What IT Support Does a Shop Running Global Shop Solutions or JobBOSS Actually Need?

by Brian Ford | Oct 14, 2026 | Informational Articles

A shop running Global Shop Solutions or JobBOSS needs one IT provider that owns everything the ERP sits on top of: the server or the internet connection that reaches the vendor’s cloud, the PCs in the office and on the floor, the network between them, the backups, the calendar for updates, and the security around all of it. The ERP vendor supports the software. Someone has to support what it runs on, and that someone has to pick up the phone when the vendor says “that’s not us.”

If you own or run a shop between Peoria and Bloomington, you have probably lived some version of this. The ERP is slow every afternoon. The vendor says the software is fine. Your IT person says the network is fine. Orders still take twice as long to enter. This post is about closing that gap.

At a glance:

Global Shop Solutions and JobBOSS support their software; neither one supports your server, your PCs, your network, or your backups.

Global Shop Solutions’ own guidance says the ERP should have a server to itself, not one shared with your files and email.

If the ERP runs in the vendor’s cloud, your internet connection becomes the server, and a second connection that takes over automatically is the difference between a hiccup and a lost afternoon.

Vendor cloud security protects the vendor’s platform; the PCs, logins, email, and network that reach the ERP are the shop’s to secure, wherever the ERP runs.

Panorama Consulting’s 2026 ERP Report found more than a quarter of ERP projects ran over budget, most often because of an unexpected need for additional technology.

Facet Technologies supports Central Illinois shops on both systems and takes the vendor call with you when something falls between software and infrastructure.

Who do you call when the ERP breaks?

It depends on what broke, and the time to figure that out is before it happens. An ERP, or enterprise resource planning system, runs quoting, job costing, scheduling, inventory, purchasing, and shipping from one database, so when it misbehaves the whole shop feels it. The vendor’s support line can help with a report that will not run or a module that is acting up. They cannot help with a server that is out of disk space or a switch that died in the back of the plant, and they will tell you so.

The row that matters most is the one where both sides could point at each other. A good IT provider does not make you referee that. They take the vendor call with you, on the same line, until it is resolved.

Why does the ERP get slow every afternoon?

Because something underneath it is too small for the load, and the only honest answer comes from measuring instead of guessing. The vendor will check their software and tell you, correctly, that it is working. The slowdown lives in one of four places: the server, the wiring and switches between the office and the floor, the shared connection your people log into if they work that way, or the PC in front of the person complaining.

The most common cause we see in Central Illinois shops is a server doing too many jobs. The ERP shares a machine with the company files, maybe email, maybe the camera system. At 2 p.m., when shipping runs reports and the office is entering orders, everything on that box fights for the same disk. Global Shop Solutions’ own guidance for the environment it runs in leads with this: the ERP should have a server to itself. Shops skip that to save on hardware, and the savings show up as slow order entry for everyone, every afternoon, for years.

Your IT provider should be watching that server at 2 p.m. when it happens, not asking you to describe it later. Facet monitors client servers around the clock so those numbers already exist. We described how that works in our post on IT monitoring.

Should the ERP be on a server in your building or in the vendor’s cloud?

There is no single right answer, and Central Illinois shops run well both ways. The decision starts with the facts of your situation: how reliable the internet is at the plant, how many shop floor machines talk to the ERP, whether you handle defense or other regulated data, and how old the current server is. Once those are accounted for, it comes down to how you would rather own it, as a server you control in your building or as a monthly service someone else maintains. What changes with the choice is what your IT provider has to protect. JobBOSS² from ECI Software Solutions can run in ECI’s cloud or on a server in your shop. Global Shop Solutions offers an on-premise version and a cloud edition where, according to the company’s Cloud ERP Trust Center, the vendor handles the servers, updates, backups, and monitoring of its platform.

If the server is in your building, it is yours: the hardware, the Windows updates, the backups, and the decision about when to upgrade. Global Shop Solutions says exactly that on its on-premise page. Your IT provider owns all of it on your behalf, and the server should be replaced on a schedule you both agreed to, not when it dies.

If the ERP is in the vendor’s cloud, the vendor owns the server and the backups, and your internet connection becomes the thing everything depends on. A shop with one consumer-grade internet line and no backup connection will lose the ERP every time that line does. The fix is a second connection that takes over on its own, a firewall that makes that switch without anyone noticing, and a plan for what the floor does during a 20-minute outage. Estimators still need working laptops. The far bay still needs Wi-Fi. That part never moves to the cloud.

One owner-level detail about Global Shop Solutions: it stores its data in a database called Actian Zen, which is not the Microsoft database most business software uses. It works well, but it has its own rules for backups and troubleshooting, and an IT provider that has never touched it will guess wrong at least once. Ask yours whether they have worked with it.

Who is responsible for securing the data inside the ERP?

You are, wherever the ERP runs. The vendor secures its software and, if you use its cloud, its servers. Global Shop Solutions’ Trust Center describes multi-factor authentication for cloud access, continuous vulnerability monitoring, and outside penetration testing of its platform. ECI’s Trust Center shows SOC 2 Type II attestation for its hosted services. Both stop at the edge of the vendor’s platform. Neither covers the PC your estimator uses, the password your office manager reuses, the email inbox where the phishing message lands, or the network in your building. For the on-premise version, the vendor’s cloud protections do not apply at all.

Think about what is in that database: every customer, every price you have ever quoted, every drawing, your margins, and often your employees’ personal information. If you supply defense primes, some of it is Controlled Unclassified Information. A stolen login on an unprotected laptop gets all of it, and a SOC 2 badge on the vendor’s data center does nothing to stop that.

Securing the ERP means securing everything that touches it. Every login, including remote access for estimators and salespeople, needs multi-factor authentication, the second step beyond a password that a stolen password alone cannot pass. Every PC that opens the ERP needs protection that catches an attacker already on the machine, not just a virus scanner. Email needs filtering, because that is where the attack arrives. The shop floor machines that cannot be updated need to sit on their own section of the network, away from the server. The server itself, if it is yours, needs to be patched and watched. Those are the layers Facet Technologies builds for every managed client through our security stack, and they are the same layers that satisfy cyber insurance questionnaires and the NIST controls that defense suppliers are self-assessing against.

What happens to the ERP if the server dies or you get hit with ransomware?

You find out whether your backups were real. The ERP database is the one file in the building that cannot be rebuilt from paper, and most shops have never tested restoring it. A backup that has never been restored is a hope.

The IBM 2026 X-Force Threat Intelligence Index ranked manufacturing as the most attacked industry again this year. Ransomware goes after backups first, so the ERP backup needs a copy kept somewhere the attacker cannot reach from your network. Facet Technologies builds backups that way, with instant recovery, so the ERP can be brought back up on a temporary copy of the server within hours while the real one is rebuilt. If you supply defense primes and your ERP holds drawings marked as Controlled Unclassified Information, the backup of that data is CUI too and has to be protected the same way. We covered that in our CMMC guide for manufacturers.

Who decides when the ERP gets updated?

The plant manager, with the IT provider doing the work. Cloud customers get updates on the vendor’s schedule. Shops with their own server choose their own timing, which is a benefit right up until nobody chooses and the server has not been updated in three years.

The update itself is rarely the problem. The order of operations is. The server and every PC that runs the ERP have to be on the same version. One PC gets updated and tested before the other thirty. Windows updates on the server get scheduled so it does not restart itself at 10 a.m. on a Tuesday. Panorama Consulting’s 2026 ERP Report found more than a quarter of ERP projects ran over budget and almost a quarter ran over schedule, and the top budget driver was an unexpected need for additional technology. That is usually a server or a network nobody looked at before the software was bought.

How does Facet Technologies support shops on Global Shop Solutions and JobBOSS?

Facet Technologies has supported Central Illinois manufacturers since 1989, and we support shops on both systems today. Our helpdesk is in our Peoria office, staffed by people who know your network and have been on the Global Shop or ECI support call alongside you before.

If the ERP is on a server in your building, we own the server, its updates, its backups, and the network from the office to the floor. We size the server to the vendor’s guidance, keep it dedicated to the ERP, and test the backup. If the ERP is in the vendor’s cloud, we own the connection: two internet lines, the firewall that switches between them, the PCs, printers, scanners, and the remote access your estimators use from home. Either way, we put the same security around the ERP: multi-factor authentication on every login, protection on every PC that opens it, filtered email, a separated network for the floor, and backups an attacker cannot reach. We schedule updates with your plant manager and take the vendor call when something crosses the line between software and infrastructure.

A server replacement or a move to the cloud is planned and budgeted with you in advance, never dropped on you as a surprise. To see what that looks like when a shop’s environment has been neglected for years, read our manufacturing IT stabilization case study, or start with what manufacturers should look for in an IT partner.

Frequently asked questions

Let’s talk about what your ERP is running on

If your shop runs Global Shop Solutions or JobBOSS and you are not sure who owns the server, the backups, or the update calendar, that is worth a 30-minute conversation. Call (309) 689-3900 or schedule a conversation with Facet Technologies. We will look at what the ERP is sitting on and tell you what is fine, what is aging, and what would keep the floor running on a bad day.

Is CMMC Still Required for Manufacturers After the July 2026 Phase 2 Suspension?

by Brian Ford | Oct 14, 2026 | Informational Articles

Yes. CMMC is still required. On July 13, 2026, the Pentagon suspended only the Phase 2 rollout, the step that would have made third-party C3PAO assessments mandatory for most contracts involving Controlled Unclassified Information starting November 10, 2026. Phase 1 stays in force: NIST SP 800-171 self-assessments, SPRS scores, and annual affirmations continue, and DFARS 252.204-7012 still applies to every contract that carries it. The 60-day reform review that accompanied the suspension has closed, and as of late September its report has not been published.

If you machine parts, supply materials, or provide engineering services to a defense prime from anywhere in Central Illinois, your obligations did not shrink. What changed is the deadline pressure and the question of who verifies your work.

At a glance:

CMMC Phase 2 was suspended on July 13, 2026, and the November 10, 2026 start date for mandatory C3PAO assessments no longer applies.

CMMC Phase 1 remains active, so Level 1 and Level 2 self-assessments, SPRS score postings, and annual affirmations continue in new Department of War solicitations.

NIST SP 800-171 Revision 2 remains the required security standard for any contractor that stores, processes, or transmits Controlled Unclassified Information.

The CMMC Reform Task Force’s 60-day review closed September 11, 2026; its report had not been published as of October 1, and the Pentagon CIO has said it will be made public.

The Small Business Administration reported CMMC certification costs approaching $600,000 for some companies, which is the burden the review was launched to address.

What exactly did the Pentagon suspend in July 2026?

The Department of War, the current name for the Department of Defense, issued two memoranda on July 13, 2026: a Chief Information Officer memo titled “Removing Barriers to Defense Industrial Base Expansion” and an implementing memo from the Under Secretary for Acquisition and Sustainment. Together they pause the advancement to CMMC Phase 2.

Phase 2 was the point where the program moved from trusting your own assessment to requiring someone else’s. A C3PAO, or Certified Third-Party Assessment Organization, is an independent assessor authorized to certify that a contractor has implemented all 110 NIST SP 800-171 controls. Under the original timeline, most contracts involving CUI would have required a C3PAO certification before award beginning November 10, 2026. That requirement is now on hold with no replacement date.

The suspension is also written into contracting rules, not just policy memos. DFARS class deviation 2026-O0025, most recently revised on September 3, 2026, tells contracting officers to leave CMMC’s third-party assessment requirements out of contracts, as Nextgov reported. If a contract you already hold carries a CMMC clause, that clause changes only when a signed modification says it does. Announcements do not amend contracts.

The stated reason for the pause is cost. According to the Wiley law firm’s analysis of the memos, the Small Business Administration reported that CMMC certification costs were approaching $600,000 for individual companies and affecting more than 100,000 small businesses. The department tied the pause to its Acquisition Transformation Strategy, which aims to lower barriers for small and non-traditional suppliers. For a 60-person machine shop in Peoria, that is the right problem to be solving.

What CMMC requirements still apply right now?

Everything in Phase 1. The suspension memos are explicit that self-assessments, SPRS postings, annual affirmations, and the underlying DFARS clauses continue without interruption. Holland & Knight’s summary quotes the guidance directly: “Phase I remains in full effect. Self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev 2 compliance, SPRS score postings and annual affirmations continue without interruption.” The 72-hour cyber incident reporting requirement also stays.

The pieces that still matter:

Federal Contract Information, or FCI, is information generated or provided under a government contract that is not meant for public release, such as pricing, delivery schedules, and contract terms. Handling FCI puts you at Level 1, which requires 15 security practices and a self-assessment.

Controlled Unclassified Information, or CUI, is sensitive but unclassified technical data: engineering drawings, specifications, test results, and anything carrying a CUI marking. Handling CUI puts you at Level 2, which requires all 110 controls from NIST SP 800-171 Revision 2 and a System Security Plan documenting how each one is met.

SPRS, the Supplier Performance Risk System, is the government database where you post your self-assessment score so contracting officers can check it. A Level 2 score is out of 110 and must be affirmed annually by a company official.

A POA&M, or Plan of Action and Milestones, is the documented list of controls you have not finished implementing and the dates you will close them. Level 2 allows conditional status with a score of at least 88 out of 110 and a POA&M closed within 180 days. Level 1 allows no POA&M at all.

None of that changed in July. If your contracts include DFARS 252.204-7012, 7019, 7020, or 7021, those clauses stay binding until the government formally modifies them.

What has the CMMC Reform Task Force said so far?

Direction, not decisions. The 60-day review window closed on September 11, 2026. In July, Pentagon CIO Kirsten Davies told DefenseScoop the task force would take roughly 15 more days after the review to write up recommendations, that the outcome “could include everything from, you know, an overhaul to small tweaks here and there,” and that the report and recommendations would be made public. The head of the Cyber AB, the accreditation body for CMMC assessors, told contractors to expect recommendations in early October. As this update publishes, nothing has been released.

What has been released is the scale of the response. The department’s Request for Information, which closed August 14, drew more than 1,100 responses and over 10,000 pages, plus more than 3,000 attendees at listening sessions, according to Davies’ remarks on September 9. She said more than half of respondents favored putting the program on hold and pursuing reform, that CMMC “was hitting small to medium-sized businesses really, really hard and inappropriately hard,” and that “compliance doesn’t equal security.” Read together, those comments point toward a lighter verification layer for small suppliers and more emphasis on continuous security practice over point-in-time certification.

What is unlikely to change is the NIST SP 800-171 baseline itself. That standard has been a contract requirement under DFARS 252.204-7012 since 2017, long before CMMC existed. CMMC was built as a verification layer on top of it, and the review is about the verification layer. If the task force trims anything for small suppliers, it will trim from the 110, so nothing a manufacturer implements now becomes wasted work.

One wrinkle to watch: a separate proposed rule from the FAR Council, published in June 2026, would require NIST SP 800-171 Revision 3 for CUI on civilian contracts. If it is finalized before CMMC catches up, defense suppliers could face two revisions of the same standard for a while. That is a documentation problem, not a reason to stop implementing controls.

Should a manufacturer keep working toward Level 2 while the program is under review?

Yes, for three reasons that have nothing to do with the CMMC calendar.

First, your prime contractor still has to verify its supply chain, and primes did not stop asking for SPRS scores in July. Primes that wrote CMMC readiness into supplier scorecards before the suspension have no reason to remove them.

Second, the False Claims Act exposure is unchanged. Affirming a SPRS score you have not earned is a false certification to the federal government whether or not a third party ever checks it. On September 1, 2026, the Department of Justice announced a $2,042,518 settlement with Honeywell Aerospace over NIST SP 800-171 controls on a single network between 2020 and 2023, a case that started with a whistleblower, two months into the Phase 2 pause. Self-assessment is now the main enforcement mechanism, which makes the accuracy of your affirmation more important, not less.

Third, the threat to manufacturers does not care what the task force decides. The IBM 2026 X-Force Threat Intelligence Index again ranked manufacturing as the most targeted industry, counted 109 distinct extortion groups in 2025 versus 73 the year before, and found exploitation of public-facing applications up 44 percent as an initial entry point. Supply chain incidents have increased nearly fourfold in five years. The 110 controls exist because those attacks work.

What you can reasonably pause: prepaying for a C3PAO assessment slot, signing a multi-year certification engagement, or buying tooling sized for a November deadline that no longer exists. Keep the controls moving. Hold the certification spend until the task force reports. If a contracting officer or prime tells you a CMMC clause has been removed, ask for the signed modification and keep a copy with your compliance records.

What does a realistic NIST 800-171 timeline look like without a hard deadline?

Most manufacturers need 6 to 12 months to reach full Level 2 implementation, and the suspension is a chance to run that timeline without panic pricing.

Months one and two are assessment: identify which level your contracts require, map where FCI and CUI live, and compare current practice against the 110 controls. Months two through four are planning: prioritize gaps by risk and effort and build a budget. Months four through eight are implementation, where most of the work happens and where manufacturers most often underestimate the effort. Months eight through ten are documentation and testing: finish the System Security Plan, collect evidence, and verify each control works as written. The final stretch is the self-assessment: calculate the score, post it to SPRS, and affirm it.

Shops with an existing security program and decent documentation move faster. Shops starting from a home router and shared passwords, or with a 15-year-old CNC on Windows XP that needs network segmentation and documented compensating controls, may need the full year. We covered the shop-floor side of this in why Central Illinois manufacturers are prime targets. Either way, a current SPRS score built on real controls is what matters now, and it will still matter under whatever the task force recommends.

How does Facet Technologies help Central Illinois manufacturers with CMMC?

Facet Technologies has supported Central Illinois businesses since 1989, including manufacturers across the region who supply components, materials, and services to defense primes. We are not a C3PAO and do not certify anyone. What we do is build and run the security environment that a self-assessment or a future third-party assessment measures.

Our president, Brian Ford, spent years in food manufacturing, where documentation and process control are part of daily operations. That background shapes how we treat CMMC: as an ongoing quality system, not a one-time project.

Our CMMC compliance consulting starts with a gap assessment that follows how data actually moves through your operation rather than comparing policies to a checklist. From there we build a remediation plan sequenced around production schedules, because you cannot shut down the floor to install controls. We deploy and manage the technical layer, including firewalls, endpoint detection, backup isolation, access controls, and 24/7 monitoring through our security stack. We help prepare the System Security Plan, policies, and evidence, and we support you through the SPRS submission or, when the program calls for it again, a C3PAO assessment. Quarterly reviews help maintain your score as the environment changes.

Compliance consulting is billed separately from our managed services agreement, so a manufacturer can engage us for a CMMC gap assessment without changing how day-to-day IT support works. Many defense suppliers also find that cyber insurance requirements and NIST SP 800-171 controls overlap heavily, which lets one project satisfy two audiences.

Frequently Asked Questions

Let’s talk about where your SPRS score stands

If you supply the defense industry from Central Illinois and you are not sure where your SPRS score stands, or whether it is built on controls that would survive an assessor’s questions, now is a good time to find out. The pause bought everyone breathing room. Using it well is the difference between a calm year and a scramble when the new rules land.

Call (309) 689-3900 or schedule a conversation with Facet Technologies. We will walk through your contracts, your data flows, and what a realistic path to a defensible self-assessment looks like for your shop.

Does IT Monitoring Actually Prevent Downtime, or Just Report It After the Fact?

by Ellie Shaw | Aug 10, 2026 | Informational Articles

IT monitoring on its own only reports. Preventing downtime takes three more things: a maintenance schedule that acts on what monitoring finds, a hardware replacement plan, and a person who already knows your network. Facet Technologies treats monitoring as the input, not the product. Here is what that difference is worth to a Central Illinois business.

At a glance: Monitoring by itself reports problems, and preventing them requires a maintenance schedule, a hardware replacement plan, and someone who knows the network. Most published downtime cost averages are skewed by large enterprises, and any business can calculate its own from hourly revenue plus idle payroll. Exploitation of unpatched software was the most common way attackers broke into networks in 2025, at 31% of breaches, according to Verizon’s 2026 Data Breach Investigations Report. Facet Technologies replaces managed firewalls on a three-year cycle so aging hardware gets budgeted instead of discovered during a failure. Facet managed services clients have an on-call technician available 24/7/365, with live phone answering from 8AM to 5PM Monday through Friday.

What does monitoring actually prevent?

By itself, monitoring reports. Three things turn that reporting into prevention.

Alerts set before failure, not at failure. An alert threshold is the point at which a measurement, such as free disk space, triggers a notification to a technician. A threshold set at 95% full tells you about a problem you already have. A threshold set at 80% gives you three weeks to plan.

A standing schedule that acts on the boring findings. Most alerts are not emergencies. A hard drive that has started to fail but has not failed yet. A backup that has been finishing incomplete for nine nights and reporting success anyway. A firewall running software the manufacturer stopped updating. None of those will wake anyone at 2 a.m., and all three will stop a business eventually if nobody works the list.

Someone who knows your environment. Readings only mean something in context. A server using 85% of its memory is normal in one business and the first sign of trouble in another. Judgment is what separates a monitoring tool from network monitoring and maintenance as a practice.

A monitored network of 60 workstations produces thousands of readings a day, and almost all of them mean nothing. Advanced monitoring software makes the first pass, including hardware-level checks that catch a failing component before anyone notices. Our technicians decide what the results actually warrant. When a server or other piece of equipment goes down, a technician is notified, including after hours, when the alert reaches whoever is on call.

What does an hour offline actually cost your business?

More than most owners assume, and less than most vendor statistics claim.

Published averages are worth treating carefully. Many widely quoted figures come from surveys weighted toward companies with thousands of employees, where an hour genuinely runs into six figures. In the 2025 SMB security survey run by ITIC and Calyptix, 8% of the small and midsize businesses surveyed put an hour offline above $25,000. That leaves 92% somewhere below it, which is exactly why an average is the wrong number to plan against.

Your own number is straightforward arithmetic:

1. Revenue per hour. Annual revenue divided by 2,080 working hours.
2. Idle payroll. Headcount affected, multiplied by their loaded hourly cost.
3. Catch-up. The overtime, expedited freight, or rescheduled appointments it takes to recover the work.

A 60-person manufacturer in Central Illinois running $12 million in annual revenue earns roughly $5,800 an hour and carries somewhere near $1,900 an hour in loaded payroll. Four hours with the production floor unable to pull work orders is about $30,000 in exposure before anyone books overtime to catch up. Not all of that revenue disappears, since some orders simply ship later. The payroll does disappear, and it does not come back.

Run those three numbers once. The result turns preventive maintenance from an IT expense into a comparison against what an outage costs.

What does proactive maintenance look like week to week?

Patch management is the scheduled process of testing and applying manufacturer updates to operating systems, applications, and network hardware. It is the least glamorous work in IT and the highest-return.

Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities became the leading way attackers first got into a network, accounting for 31% of breaches, up from 20% the prior year. The same report found that only 26% of the vulnerabilities on the federal Known Exploited Vulnerabilities catalog were fully corrected during 2025, down from 38% a year earlier. A working maintenance rhythm looks roughly like this:

• Daily: confirm backups ran, sort the overnight alerts, review security notifications
• Weekly: deploy tested patches, check storage headroom, look at failed sign-in attempts for signs of someone probing your accounts
• Monthly: update firewall and switch software, review who has access to what
• Quarterly or semiannual: business review covering hardware age, renewal dates, and next year’s budget. Most clients meet quarterly. Some prefer every six months, and we set the rhythm to match how fast the business changes.

That review is the part owners tend to undervalue. Monitoring data is what turns a server replacement from a surprise invoice into a line item you saw coming two quarters out, which is the argument for managed IT services over calling someone after the fact.

How do you know the backups actually work?

A backup job marked “successful” is not the same thing as a backup you can restore from. This is the single most common gap we find when we assess a business arriving from another provider.

Verification means restoring real data to a test location and confirming it opens. It also means confirming the backup covers what everyone assumes it covers, since file storage, databases, and email often sit on three different retention rules nobody has reviewed since setup.

For ransomware, there is one more requirement. Backups reachable from the same network with the same passwords as everything else get encrypted right along with everything else. Backup and instant recovery only counts if the copy survives the event it exists for.

How does monitoring connect to cybersecurity?

Health monitoring asks whether a machine is working. Security monitoring asks whether it is doing something it should not be doing. Both feed the same team, and the second works better when the first has already documented what normal looks like on your network.

Every Facet Technologies managed client gets active threat monitoring. Endpoint protection, security alerting, and technician review cover that baseline, and alerts reach an on-call technician outside business hours. Clients who want analysts watching continuously add managed detection and response, which is a different service from monitoring alone.

Why does a monitored network still have occasional downtime?

Because some failures are only apparent once they happen and the downtime starts. An internet provider outage, a utility failure, a cloud vendor incident, a power supply that fails without degrading first, or an update pushed by a software vendor with access to your systems: none of those give advance notice to anyone.

What a good IT partner controls is not whether anything ever breaks. It is how quickly you hear about it, who owns it, and whether the answer you get is a person or a ticket number. Facet clients on a managed agreement reach a live team member from 8AM to 5PM Monday through Friday and an on-call technician 24/7/365 outside those hours.

The measure of monitoring is fewer preventable outages, faster answers on the ones nobody could have seen coming, and no mystery afterward about the cause.

What should you ask your current IT provider?

Five questions will tell you whether you are buying prevention or notification. None require a technical background, and all five should get a straight answer within a day.

1. When a server goes down at 2 a.m., who gets notified, and what happens next? You are listening for a name and an action, not a description of software.
2. What percentage of our computers are current on security updates right now? A provider doing the work has this number. A provider who has to go find out is telling you something.
3. When did you last restore one of our files from backup to prove the backup works? “The jobs are running” is not an answer to this question.
4. Which of our equipment is past the manufacturer’s support date? Anything on that list cannot be secured, only watched.
5. What should we plan to spend on hardware replacement next year? A partner tracking your environment can answer this in a sentence.

If the answers are vague, the issue usually is not competence. It is that nobody has been asked to think past this week’s tickets.

How does Facet Technologies approach monitoring?

We run a multi-layered monitoring approach rather than relying on a single tool, and we change that stack as better options appear. Alerts route to our in-house helpdesk in Peoria, staffed by technicians who know your environment because they are the same people who built and documented it.

Four pieces of how we operate come directly out of monitoring data:

Hardware gets replaced on a schedule. Managed firewalls are covered as hardware-as-a-service and replaced every three years, so there is no equipment purchase to budget for and no aging appliance protecting your network past the date the manufacturer stopped supporting it.

We hold minimum technology requirements. We do not support operating systems that have reached end of life and no longer receive security updates from the manufacturer. A machine that cannot be patched cannot be secured, and monitoring it only confirms that. We plan those replacements ahead of the end-of-life date rather than after it.

Findings feed planning, not just tickets. Storage trends, device age, and renewal dates go into the strategic review with the client. Projects still happen. They get planned and budgeted ahead of time so they are not surprises.

Repairs stay local. Our staffed repair bench in Peoria means failing hardware gets diagnosed and fixed here rather than shipped and waited on.

Facet Technologies keeps your systems running, your data secure, and your compliance requirements documented, backed by a local Peoria team that answers the phone and owns the result. That is what we mean by True Tech Peace of Mind.

Frequently Asked Questions

Let’s Talk About What Your Network Is Telling You

If you are not sure whether your current setup is being watched or only reported on, we will look at it with you. The assessment is free. Facet Technologies has served businesses across Peoria and Central Illinois since 1989.

Call (309) 689-3900 or reach us at facettech.com/contact-us.

How Much Do Managed IT Services Cost in Peoria?

by Ellie Shaw | Jul 24, 2026 | Informational Articles

Most businesses in the Peoria area pay between $100 and $200 per user per month for fully managed IT services, and most land in the lower half of that range. The figure is not a flat rate applied to everyone. It is the output of a handful of specific factors: how many users and devices you have, what security your industry requires, how much of your operation runs in the cloud, and how many locations you cover. Understanding those factors is the difference between a price that looks arbitrary and one that makes sense. This article walks through what actually goes into a managed IT quote, so you can read any provider’s number, including ours, and know what you are looking at.

At a glance: Fully managed IT services in the Peoria area typically run $100 to $200 per user per month, with most businesses landing in the lower half of that range. The top of the range is usually reached only by businesses with heavy security or compliance needs. A managed IT price is the output of specific factors: user and device counts, security requirements, cloud usage, and number of locations. Cloud storage and cloud infrastructure can change the monthly number as your usage changes. Physical security appliances like firewalls are priced by location, not headcount, so multi-site businesses should expect that to shape the quote. Co-managed arrangements typically cost less than fully managed service for a business of the same size, because the provider covers only part of the work. Compliance consulting for frameworks like HIPAA or CMMC is billed separately and is not included in the managed services fee. A trustworthy provider discloses upcoming project costs, like an aging server, before you sign, so nothing arrives as a surprise.

Most providers keep pricing off their site, usually because every client is different and they would rather have the conversation first. There’s some truth to that, but most buyers just want a straight answer to a fair question. Here is ours.

This page assumes you have already decided you want a managed IT provider and you want to know what it costs. If you are still weighing whether an MSP is worth it compared to hourly or break/fix support, start with our break/fix versus managed IT comparison instead. If you are comparing the cost of an MSP against hiring someone in-house, our managed IT versus in-house staff breakdown has the salary math.

What Is the Price Range for Managed IT in Peoria?

For a fully managed arrangement, where a provider acts as your complete IT department, most Central Illinois businesses pay $100 to $200 per user per month, and most land in the lower half of that range. We rarely quote under $100 per user, and the top is typically reached by businesses with heavy security or compliance requirements rather than the average office. Some environments, like shops where several people share equipment, are counted per workstation instead, in the same range.

National pricing guides often quote wider ranges, anywhere from $100 to $400 per user, but those figures pull in expensive coastal markets. Managed IT pricing tracks local wages and cost of living, so a New York or San Francisco business pays far more than a Central Illinois one for the same service. Peoria’s lower cost of living is a large part of why our market sits at the lower end of the national spread.

That monthly fee is the flat, predictable foundation of the relationship. It covers the day-to-day work of running your technology: a staffed help desk that answers live, monitoring of your network and systems, patching and updates, security tools, backup management, and regular strategic reviews, quarterly or twice a year depending on your preference. The idea behind flat-rate managed services is simple: you should know what IT costs each month, and the model gives your provider a reason to keep your systems healthy rather than profit when they break.

What Goes Into a Managed IT Quote?

A managed IT quote is built from a handful of inputs. Once you see them, the number stops looking arbitrary and starts looking like arithmetic. Here are the factors that shape it, roughly in the order they matter.

Users and devices. This is the foundation, and it’s where user-count-only pricing goes wrong. A per-user figure works cleanly for an office where everyone has a laptop and a phone. It works less well for a manufacturer where 25 shop-floor workers share a handful of terminals. Two 40-person companies can need very different amounts of support, so a flat per-user price overcharges one and undercharges the other, and the undercharged business usually discovers the gap later as add-on costs. At Facet, we count both users and devices, and you won’t be penalized for having more of one than the other. When comparing quotes, it’s worth asking each provider what their price is based on, and what falls outside it.

Security requirements. A business handling protected health information, defense contract data, or financial records needs more than baseline security: advanced monitoring, stricter access controls, and additional tooling. Our cybersecurity services scale to match those requirements, and the monthly price scales with them. This is one of the most common reasons a business lands toward the top of the range. Note that compliance consulting is a separate matter, covered below.

Cloud usage. Cloud servers, virtual desktops, and large amounts of cloud-stored data carry their own monthly costs, and those can change as your usage grows or shrinks. A business with terabytes of data in the cloud will see that reflected in its monthly number, and a business that adds cloud infrastructure mid-contract will see the price adjust to match. A good provider is upfront about this from the start, so cloud growth never reads as a mystery charge.

Firewalls and hardware. A firewall is a physical security appliance, and it’s priced by location, not headcount. A ten-person business with three sites needs three firewalls; a fifty-person business under one roof needs one. Whether you rent or own your equipment matters here too, for firewalls and workstations alike. A managed firewall arrangement builds the appliance, its maintenance, and its replacement on a three-year cycle into the monthly fee, while owned equipment shifts those costs to periodic purchases. Neither approach is wrong, but they show up differently on a quote, and multi-location businesses should expect the location count to shape the number more than the user count does.

Special circumstances. Every business has something unusual about it: a line-of-business application that needs specific care, multiple locations, seasonal staff, equipment with unusual requirements. These don’t always change the price, but they belong in the conversation before a quote is final. Any provider who doesn’t ask about them is planning to find out later, at your expense.

How Is Co-Managed IT Priced?

Co-managed arrangements, where we work alongside your internal IT staff, typically run less per user/workstation than fully managed because we cover a portion of the work rather than all of it. The range is wide because these engagements are built so differently from one another.

One co-managed client may license security tools through us and handle everything else internally. Another may keep help desk in-house and rely on us for after-hours coverage, projects, and security. Another may need us for one location while their internal team covers the rest. Because the division of labor varies so much, so does the price, and a per-user figure means very little until the roles are defined. If you have internal IT and want to see how the model works, our co-managed IT page explains how the arrangements typically work.

What Costs Should You Expect Beyond the Monthly Fee?

Projects. Most businesses will have some project costs over the life of an IT relationship, and you should be suspicious of any provider who implies otherwise. Servers age out. Networks need refreshes. Offices move. Software gets migrated. These are normal, and they’re separate from the monthly managed services fee.

The difference between providers is not whether projects happen. It is whether you see them coming. There is a practice in this industry we think is indefensible: a provider shows up at contract renewal and announces that your server is end-of-life, must be replaced within the month, and will cost tens of thousands of dollars. The problem was visible for years. It was simply not mentioned until the moment it created maximum pressure.

We handle it the opposite way. If a server project or anything like it is on the horizon, we tell you before you sign, and we plan it into your budget through regular strategic reviews so the cost arrives on a schedule you chose. You will likely have project costs with us, the same as with anyone. Our aim is that none of them ever arrive as a surprise. That commitment to planning ahead is a large part of why clients stay with us for over a decade on average.

Two things sit outside the managed services fee and are worth naming directly. Compliance consulting, the advisory work of getting a business ready for HIPAA, CMMC, PCI, or a similar framework, is a separate line item, not part of the managed number, though some cybersecurity tools may be included in your monthly fee. The range in this article assumes a business without a heavy compliance-consulting need. And in rare cases, a large, tangled environment that isn’t well documented may need a scoping project to map what’s there before an accurate quote is possible. For the large majority of businesses this never comes up, and the assessment itself is always free.

How Do You Get an Accurate Quote?

Through a free assessment of your actual environment. Before we quote, we look at your systems, count what’s really there, ask about your security and compliance obligations, and flag anything on the horizon, including problems you didn’t know about. We tell you what we find whether you hire us or not, at no charge. The monthly range in this article is the price for a business that knows what it has and can show us in that assessment, without heavy compliance-consulting or other advanced needs. When those conditions hold, and they usually do, the number lands in the range and stays there, because it reflects your real environment rather than an estimate that gets corrected after you sign. It is also why we won’t give a final price over the phone.

Frequently Asked Questions

Get a Real Number for Your Business

The exact number depends on your environment, and finding it takes a conversation.

Facet Technologies has served Central Illinois businesses from Peoria since 1989. Call (309) 689-3900 or reach us through facettech.com/contact-us to schedule a free assessment and get a quote built on your actual environment.

Cyber Treats: Phishing Vultures and the World of Re-Scams

by Ellie Shaw | Jul 23, 2026 | Informational Articles

Subscribe to Cyber Treats: https://facettech.com/cybertreats/

Fun fact: Sticky Keys, one of the oldest accessibility tools in computing, was invented twice: once at a lab at the University of Wisconsin, and once by a programmer fed up with his stiff IBM keyboard. The lab’s version shipped with Macintosh System 6’s Easy Access bundle, and PC Magazine published STAYDOWN in April 1988, the same month.

Phishing Vultures and the World of Re-Scams

Getting scammed is bad enough. What could be worse? The FBI answered this week by issuing a warning: “recovery scams.”

Scammers find recent fraud victims, sometimes because they ran the original scam themselves, sometimes by lurking in social media support groups. Many created fake persona profiles and joined groups for financial fraud victims, posing as fellow victims before steering people toward the fake “recovery” contact.

Either way, someone claiming to be an FBI agent reaches out with good news: your money has been recovered, or can be, if you click this link or pay this fee.

The “polish” behind these attempts is what’s new. Some victims saw AI-generated videos of a real, senior FBI official directing them to file a complaint on a lookalike version of the FBI’s Internet Crime Complaint Center (IC3) website. Some received messages from profiles impersonating the IC3 or FBI.

The fake site collects your name, phone number, email, and how much you lost, then hands you a reference number and promises follow-up. The follow-up is the next round of the scam: a malicious link, a request for your bank details to “process the return,” or a fee to release your “recovered funds.”

Here’s how to spot it (worth sharing with anyone you know who’s been hit by fraud):

• The IC3 has no social media accounts, so any profile claiming to represent it is fake, and no legitimate FBI account will ever DM you about recovering money.
• The FBI never asks for payment to recover lost funds. “We found your money, small fee required” is always a scam.
• Type www.ic3.gov directly into your address bar and skip sponsored search results, which are often paid imitators.
• Real follow-up on an FBI complaint comes from a local field office, not a DM.

This playbook shows up in the business world too. After a company loses money to wire fraud or a compromised email account, “recovery specialists” tend to come calling. Work only with your bank, actual law enforcement, and your IT provider.

Had a security incident, or want to prevent one?

Call us at (309) 689-3900 for a complementary cybersecurity assessment and harden your defenses.

Facet out and about and in the news:

Facet Senior Account Executive Trey David was featured in a WMBD story about new phishing techniques. Check it out here!

On July 19, Jason, Marie, and Trey beat the heat at Five Points Washington’s Annual Golf Outing supporting Five Points Memory Makers Cafe, a social program for individuals living with memory loss and their caregivers. We were proud to sponsor this event for a great cause!

Now Available On-Demand: AI-Fluent Leader Sessions 1-6

The AI Fluent Leaders Series resumes August 19.

In the meantime, you can catch up on our previous sessions and be ready to join for Session 7!

What Does the Federal AI Framework Recommend for Businesses Adopting AI?

by Ellie Shaw | Jun 26, 2026 | Informational Articles

The federal government has a published blueprint for adopting AI safely, and the structure is refreshingly clear. The NIST AI Risk Management Framework organizes responsible AI adoption around four jobs: govern it, map where it lives, measure how it performs, and manage the risks over time. The framework tells you what good looks like. Doing all four well, across a real business with real data, is the part that takes serious work.

At a glance: The NIST AI Risk Management Framework is the leading U.S. guidance for adopting AI responsibly, built around four functions: Govern, Map, Measure, and Manage. NIST guidance is voluntary, but enterprise buyers, cyber insurers, and regulators increasingly treat alignment with it as the baseline expectation. A 2026 Compliance Week survey found that 83% of organizations use AI tools while only 25% have a strong governance framework around that use. Building and maintaining AI governance and security is an ongoing program, not a one-time setup, and it spans your data, your tools, your policies, and your people. Facet Technologies delivers this same structure as a managed service through its SAFE approach, so businesses get enterprise-grade AI security without building the capability themselves.

NIST is the National Institute of Standards and Technology, a U.S. Department of Commerce agency that writes the technical standards much of American business already runs on, including the cybersecurity framework many companies use today. When NIST publishes guidance on AI, it carries weight.

What Is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework, often shortened to the AI RMF, is a voluntary set of guidelines that helps any organization identify, assess, and manage the risks that come with using AI. NIST released version 1.0 in January 2023 and has continued to expand it since, including a profile specifically for generative AI tools like ChatGPT and Microsoft Copilot.

The framework is built to be flexible. It does not hand you a rigid list of rules to pass or fail. Instead, it gives you four functions to work through, and you apply them at whatever depth matches your business. A 25-person manufacturer in Central Illinois follows the same four functions as a national bank, just scaled to fit the size of the risk.

Flexible does not mean easy. Working through all four functions means inventorying every place AI touches your data, locking down file permissions, writing and enforcing policy, vetting tools, and monitoring it all as your usage grows and the tools change month to month. Adopting the framework is an ongoing program, not a one-time project you finish and file away. Large enterprises staff entire teams for exactly this work.

What Are the Four Functions of the NIST AI Framework?

The NIST AI framework is built on four functions that work together: Govern, Map, Measure, and Manage. Each one answers a different question about how AI runs inside your business.

Govern is the foundation. It sets the culture, the policies, and the clear ownership for how AI gets used. Govern is the cross-cutting function, which means it runs through everything else rather than sitting as a separate step. In plain terms, govern answers: who decides what AI we use, and what are the rules?

Map is about knowing where AI actually lives in your operation. That includes the tools your team chose on their own, often without telling anyone. Map answers: where is AI being used, and what could go wrong with each use?

Measure is how you check that AI is doing what you expect. It covers testing, watching for errors, and keeping an eye on whether a tool drifts off course over time. Measure answers: is this working the way we think it is?

Manage is the response. It covers prioritizing the real risks, putting controls in place, and having a plan for when something goes sideways. Manage answers: what do we do about the risks we found?

You do not have to run these in strict order, and most businesses cycle through them again and again as their AI use grows. Govern comes first because it sets the rules. After that, the work loops.

Why Should a Central Illinois Business Care About a Voluntary Framework?

The NIST AI framework is voluntary, which means no law forces you to follow it. So why bother? Because the people you do business with are starting to expect it.

Three pressures are converging. Enterprise customers now build AI governance questions into the security questionnaires they send vendors, so a business without a documented approach can face longer sales cycles and extra due diligence. Cyber insurance underwriters are writing AI-specific terms into policies, and showing a structured approach helps maintain your standing at renewal. And regulators increasingly point to the NIST framework as the reference point for what responsible AI looks like.

The gap is striking. A 2026 Compliance Week survey found that 83% of organizations are already using AI tools, but only 25% have a strong governance framework around that use. Most businesses are already exposed; few have built the structure to manage it.

For a business owner, the takeaway is simple. Following a recognized framework is how you show a customer, an insurer, or an auditor that your AI use is deliberate rather than accidental. It is the difference between “our team uses some AI tools” and “here is how we govern AI.” This is the same principle behind zero trust security: structure and verification beat assumption.

How Does This Connect to Shadow AI?

Shadow AI is the use of AI tools by employees without company approval or oversight. It is the single most common gap the NIST framework helps you close, and it maps directly to the Govern and Map functions.

Here is how it happens. Someone pastes customer data into a free chatbot to draft emails faster. Someone else uploads a spreadsheet to summarize it. None of it is malicious, and most of it even improves productivity, but none of it is visible. You cannot protect data you do not know is leaving the building.

That is what the Map function is for: knowing where AI is actually being used before you can secure it. A clear acceptable-use policy is part of the answer, since giving people approved tools is what stops them from reaching for risky ones. The same dynamic drives shadow IT risk more broadly, and the fix is the same: visibility first, then guardrails.

There is a second half to the Map problem that catches even careful businesses off guard. A tool like Microsoft Copilot does not browse the way a person does. It searches every file an employee’s account can reach, including places that account has never actually opened. For decades, sensitive files stayed safe partly because nobody knew where to look. AI erases that protection in seconds. The 2025 Concentric AI Data Risk Report found that 16% of business-critical files are overshared across the average organization, more than 800,000 files per company. Facet’s cybersecurity for AI readiness work closes that gap by tightening file access and permissions, so AI enables your team without exposing your data.

What Makes Facet’s Approach Different?

Most of the AI conversation right now is about speed. Adopt faster, automate more, get ahead. That part matters, and we believe in it. But speed without security is how companies end up explaining a data leak to their biggest customer. Facet Technologies built its approach the other way around: secure first, then fast.

We call our managed approach to AI adoption the Facet SAFE approach. We run the govern, map, measure, and manage work for you, sized for a company that does not have a dedicated risk department and does not want to build one. You get the outcome NIST describes without assigning the project to someone on your staff.

That security focus is not a bolt-on. Facet Technologies is a managed IT and cybersecurity provider first, which means we look at every AI tool the way we look at every other piece of technology touching your data: what does it access, where does that data go, and who is watching it. A lot of providers have moved into AI enablement recently. Far fewer come at it from a security-first foundation, with a 24/7 Security Operations Center and layered protection already in place behind the work. That foundation is the difference between someone telling you what the framework says and someone actually implementing it across your environment.

The economics tend to favor bringing in a partner, too. A single overshared dataset reaching the wrong AI tool can undo far more value than a year of managed security costs, and building the capability internally pulls leadership and IT off revenue work for months. A managed engagement turns an open-ended internal project into a predictable monthly cost, with people who do this every day accountable for the outcome.

We meet businesses at two points. The AI Fluent Leaders webinar series, hosted by Brian Ford and Ellie Shaw, is our free education on-ramp. It helps leaders understand AI well enough to make good decisions, with no cost and no pitch. When you are ready to actually secure and govern AI across your business, the SAFE engagement is where we take that off your plate. The AI readiness assessment bridges the two: it scores your business across six areas, from strategy to security, and gives you a clear picture of where you stand and what implementing this would involve, before you commit to anything.

What Should a Business Do First?

A few early moves help you get oriented, and they cost nothing but attention. Name one person as the owner of AI decisions, even if that is the owner, so the topic has a home. Ask your team, plainly and without blame, which AI tools they are already using and for what. Write down a short ground rule everyone can follow today: which tools are approved, and what kinds of data should never go into a public AI tool. Those three moves give you a rough map of where you stand.

What they do not do is finish the job. That early map almost always surfaces more than expected, like the overshared files mentioned earlier, and closing those gaps is where the real work begins: tightening permissions across your environment, vetting and configuring tools, building enforceable policy, and monitoring it all as your AI use grows. This is genuine data governance, the kind of detailed, environment-wide work that specialized teams handle full time. Getting it right across an entire business is a substantial, ongoing engagement, not a weekend project.

That is the honest dividing line. The orientation steps you can take yourself this week. The full build is where most businesses bring in a partner, because doing it properly the first time is faster, safer, and less expensive than discovering the gaps after something has already gone wrong. Facet’s AI readiness assessment is the simplest way to see both at once: where you stand today, and what the full engagement would actually involve.

FAQ

Ready to Adopt AI Without Building the Capability Yourself?

You do not have to choose between moving fast and staying secure, and you do not have to build the whole program in-house to get there. The fastest path is to see where you stand, then let a team that does this every day handle the rest. Start with Facet’s AI readiness assessment for a clear picture, or reach out to talk through what securing AI across your business would look like.

Call Facet Technologies at (309) 689-3900 or visit facettech.com/contact-us to talk through what safe, practical AI adoption looks like for your business in Peoria and across Central Illinois.

Cyber Treats: Five Shortcuts You’ll Use Again and Again

by Ellie Shaw | Jun 25, 2026 | Informational Articles

Want more Cyber Treats? https://facettech.com/cybertreats/

Wishing all our readers a Happy (early!) 4th of July on this semiquincentennial!

Five Tech Tips Guaranteed to Save You Time

Before you log off for next weekend’s festivities or a summer vacation, save these five useful keyboard shortcuts.

1. Drop in a symbol, emoji or GIF → Win + . (period)

Opens a little picker in any text field. Great for the ° or ™ you always need, or adding a little ✨pizazz✨.

2. Rename a File Instantly → Fn + F2

Select a file and press Fn + F2 — the name highlights, ready to retype. Bonus: after you rename one, press Tab to jump straight to the next file. Great for cleaning up a folder full of “Scan_001, Scan_002.”

3. Screenshot precisely with Snipping Tool → Win + Shift + S or PrtSc (Windows 11 Update)

Drag a box around any part of your screen and it copies, ready to paste into an email or chat. No more full-screen capture and crop. On Windows 11, the PrtSc button also opens the Snipping Tool by default.

4. Snap two windows side by side → Win + Arrow

Press Win + ← to shove the active window to the left half. Windows then offers up your other open windows for the right half. Just arrow-key to the one you want and hit Enter. No mouse required!

5. Lock your screen in one move → Win + L

Stepping away from your desk? One keystroke locks it. This one’s a freebie from the security side of the house. It’s a small habit that provides real protection.

Need guidance on cybersecurity measures or reliable IT support? Reach out at (309) 689-3900 to book time with us to go over your strategy.

There’s Still Time: Sign Up for AI Fluent Leaders: Session 6

How SMBs Can Move Faster Than the Competition Using AI

Your competition has more people, more budget, and more time than you do. The good news: smart AI use can flip that math. Smart SMBs are using it to move faster than companies many times their size, and in this session we’ll show you exactly how, sharing the tips and tricks we use ourselves. 

This session will cover:

• How to get found by buyers and AI search without a big marketing team
• Real examples of the grunt work we’ve handed off to AI, and what it gave us back
• Why small teams have the speed advantage, and how small wins compound into a real edge
• Where to point AI next, so you’re positioned for what’s coming

At just 45 minutes (30 minute presentation + 15 minute Q&A), this one’s going to provide huge value and lots of ideas for your team.

Don’t miss it: Wednesday, July 1 at 10am CST.

Register Now

Want more Cyber Treats? https://facettech.com/cybertreats/