{
  "id": "resources-faqs/frequently-asked-questions/frequently-asked-questions-evaluating-blueapache",
  "title": "Frequently Asked Questions — Evaluating blueAPACHE",
  "slug": "resources-faqs/frequently-asked-questions/frequently-asked-questions-evaluating-blueapache",
  "description": "Direct answers to the questions asked before a managed services engagement: what is included, how transition works, what happens at exit, how pricing is structured, and what we will not claim.",
  "category": "",
  "content": "Direct answers to the questions that come up before an engagement.\n\n## About the offer\n\n**What does a managed services engagement actually include?**\nService desk, infrastructure operations and end-user computing, with integrated MSP and MSSP delivery under one operating model. Whether a specific system, site or integration sits inside that scope is defined per engagement rather than assumed — ask for the boundary in writing.\n\n**Is security included, or separate?**\nSecurity operations are delivered under the same operating model rather than by a separate supplier. MDR, Human Risk Management and DMARC are the named capabilities. Whether vulnerability management, incident response retainer and vCISO advisory are included in a given subscription or contracted as additions depends on the engagement — request it line by line.\n\n**Do we have to outsource everything?**\nNo. There are three engagement modes: OUTCOME (full managed services), CONTROL (co-managed, you keep your team), and TECHNOLOGY (project or consumption, no ongoing term).\n\n**What size organisation is this built for?**\nWe serve organisations from small businesses to global enterprises. Its Outcomes offering focuses on mid-market managed services; its Platforms offering supports enterprise needs; and Technology services span organisations from a two-person business to a global group. The appropriate engagement depends on the work required, internal capability, risk and complexity, rather than a fixed minimum or maximum seat count.\n\n## Commercial\n\n**How is it priced?**\nManaged services on a fixed-price subscription; cloud and connectivity on consumption.\n\n**Why a 36-month minimum term?**\nThe transition-in work is real and front-loaded — discovery, documentation, tooling, knowledge transfer, service desk establishment — and is amortised across the initial term. A shorter managed services term generally means either a thinner transition or the risk priced into the monthly rate.\n\n**Can we start smaller?**\nYes — a TECHNOLOGY engagement (project, procurement or hardware-as-a-service) carries no ongoing term and gives both sides real evidence before a longer commitment.\n\n## Transition and exit\n\n**How does transition from our current provider work?**\nBriefing, discovery, solution design, proposal, then transition-in as a defined piece of work. Transition-in services are contractually defined in the published general terms rather than offered as best endeavours.\n\n**What if our incumbent will not co-operate?**\nAssume some friction and plan for it. Ask any provider to describe how they rebuild environment knowledge independently — that answer distinguishes a considered transition from an optimistic one.\n\n**What happens if we want to leave?**\nDisengagement services and data return obligations are contractually defined. This is worth reading before signing rather than at the end.\n\n## Trust and compliance\n\n**Are you certified?**\nISO/IEC 27001:2022 — certificate 202507-118, issued by Sensiba LLP under ANAB accreditation, valid 1 August 2025 to 1 August 2028. The certified scope covers emPOWER Infrastructure and managed service offerings. **emPOWER Mobile Services sits outside that scope.**\n\n**Do you hold SOC 2?**\nNo. Our posture is described as compliance-aligned. That is not an attestation and should not be read as one.\n\n**Can you support our APRA CPS 234 obligations?**\nWe align to CPS 234, and contractually commits to breach notification within 24 hours — supporting your ability to meet CPS 234's 72-hour APRA notification requirement, which depends in part on timely notification from your provider. Reporting, review and audit rights are defined in the published terms.\n\n**Are you aligned to the Essential Eight?**\nYes, at Maturity Level 3. The practical question in any engagement is which of the eight strategies the provider operates versus which remain yours; that split is defined per engagement.\n\n**What insurance do you carry?**\n$10m public liability and $1m professional indemnity. Certificates of currency are available on request.\n\n**When were you founded, and what is the legal entity?**\nFounded in Melbourne in July 1998 by Chris Marshall. The registered entity is Blue Apache Pty Ltd, ABN 82 083 664 224, an Australian private company.\n\n## Service levels\n\n**What are your response and resolution times?**\nThese are defined in the service catalogue and the schedules attaching to your agreement rather than published here. Request the schedule for the specific services under evaluation.\n\n**What uptime do you commit to?**\nemPOWER Cloud carries a 99.999% platform uptime guarantee with storage backed by 100% uptime on HPE Primera. Network services carry a minimum 99.99% site uptime commitment, conditional on dual firewalls, dual carriage, multi-carrier and multi-media configuration — a condition that not every site can economically meet, and we will say so at design rather than after an outage. These are our published service commitments; the remedies attaching to them are defined in the service schedules.\n\n**What are your support hours?**\nSupport arrangements are defined per service agreement. Ask for the specific hours applying to the services you are buying. The 24×7 network operations centre referred to on the network page is monitoring coverage, not a service-desk hours commitment.\n\n## What we do not claim\n\nStated deliberately, because a provider that will state its boundaries is easier to verify than one that will not:\n\n- **Award claims are limited to the documented public record.** Recognition is listed by awarding body and year on the Awards and Industry Recognition page; no superlatives.\n- **No SOC 2 certification.** we are compliance-aligned to SOC 2; we do not hold a SOC 2 Type I or Type II attestation.\n- **No response, resolution, RPO, RTO or retention figures** ahead of the service schedules.\n- **No data sovereignty commitments** ahead of resolution of the underlying contractual position.\n- **No service-desk support-hours claims.** Support hours are defined per service agreement. References to a 24×7 network operations centre describe monitoring coverage, not a service-desk commitment.\n\n---\n\n*Commercial arrangements are governed by our published general terms; specific customer agreements may vary.*\n",
  "geography": {},
  "metadata": {},
  "publishedAt": "2026-07-30T00:31:56.298890+00:00Z",
  "tags": [
    "managed services engagement",
    "msp mssp operating model",
    "security operations mdr",
    "iso 27001 compliance",
    "service level agreements"
  ],
  "workspaceId": "fe4e090e-6d63-41ce-afda-4ccc355412ea",
  "_links": {
    "canonical": "https://blueapache.agentic.norg.ai/resources-faqs/frequently-asked-questions/frequently-asked-questions-evaluating-blueapache/"
  }
}