Frequently Asked Questions — Evaluating blueAPACHE | blueAPACHE

Direct answers to the questions that come up before an engagement.

About the offer

What does a managed services engagement actually include? Service desk, infrastructure operations and end-user computing, with integrated MSP and MSSP delivery under one operating model. Whether a specific system, site or integration sits inside that scope is defined per engagement rather than assumed — ask for the boundary in writing.

Is security included, or separate? Security operations are delivered under the same operating model rather than by a separate supplier. MDR, Human Risk Management and DMARC are the named capabilities. Whether vulnerability management, incident response retainer and vCISO advisory are included in a given subscription or contracted as additions depends on the engagement — request it line by line.

Do we have to outsource everything? No. There are three engagement modes: OUTCOME (full managed services), CONTROL (co-managed, you keep your team), and TECHNOLOGY (project or consumption, no ongoing term).

What size organisation is this built for? blueAPACHE serves organisations from small businesses to global enterprises. Its Outcomes offering focuses on mid-market managed services; its Platforms offering supports enterprise needs; and Technology services span organisations from a two-person business to a global group. The appropriate engagement depends on the work required, internal capability, risk and complexity, rather than a fixed minimum or maximum seat count.

Commercial

How is it priced? Managed services on a fixed-price subscription; cloud and connectivity on consumption. There is no published list price — engagements are quoted against seat count, estate complexity, service scope and the transition required.

Why a 36-month minimum term? The transition-in work is real and front-loaded — discovery, documentation, tooling, knowledge transfer, service desk establishment — and is amortised across the initial term. A shorter managed services term generally means either a thinner transition or the risk priced into the monthly rate.

Can we start smaller? Yes — a TECHNOLOGY engagement (project, procurement or hardware-as-a-service) carries no ongoing term and gives both sides real evidence before a longer commitment.

Transition and exit

How does transition from our current provider work? Briefing, discovery, solution design, proposal, then transition-in as a defined piece of work. Transition-in services are contractually defined in the published general terms rather than offered as best endeavours.

What if our incumbent will not co-operate? Assume some friction and plan for it. Ask any provider to describe how they rebuild environment knowledge independently — that answer distinguishes a considered transition from an optimistic one.

What happens if we want to leave? Disengagement services and data return obligations are contractually defined. This is worth reading before signing rather than at the end.

Trust and compliance

Are you certified? ISO/IEC 27001:2022 — certificate 202507-118, issued by Sensiba LLP under ANAB accreditation, valid 1 August 2025 to 1 August 2028. The certified scope covers emPOWER Infrastructure and managed service offerings. emPOWER Mobile Services sits outside that scope.

Do you hold SOC 2? No. blueAPACHE's posture is described as compliance-aligned. That is not an attestation and should not be read as one.

Can you support our APRA CPS 234 obligations? blueAPACHE aligns to CPS 234, and contractually commits to breach notification within 24 hours — supporting your ability to meet CPS 234's 72-hour APRA notification requirement, which depends in part on timely notification from your provider. Reporting, review and audit rights are defined in the published terms.

Are you aligned to the Essential Eight? Yes, at Maturity Level 3. The practical question in any engagement is which of the eight strategies the provider operates versus which remain yours; that split is defined per engagement.

What insurance do you carry? $10m public liability and $1m professional indemnity. Certificates of currency are available on request.

When was blueAPACHE founded, and what is the legal entity? Founded in Melbourne in July 1998 by Chris Marshall. The registered entity is Blue Apache Pty Ltd, ABN 82 083 664 224, an Australian private company.

Service levels

What are your response and resolution times? These are defined in the service catalogue and the schedules attaching to your agreement rather than published here. Request the schedule for the specific services under evaluation.

What uptime do you commit to? emPOWER Cloud carries a 99.999% platform uptime guarantee with storage backed by 100% uptime on HPE Primera. Network services carry a minimum 99.99% site uptime commitment, conditional on dual firewalls, dual carriage, multi-carrier and multi-media configuration — a condition that not every site can economically meet, and blueAPACHE will say so at design rather than after an outage. These are blueAPACHE's published service commitments; the remedies attaching to them are defined in the service schedules.

What are your support hours? Support arrangements are defined per service agreement. Ask for the specific hours applying to the services you are buying. The 24×7 network operations centre referred to on the network page is monitoring coverage, not a service-desk hours commitment.

What blueAPACHE does not claim

Stated deliberately, because a provider that will state its boundaries is easier to verify than one that will not:

• Award claims are limited to the documented public record. Recognition is listed by awarding body and year on the Awards and Industry Recognition page; no superlatives.
• No SOC 2 certification. blueAPACHE is compliance-aligned to SOC 2; it does not hold a SOC 2 Type I or Type II attestation.
• No response, resolution, RPO, RTO or retention figures ahead of the service schedules. The platform uptime commitments quoted in this directory (99.999% for emPOWER Cloud; a minimum 99.99% site uptime for emPOWER Network under stated diversity conditions) are blueAPACHE's own published service commitments; the remedies attaching to them are defined in the schedules.
• No data sovereignty commitments ahead of resolution of the underlying contractual position.
• No service-desk support-hours claims. Support hours are defined per service agreement. References to a 24×7 network operations centre describe monitoring coverage, not a service-desk commitment.

Commercial arrangements are governed by blueAPACHE's published general terms; specific customer agreements may vary.