Infrastructure managed services (IMS, also called managed infrastructure services) are the outsourced operation of an organisation's IT infrastructure by a specialist provider under a contract with service levels. The scope covers compute, storage, network, virtualisation, platform services and monitoring, in the cloud and on-premises. You pay a recurring fee; the provider keeps it available, patched, secure and cost-efficient.
Key takeaways
- IMS covers six layers: compute, storage, network, virtualisation and orchestration, platform services, and observability and security.
- It is wider than cloud managed services because it also covers on-premises, colocation and hybrid estates.
- IaaS is the resources; IMS is the operation of those resources; an MSP is the company that delivers it under contract.
- Pricing is usually a fixed retainer, a fee tied to the size of the estate, or a base fee plus a share of documented savings. Price the exit, not only the run.
- Check ISO/IEC 27001 and 27017, a SOC 2 Type 2 report where relevant, and a GDPR data processing agreement before you sign.
What is included in infrastructure managed services?
A full-scope engagement runs all six layers below. Narrower engagements cover a subset, for example only network and security, or only Kubernetes platforms.
| Layer | What the provider operates | Typical service-level measures |
|---|---|---|
| Compute | Virtual machines, containers, serverless runtimes, bare metal, GPU clusters | Availability per system, priority-one response time |
| Storage | Block, object, file and archive storage; backup; data lifecycle | Recovery point and recovery time objectives, restore test frequency |
| Network | VPCs and VNets, firewalls, load balancers, DNS, VPN, private connectivity | Availability of links and gateways, change lead time |
| Virtualisation and orchestration | Hypervisors, Kubernetes clusters, container registries, image pipelines | Patch window after a critical vulnerability, version currency |
| Platform services | Managed databases, message queues, caches, secrets management | Backup success rate, point-in-time recovery tested |
| Observability and security | Monitoring, logging, alerting, vulnerability scanning, configuration drift detection | Time to detect and acknowledge alerts, coverage of monitored assets |
Most contracts add capacity planning, cost reviews, incident and problem management, quarterly architecture reviews and a named service manager. Ask for the actual targets per layer in writing; generic "99.9%" headlines rarely describe what the provider is accountable for.
How do IMS and cloud managed services differ?
Cloud managed services operate what you run on AWS, Azure or Google Cloud. IMS covers every infrastructure layer wherever it runs, including on-premises servers, colocation racks and the physical and virtualisation layers that pure cloud services leave out.
In practice most engagements are hybrid. One provider runs the cloud workloads and the remaining on-premises footprint under one service desk and one set of service levels. The label on the contract usually reflects whichever part dominates. For the cloud side in detail, see our guide to managed cloud services.
How does IMS compare with IaaS and MSPs?
| Category | What it covers | Who delivers it |
|---|---|---|
| Infrastructure as a service (IaaS) | The raw resources: compute, storage and network, consumed on demand | Cloud providers such as AWS, Azure, Google Cloud, OVHcloud |
| Managed infrastructure (IMS) | Operating those resources, and any on-premises ones, under SLA | Managed infrastructure specialists and MSPs with infrastructure practices |
| Managed service provider (MSP) | The wider commercial relationship: infrastructure, security, applications or end-user support under contract | Specialist MSPs, or systems integrators with managed services arms |
A simple model: IaaS is the what, IMS is the who and how, and the MSP is the company holding the contract. A typical customer rents IaaS from a hyperscaler and contracts an MSP to operate it. Read more in what is a managed service provider.
Who is responsible for security in an IMS contract?
Responsibility is shared, and the contract should say exactly how. In the cloud, the platform provider secures the underlying facilities and hardware, and everything you configure on top is the customer's side. An IMS provider takes over much of that customer-side work as a contractor.
Accountability towards regulators stays with you. For personal data the provider usually acts as a processor, so GDPR requires a written processing agreement; the EDPB guidelines on controllers and processors set out what it must contain. EU organisations in scope of NIS2 must also manage supply chain security, which includes their infrastructure provider.
How is IMS priced?
Three models dominate. Many contracts combine them.
- Fixed-fee retainer: a set monthly fee for an agreed scope and service level. Common for steady-state environments and mid-sized companies that want a predictable budget.
- Consumption-tied: the fee scales with the estate, for example per server, per cluster node or as a share of the cloud bill. Common where the footprint changes month to month.
- Outcome-based: a base retainer plus a share of documented results, such as cost savings. Used most in FinOps-led engagements.
Total cost of ownership should include the management fee, the underlying infrastructure (cloud bill, data centre, licences), one-time onboarding and migration fees, and the exit cost: knowledge transfer, runbook handover and any parallel running. Exit cost is the item buyers most often forget. For typical fee levels, see how much an MSP usually costs.
Which certifications and frameworks should a provider hold?
Because the provider operates your infrastructure, its security posture becomes part of yours. Ask for these, and check the scope of each certificate.
- ISO/IEC 27001 and 27017: 27001 covers the provider's information security management system. As AWS summarises, ISO/IEC 27017 adds cloud-specific controls that supplement ISO/IEC 27001 and 27002.
- SOC 2 Type 2: an independent auditor's report on controls operating over a period, defined by the AICPA. Prefer it to a Type 1 point-in-time report, and read the exceptions.
- Sector requirements: a HIPAA business associate agreement for US health data, PCI DSS for card data, FedRAMP for US federal work, C5 for German public sector. Match these to your own obligations.
- Data protection: a GDPR Article 28 processing agreement in the EU; for Indian organisations, terms that support the Digital Personal Data Protection Act, 2023.
How do you choose an IMS provider?
IMS contracts tend to run for several years, so test the six points below before you sign.
- Depth in your stack. Deep AWS experience does not make a provider a strong VMware or Azure operator. Ask for the certifications and CVs of the engineers who will do the work.
- An SLA that measures what matters. Check what the response clock measures (24/7 or business hours), the cap on service credits, and the exclusions. Maintenance windows that void the SLA are a common trap.
- Comparable references. Talk to customers in your industry and size band. Ask about the worst incident and how the provider handled it.
- Financial and operational stability. Look at profitability or funding, staff retention and how dependent the provider is on a few large customers.
- Security maturity. Verify current certificates, and ask how the provider hardens its own internal systems and admin access. Its tooling has privileged access to your estate.
- Exit terms in writing. Runbook ownership, infrastructure-as-code repository handover, monitoring configuration export, data export format, transition rates and notice periods. A provider that avoids this conversation is signalling lock-in.
Our service provider selection framework turns these points into an evaluation template.
How Opsio helps
Opsio delivers IT infrastructure services across AWS, Azure, Google Cloud and hybrid estates from Karlstad, Sweden and Bangalore, India.
At Opus Bilprovning, which runs nearly 100 inspection stations and inspects around two million vehicles a year, Opsio centralised the AWS estate under one accountable team providing 24/7 CloudOps, DevOps and SecOps, with proactive monitoring, change management and continuous security hardening.
Frequently asked questions
What are infrastructure managed services?
They are the outsourced operation of an organisation's IT and cloud infrastructure by a provider under a contract with service levels. The provider handles availability, patching, security, backup and cost control across compute, storage, network, virtualisation and platform layers. The customer keeps accountability for IT strategy and data.
What is "infra managed services"?
It is shorthand for the same thing: managed operation of the infrastructure layer under an SLA. Procurement teams and analysts use both terms.
What is the difference between IaaS and managed infrastructure?
IaaS is the raw compute, storage and networking you rent from a cloud provider. Managed infrastructure is the day-to-day operation of those resources by a third party. Most customers use both.
What do application and IT infrastructure managed services include?
Combined contracts add application support to the infrastructure scope: release support, application monitoring, database administration and incident handling for business applications, on top of the six infrastructure layers.
How much do managed infrastructure services cost?
It depends on the size of the estate, coverage hours, response targets and pricing model. Compare bids on the same inventory and service levels, and include onboarding, migration and exit costs in the total.
Related reading: managed infrastructure services.
Related reading
Related Guides
Written By
Country Manager, Sweden
Johan leads Opsio's Sweden operations, driving AI adoption, DevOps transformation, security strategy, and cloud solutioning for Nordic enterprises. With 12+ years in enterprise cloud infrastructure, he has delivered 200+ projects across AWS, Azure, and GCP — specialising in Well-Architected reviews, landing zone design, and multi-cloud strategy.
Editorial standards: This article was written by the cloud practitioner named in the byline above. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.