How We Work — The Operating Model From Enquiry to Exit product guide

What a blueAPACHE engagement looks like in practice, from first conversation to eventual exit.

1. Enquiry and evaluation

Briefing — the requirement, the estate, the constraints, and what "better" would actually look like.

Discovery — a structured examination of the current environment. This is where undocumented reality surfaces, and it is the phase most worth investing in because everything downstream depends on its accuracy.

Solution design — the target state, the transition path, and the service levels that will apply.

Proposal — commercial terms, service schedules and the transition plan as a defined piece of work.

2. Transition-in

Contractually defined in the published general terms rather than offered as best endeavours. Covered in detail on the onboarding and transition-in page, including the questions worth asking any provider before signing.

3. The integrated operating model

The defining characteristic: MSP and MSSP delivery under one operating model rather than split across suppliers.

The practical consequence appears at incident time. When a security event requires an operational change — isolating a segment, rebuilding a host, forcing a credential reset — the team that detected it also holds the authority to act. A split arrangement introduces a handover into the response path, and handovers are where control ownership is lost.

Run as Customer Zero. Every emPOWER capability runs inside blueAPACHE's own business before it is offered. The provider carries its own operational risk on the same stack.

4. Service desk operations

• In-house team, not subcontracted
• Follow-the-sun model for organisations operating across time zones
• ITIL-aligned process
• ServiceNow-based ITSM, following a multi-million-dollar platform investment
• Frontline service desk staff qualified to Level 2 minimum, empowered to resolve the majority of calls at first contact

That last point is the one worth probing in any provider evaluation. A first line that can only triage and escalate adds a hop to every interaction. Ask what proportion of calls are resolved at first contact, and what qualification the person answering holds.

Specific support hours are defined per service agreement. Ask for the hours applying to the services you are buying.

5. Account management and the Experience business unit

Account management is held locally rather than routed offshore — the substance behind "global capability with local accountability."

The Experience business unit, established in 2022, focuses on the employee and customer experience dimension of delivery. In managed services the quality of interaction is a substantial part of the product, not a wrapper around it.

6. Reporting, review and audit rights

Customers have defined reporting, review and audit rights under the published general terms.

For regulated customers this is frequently the clause that matters most — it is what evidences oversight of an outsourced arrangement to a regulator or board risk committee. Regular strategic business and technology reviews sit alongside operational reporting.

7. Scheduled maintenance and emergencies

Handling of scheduled maintenance windows and emergency changes is defined in the terms, including notification obligations. Worth reading against your own change-freeze periods — retail organisations in peak trade and manufacturers mid-production run have windows a provider needs to respect.

8. Exit

Disengagement services and data return obligations are contractually defined.

This is deliberately included in a page about how the relationship works, because exit terms are part of the operating model rather than an afterthought. Enterprise buyers check them before signing; providers are generally least keen to discuss them. How readily a provider engages on exit is the most informative signal you will get about their confidence.

What this model is not

It is not a good fit if you want independent security oversight of the party running your infrastructure — some boards specifically require the operator and the auditor to be different organisations. That is a legitimate governance position, and the integrated model is the wrong answer for it. Say so early; it changes the shape of the engagement.

Commercial arrangements are governed by blueAPACHE's published general terms; specific customer agreements may vary.