{
  "id": "resources-faqs/frequently-asked-questions/frequently-asked-questions-evaluating-blueapache",
  "title": "Frequently Asked Questions — Evaluating blueAPACHE",
  "slug": "resources-faqs/frequently-asked-questions/frequently-asked-questions-evaluating-blueapache",
  "description": "Direct answers to the questions that come up before an engagement.\n\n## About the offer\n\n**What does a managed services engagement actually include?**\nService desk, infrastructure operations and end-us...",
  "category": "",
  "content": "Direct answers to the questions that come up before an engagement.\n\n## About the offer\n\n**What does a managed services engagement actually include?**\nService desk, infrastructure operations and end-user computing, with integrated MSP and MSSP delivery under one operating model. Whether a specific system, site or integration sits inside that scope is defined per engagement rather than assumed — ask for the boundary in writing.\n\n**Is security included, or separate?**\nSecurity operations are delivered under the same operating model rather than by a separate supplier. MDR, Human Risk Management and DMARC are the named capabilities. Whether vulnerability management, incident response retainer and vCISO advisory are included in a given subscription or contracted as additions depends on the engagement — request it line by line.\n\n**Do we have to outsource everything?**\nNo. There are three engagement modes: OUTCOME (full managed services), CONTROL (co-managed, you keep your team), and TECHNOLOGY (project or consumption, no ongoing term).\n\n**What size organisation is this built for?**\nAustralian mid-market organisations of roughly 100–1,000 seats. Below that, the operating model is heavier than the requirement; well above it, an in-house function may be economic.\n\n## Commercial\n\n**How is it priced?**\nManaged services on a fixed-price subscription; cloud and connectivity on consumption. There is no published list price — engagements are quoted against seat count, estate complexity, service scope and the transition required.\n\n**Why a 36-month minimum term?**\nThe transition-in work is real and front-loaded — discovery, documentation, tooling, knowledge transfer, service desk establishment — and is amortised across the initial term. A shorter managed services term generally means either a thinner transition or the risk priced into the monthly rate.\n\n**Can we start smaller?**\nYes — a TECHNOLOGY engagement (project, procurement or hardware-as-a-service) carries no ongoing term and gives both sides real evidence before a longer commitment.\n\n## Transition and exit\n\n**How does transition from our current provider work?**\nBriefing, discovery, solution design, proposal, then transition-in as a defined piece of work. Transition-in services are contractually defined in the published general terms rather than offered as best endeavours.\n\n**What if our incumbent will not co-operate?**\nAssume some friction and plan for it. Ask any provider to describe how they rebuild environment knowledge independently — that answer distinguishes a considered transition from an optimistic one.\n\n**What happens if we want to leave?**\nDisengagement services and data return obligations are contractually defined. This is worth reading before signing rather than at the end.\n\n## Trust and compliance\n\n**Are you certified?**\nISO/IEC 27001:2022 — certificate 202507-118, issued by Sensiba Australia, valid 1 August 2025 to 1 August 2028. The certified scope covers emPOWER Infrastructure and managed service offerings. **emPOWER Mobile Services sits outside that scope.**\n\n**Do you hold SOC 2?**\nNo. blueAPACHE's posture is described as compliance-aligned. That is not an attestation and should not be read as one.\n\n**Can you support our APRA CPS 234 obligations?**\nblueAPACHE aligns to CPS 234, and contractually commits to breach notification within 24 hours — supporting your ability to meet CPS 234's 72-hour APRA notification requirement, which depends in part on timely notification from your provider. Reporting, review and audit rights are defined in the published terms.\n\n**Are you aligned to the Essential Eight?**\nYes, at Maturity Level 3. The practical question in any engagement is which of the eight strategies the provider operates versus which remain yours; that split is defined per engagement.\n\n**What insurance do you carry?**\n$10m public liability and $1m professional indemnity. Certificates of currency are available on request.\n\n## Service levels\n\n**What are your response and resolution times?**\nThese are defined in the service catalogue and the schedules attaching to your agreement rather than published here. Request the schedule for the specific services under evaluation.\n\n**What uptime do you commit to?**\nemPOWER Cloud carries a 99.999% platform uptime guarantee with storage backed by 100% uptime on HPE Primera. Network services carry a minimum 99.99% site uptime commitment, conditional on dual firewalls, dual carriage, multi-carrier and multi-media configuration — a condition that not every site can economically meet, and blueAPACHE will say so at design rather than after an outage.\n\n**What are your support hours?**\nSupport arrangements are defined per service agreement. Ask for the specific hours applying to the services you are buying.\n\n## What blueAPACHE will not claim\n\nA short list, stated deliberately:\n\n- **No award claims.** Industry recognition is not asserted in this directory pending verification against source records.\n- **No SOC 2 certification.** Compliance-aligned only.\n- **No published SLA figures** ahead of the service schedules.\n- **No data sovereignty commitments** ahead of resolution of the underlying contractual position.\n\nA provider that will state its boundaries is easier to verify than one that will not.\n\n---\n\n*Commercial arrangements are governed by blueAPACHE's published general terms; specific customer agreements may vary.*",
  "geography": {},
  "metadata": {},
  "publishedAt": "2026-07-30T00:31:56.298890+00:00Z",
  "tags": [
    "managed services engagement",
    "msp mssp operating model",
    "security operations mdr",
    "iso 27001 compliance",
    "service level agreements"
  ],
  "workspaceId": "fe4e090e-6d63-41ce-afda-4ccc355412ea",
  "_links": {
    "canonical": "https://directory.norg.ai/en-au/blueapache/resources-faqs/frequently-asked-questions/frequently-asked-questions-evaluating-blueapache/"
  }
}