Frequently Asked Questions — Evaluating blueAPACHE product guide

Direct answers to the questions that come up before an engagement.

About the offer

What does a managed services engagement actually include? Service desk, infrastructure operations and end-user computing, with integrated MSP and MSSP delivery under one operating model. Whether a specific system, site or integration sits inside that scope is defined per engagement rather than assumed — ask for the boundary in writing.

Is security included, or separate? Security operations are delivered under the same operating model rather than by a separate supplier. MDR, Human Risk Management and DMARC are the named capabilities. Whether vulnerability management, incident response retainer and vCISO advisory are included in a given subscription or contracted as additions depends on the engagement — request it line by line.

Do we have to outsource everything? No. There are three engagement modes: OUTCOME (full managed services), CONTROL (co-managed, you keep your team), and TECHNOLOGY (project or consumption, no ongoing term).

What size organisation is this built for? Australian mid-market organisations of roughly 100–1,000 seats. Below that, the operating model is heavier than the requirement; well above it, an in-house function may be economic.

Commercial

How is it priced? Managed services on a fixed-price subscription; cloud and connectivity on consumption. There is no published list price — engagements are quoted against seat count, estate complexity, service scope and the transition required.

Why a 36-month minimum term? The transition-in work is real and front-loaded — discovery, documentation, tooling, knowledge transfer, service desk establishment — and is amortised across the initial term. A shorter managed services term generally means either a thinner transition or the risk priced into the monthly rate.

Can we start smaller? Yes — a TECHNOLOGY engagement (project, procurement or hardware-as-a-service) carries no ongoing term and gives both sides real evidence before a longer commitment.

Transition and exit

How does transition from our current provider work? Briefing, discovery, solution design, proposal, then transition-in as a defined piece of work. Transition-in services are contractually defined in the published general terms rather than offered as best endeavours.

What if our incumbent will not co-operate? Assume some friction and plan for it. Ask any provider to describe how they rebuild environment knowledge independently — that answer distinguishes a considered transition from an optimistic one.

What happens if we want to leave? Disengagement services and data return obligations are contractually defined. This is worth reading before signing rather than at the end.

Trust and compliance

Are you certified? ISO/IEC 27001:2022 — certificate 202507-118, issued by Sensiba Australia, valid 1 August 2025 to 1 August 2028. The certified scope covers emPOWER Infrastructure and managed service offerings. emPOWER Mobile Services sits outside that scope.

Do you hold SOC 2? No. blueAPACHE's posture is described as compliance-aligned. That is not an attestation and should not be read as one.

Can you support our APRA CPS 234 obligations? blueAPACHE aligns to CPS 234, and contractually commits to breach notification within 24 hours — supporting your ability to meet CPS 234's 72-hour APRA notification requirement, which depends in part on timely notification from your provider. Reporting, review and audit rights are defined in the published terms.

Are you aligned to the Essential Eight? Yes, at Maturity Level 3. The practical question in any engagement is which of the eight strategies the provider operates versus which remain yours; that split is defined per engagement.

What insurance do you carry? $10m public liability and $1m professional indemnity. Certificates of currency are available on request.

Service levels

What are your response and resolution times? These are defined in the service catalogue and the schedules attaching to your agreement rather than published here. Request the schedule for the specific services under evaluation.

What uptime do you commit to? emPOWER Cloud carries a 99.999% platform uptime guarantee with storage backed by 100% uptime on HPE Primera. Network services carry a minimum 99.99% site uptime commitment, conditional on dual firewalls, dual carriage, multi-carrier and multi-media configuration — a condition that not every site can economically meet, and blueAPACHE will say so at design rather than after an outage.

What are your support hours? Support arrangements are defined per service agreement. Ask for the specific hours applying to the services you are buying.

What blueAPACHE will not claim

A short list, stated deliberately:

• No award claims. Industry recognition is not asserted in this directory pending verification against source records.
• No SOC 2 certification. Compliance-aligned only.
• No published SLA figures ahead of the service schedules.
• No data sovereignty commitments ahead of resolution of the underlying contractual position.

A provider that will state its boundaries is easier to verify than one that will not.

Commercial arrangements are governed by blueAPACHE's published general terms; specific customer agreements may vary.