress and patch verification tracked.
  • Built on the endpoint protection already running in every plan.
BACK ⟲
FIG. 03 — WHO DOES WHAT

The tooling does the rote. The SOC hunts threats. A person makes the call.

THE TOOLING
A suite of management tools — agent-based monitoring and polling, endpoint sensors, backup agents — collects and analyzes telemetry, deploys patches on the announced window, and runs the routine actions. The tools do the rote collection and execution; they don't make the calls.
THE SOC
A 24/7 security operations team watches detections across every coverage level, hunts threats, and contains and remediates them — on Core through Resilient, not just the top tier.
A PERSON
Approves and schedules the windows. Performs the restores. Makes the changes. Handles your help requests. Closes the ticket into your record.
ESCALATION
Detection → containment → cleanup → report. A documented sequence, regardless of who is on the other end.
REVIEWS
Periodic, looped back into day-to-day management — coverage levels and seat counts adjusted as the firm changes, on paper.
FIG. 04 — OPERATING CADENCE

What runs, and how often.

Most of managed service runs on a fixed cadence in the background, with or without a ticket open. Here is what happens, and when.

CONTINUOUS24/7
Monitoring and detection. Device and network telemetry, managed detection and response, and account monitoring run around the clock, watched by a 24/7 SOC.HEALTH & CAPACITY · DETECTION & RESPONSE · DNS & WEB FILTERING · IDENTITY MONITORING (WHERE ELECTED)
DAILYEVERY DAY
Backups and checks. Backup jobs run and are verified, patch state is checked, and the day's alerts are triaged without you asking.BACKUP JOBS RUN & VERIFIED · PATCH-STATE CHECKS · ALERT TRIAGE
SCHEDULEDON A CALENDAR
Patching and administration. Operating-system and application patches land in an announced window. The Microsoft 365 tenant and its security baseline are maintained, and reviews are held on a set interval.MONTHLY PATCH WINDOW · MICROSOFT 365 ADMINISTRATION · BASELINE UPKEEP · PERIODIC REVIEWS
ON REQUESTWHEN YOU ASK
Helpdesk, restores, and changes. Support requests, file or machine restores, and changes run through one intake, against your included time and then prepaid blocks.HELPDESK & SUPPORT · FILE & MACHINE RESTORES · CHANGES & PROJECTS

Server backup and disaster recovery runs on this same cadence under its own agreement — Backup & DR.

FIG. 05 — THE QUOTE, TRANSLATED

Line for line.

What you read here is what you read on the quote — same names, same structure.

AS IT READS ON YOUR QUOTE
MANAGED SERVICES — CORE / SECURE / RESILIENT
One line per coverage level; the quantity is your covered devices. The levels above, D-01–03.
WORKPLACE SERVICES — PER USER
Email security and cloud data backup, P-01–02. One quantity: your headcount.
MICROSOFT 365 LICENSING — PER USER (OPTIONAL)
Seat licensing resold at market rate where you'd rather consolidate it with us. Separate from the workplace services above — never bundled into a coverage level.
IDENTITY PROTECTION
The A-01 add-on, quoted per identity.
RETENTION & LEGAL HOLD
The A-02 add-on, per elected user.
MOBILE DEVICE MANAGEMENT
A-03, per enrolled phone or tablet — separate from workstation counts.
VULNERABILITY MANAGEMENT
The A-04 add-on, quoted per endpoint.
SERVER / NETWORK / NAS MANAGEMENT
Infrastructure stated lines on the same agreement, independent of device and user counts. Server protection itself is S-06.
MANAGED BDR
Per protected server, VM, or workload, under its own agreement — detailed at S-06.
ONBOARDING FEE
One-time, stated before signature — how it runs is in FIG. 03.
SUPPORT BLOCK
Prepaid labor, drawn only after included allocations — see S-04.

Your quote is itemized exactly this way. If a line on a quote isn't on this list, ask — we'll show you where it lives on this page.

FIG. 06 — CONTACT

Start with fifteen minutes.

Enquiries are returned within one business day.

PHONE
TOLL-FREE
(833) 388-0700
LOCAL
(610) 978-0700
SALES — DIRECT
(610) 978-0375
WRITTEN ENQUIRIES
hello@mainlinemanaged.com
Or the form below — same destination.

Useful to have ready: rough headcount, device count, and what prompted the look. Two sentences is plenty.
HOURS
Monday–Friday · 9:00 AM–5:00 PM ET
Written enquiries land any time and are picked up the next business morning.
BASE
Radnor, Pennsylvania
Serving the corridor west to east — on-site along the Main Line, remote-first everywhere else.

Sends directly to us — no mail app required.

AFTER YOU SEND
  • READ It lands in one queue and is read by the person who'd do the work.
  • REPLY Within one business day — usually with a few times for a call.
  • CALL Fifteen minutes. You'll know if we fit; nothing proceeds without paper.