Network MSP onboarding
Every Edge plan runs the same way, whether it is a single-site clinic or a multi-site operator. You talk to the engineer who does the work. Nothing changes on your network until you have seen the plan. You get the same report every month. And you can leave with your documentation in hand. This page is the whole process, so there is nothing to discover later. It starts with a 30-minute call and, if we fit, a fixed-price Network Risk Assessment from $3,500.
Updated October 21, 2026
The sequence
Typical calendar for a single site. Multi-site and regulated environments run the same steps over a longer window.
Day 0 · 30 minutes
You describe the environment and the issue or project you need help with. We tell you whether we are the right fit, and if we are not, who might be. No slides. If it is a fit, we scope the assessment on the call and quote the fixed price.
About 2 weeks · $3,500 single small site, prepaid
Read-only review of firewall, switches, Wi-Fi, remote access, IP addressing and monitoring, plus a 7-day utilization capture and a walkthrough with whoever runs the office. We do not change anything during an assessment, with one exception: if there is no backup of your firewall configuration, we export one to encrypted storage and give you the key. The fee is prepaid; part or all of it is credited if you sign an Edge plan or Edge Firewall Managed within 60 days of the readout. The report, diagram and plan are yours to keep whether or not you continue. Larger networks are priced on the assessment pricing page.
Day 10 to 12 · 60 minutes
You receive the written Network Health Report: inventory with vendor support dates, topology, ranked findings with severity and effort, and a 30/60/90-day roadmap with budget ranges. We walk through it with you. The report is yours whether or not you continue. Here is what one looks like (PDF).
Week 3 · your decision
If you want the work done, you get a fixed-price statement of work for the fixes you pick (a firewall migration starts at $6,500, or from $8,900 for the 100F–200F class or an HA pair, for example), and a managed plan from $695 per site per month if you want ongoing coverage. Each is a separate decision. You can do the critical fixes with us and nothing else. That is fine.
Weeks 3 to 8 · scheduled with you
Fixes run in agreed change windows, usually evenings or weekends, each with a written change plan and a rollback. Monitoring is usually live within the first week after you hand over access. We stand it up with a small, secure connector that lets us reach your gear remotely, and a private status dashboard for you at your own address on ambioedge.com. Credentials go into a vault, not a spreadsheet. You get a kickoff email, a dashboard walkthrough, and a 15-minute call if you want it.
Every month
Automated monitoring watches every managed device and link; a human responds Monday to Friday, 8 AM to 5 PM Pacific. You receive a monthly service summary on the first business day: uptime, incidents, changes made, trends, and what we recommend next. Silence between summaries means everything is fine. Within 14 days we ask for a second contact at your company so there is always someone we can reach. At six months we review whether the plan still fits.
Admin access to your firewall, switches and access points, or the name of whoever holds it. Your ISP account details and escalation contacts; if you want us opening ISP tickets, add us as an authorized contact on the account. Any existing network diagrams, however old. And the names of the people who can approve changes.
Architecture & Design
A documented plan with clear standards, approved by you, before a single change is made.
Before. Single-homed everything. One internet line, one firewall, one core switch, one path to every desk — every link is a single point of failure. Any one device fails and the office stops.
After. Two internet lines. Two firewalls, so one can fail without dropping connections (an HA pair). Two core switches acting as one. Every switch stack connected to both. Redundant paths reduce single points of failure; we test the failover on your network, not just on paper.
What arrives
Four Edge plans, two single-firewall plans (Edge Firewall Watch and Managed) and three ownership retainers are on the services page. This is how the four Edge plans differ in practice: what you get, and how fast a person responds when something breaks.
| Plan | Response to a critical issue | Included engineering | Reviews |
|---|---|---|---|
| Edge Essential $695/site/mo · up to 10 devices | Next business day | None; standard changes at $225/hr, 30-minute minimum | Monthly summary, config backup and change tracking, ISP outage notice (ticket details for your ISP) |
| Edge Secure $1,295/site/mo · up to 20 devices | Same business day; acknowledged within 4 business hours | 1 hour/month standard changes | Adds ISP escalation (we open and chase the ticket), a quarterly posture check and trend review |
| Edge Compliance $1,795/site/mo · up to 30 devices | Priority same business day; acknowledged within 2 business hours | 2 hours/month standard changes | Adds firewall policy, VPN and access reviews, vulnerability tracking, log-retention guidance for auditors |
| Edge Multi-Site $2,495 first site + $995/additional site/mo | Highest priority, named escalation; acknowledged within 2 business hours | 3 hours/month standard changes, pooled across sites | Adds standardized configs across sites and a quarterly roadmap review |
Standard changes are routine settings work: a new Wi-Fi network, a new VPN user, a VLAN or DHCP change, a NAT rule for one application. Devices beyond a plan’s ceiling are $25 per device per month; on Multi-Site they are quoted after scoping, because device mix varies by site. Hours beyond the plan bill at the agreed rate or are scoped as a project. Response windows are business hours, Monday to Friday 8 AM to 5 PM Pacific. Outside business hours monitoring and alerts keep running; emergency work is $487.50 per hour ($525 for architecture work), two-hour minimum, when an authorized contact asks. Response means acknowledgement, triage and start of mitigation. If we miss the business-hours acknowledgement target on a Critical issue, you can claim a credit of 10% of that site’s monthly fee, up to 25% a month, in writing within 60 days; it comes off your next invoice. Contracted response times are defined in your agreement; the table is the plan design, not a guarantee of uptime.
The rules
Every change to production gets a written change record: what, why, when, how to roll back. Standard changes within your plan’s included hours are scheduled in your maintenance window at no extra charge. Anything outside the plan or the statement of work needs your written OK from a named approver before we start. We never make an out-of-scope change because someone on site asked nicely.
Default window is Friday 6 PM to Sunday 6 PM Pacific, agreed at launch and changeable with notice. Emergency fixes outside the window happen when the alternative is an outage, and you hear about it the same day.
One number to call, and one senior engineer as your point of contact. You are never passed between people. Severity is set when you report it and confirmed on first response: critical means a site or business-critical service is down. If we cannot reach you, we work the problem and keep the second contact informed. Vendor escalations on hardware we manage are ours to run, not yours. ISP escalation, where we open and chase the ticket with your internet provider, is included on Secure and up, during business hours, once you add us as a contact on your ISP account (the exception is an outage on a single circuit where you declined the second circuit we recommended, which bills hourly). On Essential you get the outage notice with everything needed to open the ticket, and we run the escalation for you if you pre-authorize it at onboarding or ask in writing: $225 an hour during business hours, 30-minute minimum, then 15-minute increments, stopping at one hour per outage unless you agree to more. After hours we do it only if you ask, at the emergency rate.
Assessments and project work are prepaid or deposit-backed. Managed plans bill monthly in advance by card or ACH through a customer portal; the first invoice is the only one you pay by hand, the rest run automatically. Fortinet hardware is quoted separately by part number; other hardware at our cost plus 15%; hardware is never bundled into labor. Plan rates adjust by 4% at each anniversary; a 24-month term adjusts 3% after year one, and a 36-month term adjusts once. Standard changes for plan customers, beyond any hours the plan includes, bill at $225 an hour with a 30-minute minimum and 15-minute increments after that. Engineering outside a plan or statement of work bills by the hour at $225 to $350 depending on the kind of work, one-hour minimum. After-hours emergency work bills at the emergency rate above; a planned change outside your maintenance window can be booked as a scheduled two-hour evening cutover window at $325.
Configurations, credentials and documentation live in version-controlled storage and a credential vault under our control, not on a laptop. We hold independent administrative access to what we manage and you always hold your own. Suspected unauthorized access is reported to you within 24 hours.
The initial term is 12, 24 or 36 months, but either side can walk away in the first 90 days with no fee (30 days’ notice; onboarding is non-refundable). If you leave after day 90 and before the term ends, the fee is the lesser of three months of plan fees or what’s left in the term. After the initial term, 60 days’ written notice. In-flight work finishes or stops at a documented point, your choice. Within 30 days you get your documentation, credentials, configuration backups and change history, diagrams, device inventory, alert rules and an export of the monitoring data, and we remove our access. No hostage credentials.
Fit
Organizations with 20 to a few hundred people, one to many sites, a network that matters to revenue or compliance, and nobody on staff whose main job is the network. Clinics, firms, manufacturers, multi-site operators, and IT teams that want a network specialist beside them rather than a generalist MSP over them. If you already have an MSP, keep them; a co-managed arrangement covers the network layer alongside them. On-site work covers Sacramento, the San Francisco Bay Area and San Jose; multi-site organizations elsewhere in the U.S. are run remotely.
Desktop support, printers, email, Microsoft 365 administration. We will tell you on the first call and point you to an MSP that does those well. If you need someone on site every day, we will say so and, where we can, bring a vetted field partner under our direction.
FAQ
About two weeks for a single-site assessment, a 60-minute readout, then your decision. After you hand over access, monitoring comes up first and fixes run in agreed change windows over weeks 3 to 8.
No. The report, diagram and 30/60/90-day roadmap are yours whether or not you continue. You can do the critical fixes with us and nothing else, or take the report elsewhere.
Either side can walk away in the first 90 days with 30 days’ notice and no fee. Within 30 days you get your documentation, configuration backups, credentials and change history, and we remove our access.
Step one
Bring the device count, the sites, and the issue or project you need help with. Leave knowing whether we fit and what the assessment would cover. If it fits, the Network Risk Assessment is $3,500 for a single small site, about two weeks, and the report is yours to keep either way; larger networks are priced on the assessment pricing page. See a sample report (PDF).
