Standards

Version: v2025.2
Effective date: 01 JAN 2025
Last updated: 20 JAN 2026

What this page is

This page sets out the standards we use to deliver Managed Services safely and consistently.

This page contains two parts:

• Supportability Standards (hardware, operating systems, commonly supported software)

• Security Standards (Minimum Security Controls and how exceptions are handled)

If this page is referenced in your agreement or Work Order, it forms part of the service operating standard. If there is a conflict, your signed agreement or Work Order takes priority.

1) Supportability Standards

Hardware

General

• We may choose not to support devices that are more than 5 years old.

PCs

• Must be 5 years old or newer, or covered by an extended warranty or other vendor support.

• Must meet at least: Intel Core i5 (or equivalent), 16GB RAM, 250GB SSD.

• Must include a 3 year warranty with onsite parts and labour, with next business day response where available.

Servers

• Must have an active warranty including onsite labour and replacement parts, with next business day response where available.

Networking equipment

• Must be vendor supported (firmware updates are still published).

• Switching must be gigabit capable.

UPS (uninterruptible power supplies)

• Network switches, firewalls, routers, wireless access points, and phone systems must be on at least a basic UPS.

• Servers must be on an online UPS with UPS monitoring configured.

• UPS units must be tested annually and batteries replaced on a regular cycle, typically every 2 to 3 years.

• UPS devices should be replaced every 5 to 10 years depending on performance and warranty.

Printers and copiers

• Multi-function printers must have an active support agreement or managed print provider.

• We do not provide hardware support for printers. We will work with your managed print provider or a reputable printer technician to resolve printer hardware issues.

2) Operating systems

• Devices must run an operating system that is supported by the vendor.

• Managed patching is available only for Microsoft or Apple operating systems.

3) Commonly supported software

This is a non-exhaustive list of software we commonly support. It is not a guarantee that every configuration or edition is supported, and it does not approve or authorise the use of software that conflicts with your internal policies, licensing obligations, or compliance requirements.

• Line of business applications with an active vendor support agreement

• Adobe Reader

• Adobe Acrobat

• Dropbox

• Google Chrome

• Microsoft Edge

• Microsoft Office suite

• Mozilla Firefox

• Optimus agent and security software

• Slack

• Zoom

4) Security Standards

Minimum Security Controls

Minimum Security Controls are the minimum baseline required for Optimus to provide Managed Services without limitation.

If your environment does not meet a Minimum Security Control:

• we will tell you what is missing and why it matters

• we will recommend a remediation plan

• we will record the exception using either an Exception Record or a Waiver depending on risk

Minimum Security Controls list

Identity and access

• MFA enabled for all user accounts where available, and always for admin or privileged access.

• Leavers access removed or disabled promptly.

Devices and patching

• Supported operating systems for devices that access business data or services.

• Security updates applied regularly for operating systems and common applications.

• Endpoint protection active on managed endpoints.

Backups and recovery

• Business-critical data has a current backup where the business expects recovery to be possible.

• Backup responsibility is clearly assigned as either Customer-managed or Supplier-managed.

Remote access and perimeter

• Remote access is protected by MFA and secure configuration.

• No insecure remote management services are exposed to the internet unless explicitly approved.

User awareness

• Users receive basic security awareness guidance, either via Optimus provided training (if included) or Customer provided training.

Recommended security controls

These controls are strongly recommended but are not mandatory unless stated in a Work Order or required due to risk.

• Stronger email security controls

• Device management and baseline configuration policies

• Privileged access improvements such as separate admin accounts, tighter role assignment, and admin activity review

• Backup immutability for higher-risk environments

5) Exceptions and waivers

Security Exception Record

Used when the exception is:

• time-bound, or

• limited scope, or

• a recommended control is declined

The Exception Record can be included in a quote, Work Order, or email, and must include a clear acknowledgement.

Security Limitation Waiver

Used when a Minimum Security Control is not met and the gap is material or ongoing.

This is a standalone document that is signed, including by electronic signature.

6) Updates and change log

We may update these standards to reflect changes in technology and risk. Each update will include a version number, effective date, and a short change log.

Change log

v2025.1 [01 Jan 2025]

• Published hardware and software standards.

v2025.2 [03 Jan 2026]

• Published combined Supportability Standards and Security Standards.