How Much Do Managed IT Services Cost for a Mortgage Company?

The Short Answer

For a small mortgage company in Phoenix, a properly scoped managed IT program typically runs approximately $200–$250 per user per month as a planning range. That figure reflects the security controls and compliance posture that GLBA and the FTC Safeguards Rule require. It is not a guaranteed quote, and it does not include Microsoft 365 licensing, hardware, one-time projects, or migrations — those are always separate line items.

A five-person mortgage shop, for example, should plan for roughly $1,000–$1,250 per month for managed IT services, before licensing and other costs. A 20-person lender should plan for approximately $4,000–$5,000 per month for the same service tier.

This article explains what drives that price, what is actually included, what is not, and how to evaluate any Managed Service Provider (MSP) offer you receive.

Why Mortgage Company IT Has a Higher Floor Than Generic Small-Business IT

Most generic small-business managed IT starts around $100–$200 per user per month. Mortgage lending sits closer to the top of that range and often above it, for three concrete reasons.

• Regulated data. Borrower financial records, loan files, Social Security numbers, income documentation, and credit reports are all non-public personal information (NPI) under GLBA. The FTC Safeguards Rule (16 CFR Part 314) mandates specific technical controls: encryption, multi-factor authentication, access controls, audit logging, a written information security program, and periodic risk assessments. Those controls cost money to implement and operate correctly.
• Operational fragility. A mortgage transaction depends on a chain of technology: the loan origination system (LOS), internet connectivity, Microsoft 365 email, e-signature platforms, credit-pull integrations, and borrower-facing document portals. When any link in that chain fails during a rate-lock window or the day before closing, the cost is not just an IT inconvenience — it is a delayed or lost loan.
• Third-party scrutiny. Larger lenders, warehouse lines, and state regulators increasingly ask smaller brokers and lenders to demonstrate their security posture. An underdocumented IT environment creates risk at the business relationship level, not just the compliance level.

A lower-priced managed IT program that does not address these realities is not a bargain. It is a different, narrower scope of operational responsibility — and the work that is not included does not disappear. It either gets done by someone else or it does not get done at all.

What the $200–$250 Per User Rate Actually Covers

The planning range reflects a fully scoped managed IT program that carries day-to-day operational responsibility for the following areas. This is not a product list. Each item represents recurring work that has to be performed consistently — not just software installed and left running.

1. Endpoint Management and Security

Every laptop and desktop used by loan officers, processors, and support staff is monitored, patched, encrypted, and protected. This includes:

• Endpoint Detection and Response (EDR): continuous behavioral monitoring that catches threats that signature-based antivirus misses, including the ability to isolate a device that is actively compromised.
• Managed Detection and Response (MDR): a live Security Operations Center that triages alerts around the clock, so a credential-theft attempt at midnight does not go unnoticed until your staff arrives in the morning.
• Full-disk encryption on every device, so a stolen laptop does not become a reportable breach.
• Automated patching of operating systems and applications, closing the known vulnerabilities attackers actively exploit.
• Application controls that limit what software can run and what approved applications are permitted to do — stopping ransomware and unauthorized executables before they execute.

2. Microsoft 365 Security and Administration

Microsoft 365 is the productivity backbone of almost every mortgage operation — email, Teams, OneDrive, SharePoint. Microsoft keeps the platform running, but securing what is inside it, and managing it correctly, is a separate ongoing responsibility.

• Identity Threat Detection and Response (ITDR): monitoring Microsoft 365 accounts for compromised logins, impossible-travel sign-ins, and unauthorized account changes — catching an attacker who has stolen a password before they reach borrower files or wire-transfer instructions.
• Advanced email protection: filtering beyond spam, catching business email compromise (BEC) attempts, impersonation, and weaponized attachments — the attack type most likely to intercept a wire transfer in a mortgage transaction.
• Data Loss Prevention (DLP): policy controls that flag or block NPI leaving the environment improperly, whether by accident or by a malicious insider.
• Microsoft 365 backup: an independent copy of email, OneDrive, SharePoint, and Teams content. Microsoft does not fully protect this data from deletion, ransomware, or corruption. A separate backup is what stands between a firm and permanent loss.
• Security baseline configuration and periodic review of settings, permissions, and sharing policies.

3. Helpdesk Support

Business-hours helpdesk for day-to-day user support: software issues, connectivity problems, account lockouts, printer failures, and every other technical interruption that pulls a loan officer away from a borrower. Helpdesk is business-hours coverage. Monitoring and incident response run 24/7/365 — those are different functions, and "24/7 helpdesk" is not a claim Onsite Technical Services makes.

4. Backup and Recovery

Backup is not the outcome. The outcome is recovering loan files, LOS data, and email history quickly enough that a closing is not missed. That means backup is tested, recovery is documented, and someone is responsible for verifying it regularly. The managed program covers both computer-level backup and Microsoft 365 content backup as part of the included scope.

5. Security Awareness Training

People are the most-targeted part of any organization, and mortgage staff are specifically targeted because of the financial transactions they handle. Recurring training and realistic simulated phishing campaigns build the habits that reduce the likelihood of a business email compromise succeeding. This is an included operational responsibility, not an optional add-on.

What Is Not Included in the Per-User Rate

These items are always billed separately, regardless of firm size or configuration:

• Microsoft 365 licensing. Licensed on Microsoft's terms, passed through at cost, and itemized as its own line. The per-user managed IT rate does not absorb this.
• Network management. Firewall, switch, and wireless access-point management is a separate line item. It is never bundled into the per-user Standard rate. A lender with a managed office network will see this as an additional monthly charge.
• Hardware. Laptops, workstations, servers, and network equipment are purchased separately.
• One-time projects. New-office setup, LOS migrations, infrastructure upgrades, and compliance remediation work are scoped and billed as projects, not absorbed into recurring managed services.
• Third-party software and LOS licensing. The managed IT program supports your LOS — it does not license it. Vendor relationships and LOS contracts remain the client's responsibility.

The 5-Part Keep Borrowers Moving Framework

When evaluating managed IT for a mortgage operation, the right question is not only "what does it cost?" — it is "what happens when something breaks, and does the MSP's scope cover the things that stop loans from moving?" This framework maps the answer.

Part 1: Identify the Technology That Can Stop a Loan From Moving

Map your actual dependencies: LOS availability, internet connectivity, Microsoft 365 and email, e-signature platform access, credit-pull integrations, borrower-facing document portals, and the endpoints your staff use daily. Every link in that chain is a potential failure point. A managed IT program worth the cost has a documented answer for what happens when each one fails.

Part 2: Monitor Problems Before They Become Closing Problems

Monitoring means something breaks at 11 p.m. and an alert fires — not that a processor discovers a downed system at 8 a.m. on closing day. Endpoint monitoring, patch compliance tracking, identity monitoring, and network alerting are the early-warning system that converts potential disasters into manageable tickets.

Part 3: Build Security Without Creating Operational Bottlenecks

GLBA and the FTC Safeguards Rule require multi-factor authentication, access controls, encryption, and audit logging. Implemented carelessly, these controls create friction that slows loan officers and processors. Implemented correctly, they protect borrower data without adding meaningful daily friction. The difference is in how the controls are configured and who is responsible for maintaining them. This is where the operational-responsibility question matters most: a provider that installs MFA and walks away is not managing it. A provider that owns the configuration, monitors for authentication anomalies, and handles exceptions is.

Part 4: Make Backup and Recovery Part of the Lending Continuity Plan

Backup protects three specific categories in a mortgage operation: loan files and LOS data, Microsoft 365 content (email threads, borrower communications, disclosures), and endpoint data. The question to ask any MSP is not "do you back it up?" but "who tests recovery, how often, and what is the documented process when a restore is needed?" An untested backup is not a recovery plan.

Part 5: Define Who Owns Each Ongoing Responsibility

The most common failure mode in small-firm managed IT is not that tools are absent — it is that responsibilities are unclear. When a loan officer's Microsoft 365 account shows a suspicious login at 2 a.m., who sees the alert? Who decides whether to terminate the session? Who notifies the principal? A well-scoped managed IT program answers all of these questions in writing before a problem occurs. If your current or prospective MSP cannot answer these questions clearly, that is your answer about the quality of the program.

Pricing Example: A 12-Person Mortgage Brokerage

Assumptions: 12 users, office in the Greater Phoenix area, managed office network (firewall, switch, wireless), Microsoft 365 Business Premium licensing (licensed separately), no current LOS migration needed.

This is a planning example, not a quote. The per-user figure is the approved planning range for a GLBA-regulated environment. Network management pricing spans a wide range because it depends on who owns the equipment: if the firm already owns its firewall, switches, and access points and OTS provides maintenance and monitoring (with SIEM added where compliance requires it), the range runs approximately $50–$200 per month per location. If OTS supplies the hardware and subscriptions along with SIEM, the range runs approximately $150–$400 per month per site. Actual pricing depends on scope, architecture, existing infrastructure condition, and other factors reviewed during an engagement scoping conversation.

What Drives the Price Up or Down

Several factors shift the actual monthly figure within or outside the planning range:

• User count. The per-user rate is the primary driver of recurring cost. Fewer users means the fixed overhead of maintaining a secure environment is spread across fewer billable units, which can push the effective per-user cost higher for very small firms.
• Infrastructure complexity. Multiple office locations, aging network equipment, or an LOS with complex integration requirements increase the management load and may affect scoping.
• Existing security posture. A firm starting from a well-configured baseline requires less remediation work upfront. A firm with years of accumulated configuration drift, unpatched systems, or no current MFA enforcement will typically have project work required before or alongside the managed program.
• Regulatory documentation requirements. A written information security program (WISP or equivalent), periodic risk assessments, and vendor due-diligence documentation are GLBA requirements. The managed IT program provides operational evidence and technical controls that support these requirements — but the program itself does not write the WISP or serve as the compliance consultant. Compliance program responsibility stays with the firm and any compliance advisor it retains.

What to Ask Any MSP Before Signing

These questions cut through marketing language and reveal the actual scope of operational responsibility:

1. What is explicitly included in the monthly rate, and what requires a separate statement of work or project quote?
2. Is network management (firewall, switch, wireless) included in the per-user rate, or billed separately?
3. Who monitors Microsoft 365 identity alerts, and what is the escalation process when an account shows a suspicious login?
4. How is backup tested, who is responsible for verifying recovery, and what is the documented process when a restore is needed?
5. What does business-hours helpdesk coverage mean specifically, and what is the after-hours process for an incident during a closing?
6. How does your program support the technical safeguard requirements under the FTC Safeguards Rule, and what documentation does it produce?

A provider that cannot answer these questions specifically — with written scope language — is telling you something important about how they operate.

Managed IT and GLBA: What the Technology Program Covers and What It Does Not

The FTC Safeguards Rule requires mortgage lenders to implement and maintain a comprehensive information security program. A properly scoped managed IT program covers the technical safeguards that program requires: encryption, multi-factor authentication, access controls, monitoring, patching, audit logging, and backup. It also produces the operational documentation (change records, alert logs, patching reports) that supports a periodic risk assessment and regulatory inquiry.

What it does not do: write the information security program document itself, serve as your designated qualified individual, perform the required annual risk assessment as a compliance function, or make compliance decisions on your firm's behalf. Those responsibilities belong to the firm's leadership and any compliance advisor or attorney retained for that purpose. Onsite Technical Services operates the technical environment. Compliance program ownership stays with you.

Is a Managed IT Program Worth the Cost for a Small Mortgage Shop?

Consider what a breach or extended outage actually costs a small lender. A ransomware event during peak production season does not just produce an IT bill — it stops loan production, exposes borrower NPI, triggers FTC breach notification obligations (within 30 days for 500 or more affected consumers), and can draw state regulatory attention. For a five-person shop, a week of downtime is not an inconvenience — it is potentially a month of lost production on top of remediation costs.

The managed IT program does not eliminate risk. No program does. What it does is put the controls, monitoring, and documented operational responsibility in place so that problems are caught earlier, contained faster, and recovered from with less production loss. For a mortgage operation that runs on narrow timelines and borrower trust, that difference is operationally significant.

Frequently Asked Questions

Does a five-person mortgage company need managed IT services?

Yes, if it handles borrower NPI — and nearly every mortgage operation does. GLBA and the FTC Safeguards Rule apply regardless of firm size. At five users, the planning math runs approximately $1,000–$1,250 per month for the managed IT program, before Microsoft 365 licensing and network management. That is not a trivial expense for a small firm, but compare it to the cost of a ransomware recovery, a wire-transfer fraud event from a compromised email account, or a regulatory inquiry following a breach.

Is Microsoft 365 backup included in managed IT services?

It should be, and at Onsite Technical Services it is included in the managed program scope. Microsoft does not fully back up Microsoft 365 content — email, OneDrive, SharePoint, and Teams data can be deleted, corrupted, or encrypted by ransomware without a recoverable copy unless an independent backup is in place. For a mortgage firm, that includes borrower communications, loan disclosures, and e-signed documents. Confirm with any provider whether M365 backup is included or requires a separate line item.

What is the difference between business-hours helpdesk and 24/7 monitoring?

Helpdesk — the live support line your loan officers call when something is not working — operates during business hours. Monitoring and incident response operate around the clock. This means a server alert, a ransomware behavior trigger, or a suspicious Microsoft 365 login at 2 a.m. fires an alert and receives a response from a Security Operations Center, even if no one is in the office. The distinction matters for mortgage operations: closings and rate locks do not always happen during business hours, and the threats targeting mortgage firms definitely do not.

Does a managed IT program make my mortgage company GLBA compliant?

No. A managed IT program implements and operates the technical safeguards that the FTC Safeguards Rule requires — encryption, multi-factor authentication, access controls, monitoring, patching, audit logging, and backup. But the compliance program itself — including the written information security program, the annual risk assessment, designation of a qualified individual, and vendor oversight — is the firm's responsibility. Onsite Technical Services operates the technical environment; the firm and any compliance advisor it retains own the compliance program.

Is network management (firewall, switch, wireless) included in the per-user monthly rate?

No. Network management is always a separate line item and is never bundled into the per-user Standard Managed Services rate, regardless of firm size or configuration. Pricing depends on scope: if the firm owns its firewall, switches, and access points and OTS provides maintenance and monitoring, the range runs approximately $50–$200 per month per location. If OTS also supplies the hardware and subscriptions, along with SIEM where compliance requires it, the range runs approximately $150–$400 per month per site. Ask any MSP explicitly whether network management is included or separate, and which ownership model applies, before comparing proposals.

Book a Consult