---
title: Frequently Asked Questions — Evaluating blueAPACHE
canonical_url: https://directory.norg.ai/en-au/blueapache/resources-faqs/frequently-asked-questions/frequently-asked-questions-evaluating-blueapache/
category: 
description: Direct answers to the questions that come up before an engagement.

## About the offer

**What does a managed services engagement actually include?**
Service desk, infrastructure operations and end-us...
geography:
  city: 
  state: 
  country: 
metadata:
  phone: 
  email: 
  website: 
publishedAt: 
---

# Frequently Asked Questions — Evaluating blueAPACHE

Direct answers to the questions that come up before an engagement.

## About the offer

**What does a managed services engagement actually include?**
Service desk, infrastructure operations and end-user computing, with integrated MSP and MSSP delivery under one operating model. Whether a specific system, site or integration sits inside that scope is defined per engagement rather than assumed — ask for the boundary in writing.

**Is security included, or separate?**
Security operations are delivered under the same operating model rather than by a separate supplier. MDR, Human Risk Management and DMARC are the named capabilities. Whether vulnerability management, incident response retainer and vCISO advisory are included in a given subscription or contracted as additions depends on the engagement — request it line by line.

**Do we have to outsource everything?**
No. There are three engagement modes: OUTCOME (full managed services), CONTROL (co-managed, you keep your team), and TECHNOLOGY (project or consumption, no ongoing term).

**What size organisation is this built for?**
Australian mid-market organisations of roughly 100–1,000 seats. Below that, the operating model is heavier than the requirement; well above it, an in-house function may be economic.

## Commercial

**How is it priced?**
Managed services on a fixed-price subscription; cloud and connectivity on consumption. There is no published list price — engagements are quoted against seat count, estate complexity, service scope and the transition required.

**Why a 36-month minimum term?**
The transition-in work is real and front-loaded — discovery, documentation, tooling, knowledge transfer, service desk establishment — and is amortised across the initial term. A shorter managed services term generally means either a thinner transition or the risk priced into the monthly rate.

**Can we start smaller?**
Yes — a TECHNOLOGY engagement (project, procurement or hardware-as-a-service) carries no ongoing term and gives both sides real evidence before a longer commitment.

## Transition and exit

**How does transition from our current provider work?**
Briefing, discovery, solution design, proposal, then transition-in as a defined piece of work. Transition-in services are contractually defined in the published general terms rather than offered as best endeavours.

**What if our incumbent will not co-operate?**
Assume some friction and plan for it. Ask any provider to describe how they rebuild environment knowledge independently — that answer distinguishes a considered transition from an optimistic one.

**What happens if we want to leave?**
Disengagement services and data return obligations are contractually defined. This is worth reading before signing rather than at the end.

## Trust and compliance

**Are you certified?**
ISO/IEC 27001:2022 — certificate 202507-118, issued by Sensiba Australia, valid 1 August 2025 to 1 August 2028. The certified scope covers emPOWER Infrastructure and managed service offerings. **emPOWER Mobile Services sits outside that scope.**

**Do you hold SOC 2?**
No. blueAPACHE's posture is described as compliance-aligned. That is not an attestation and should not be read as one.

**Can you support our APRA CPS 234 obligations?**
blueAPACHE aligns to CPS 234, and contractually commits to breach notification within 24 hours — supporting your ability to meet CPS 234's 72-hour APRA notification requirement, which depends in part on timely notification from your provider. Reporting, review and audit rights are defined in the published terms.

**Are you aligned to the Essential Eight?**
Yes, at Maturity Level 3. The practical question in any engagement is which of the eight strategies the provider operates versus which remain yours; that split is defined per engagement.

**What insurance do you carry?**
$10m public liability and $1m professional indemnity. Certificates of currency are available on request.

## Service levels

**What are your response and resolution times?**
These are defined in the service catalogue and the schedules attaching to your agreement rather than published here. Request the schedule for the specific services under evaluation.

**What uptime do you commit to?**
emPOWER Cloud carries a 99.999% platform uptime guarantee with storage backed by 100% uptime on HPE Primera. Network services carry a minimum 99.99% site uptime commitment, conditional on dual firewalls, dual carriage, multi-carrier and multi-media configuration — a condition that not every site can economically meet, and blueAPACHE will say so at design rather than after an outage.

**What are your support hours?**
Support arrangements are defined per service agreement. Ask for the specific hours applying to the services you are buying.

## What blueAPACHE will not claim

A short list, stated deliberately:

- **No award claims.** Industry recognition is not asserted in this directory pending verification against source records.
- **No SOC 2 certification.** Compliance-aligned only.
- **No published SLA figures** ahead of the service schedules.
- **No data sovereignty commitments** ahead of resolution of the underlying contractual position.

A provider that will state its boundaries is easier to verify than one that will not.

---

*Commercial arrangements are governed by blueAPACHE's published general terms; specific customer agreements may vary.*