Everything people ask, in one place
Frequently Asked Questions
Straight answers on pricing, security, hosting, compliance, and how we work — each with a link to the full detail. Can’t find yours? Ask the owner directly.
About CRC Cloud
What is CRC Cloud?
CRC Cloud is a Newport Beach, California provider of managed IT, cybersecurity, and private cloud hosting — an MSP, MSSP, and CSP in one accountable partner. Its roots go back to 1983 as Computer Research Center. Today it serves Orange County, Los Angeles, San Diego, the Inland Empire, and clients nationwide. About CRC Cloud →
Is CRC Cloud an MSP or an MSSP?
Both, plus a cloud services provider (CSP). Core IT is the MSP layer, Secure IT adds the MSSP layer with a 24/7 security operations center, and Cloud Complete adds private cloud hosting — on either plan — on infrastructure CRC Cloud owns in a Southern California datacenter. See the plans and published pricing →
How long has CRC Cloud been in business?
The lineage runs continuously from 1983 — Computer Research Center, through CRC Computer Supplies and classroom training documented in college catalogs and press through the 1980s and 90s, to today’s CRC Cloud. The receipts — catalogs, news coverage, the 1992 LA Times column — are published on the heritage page. See the 40-year archive →
Where is CRC Cloud located?
Headquarters: 4695 MacArthur Ct, 11th Floor, Newport Beach, CA 92660 (visits by appointment). A secure operations office operates in Irvine, CA — its location is shared with clients only, part of our policy of security through discretion. Support is remote-first, with on-site included within 175 driving miles of Newport Beach and billed beyond it at $145 an hour including travel time, plus travel expenses at cost — our own engineers travel wherever the work needs hands. Service areas →
Working with us
We already have an IT person or team. Is this still useful?
That’s what co-managed IT is for: your team keeps operations, we add after-hours coverage, the tooling, escalation depth, and a vCIO strategy layer — and on Co-Managed with Secure IT, the 24/7 SOC. It works as a partnership, not a replacement. Co-Managed IT →
What happens on the free assessment call?
Thirty minutes, the owner, no script: headcount, servers and endpoints, key vendors, how IT and security are handled today, cloud services in play. You get a structured posture read, and a written quote within one business day, built from what you tell us and confirmed at onboarding. If you want a fixed quote from a documented look at your environment before you sign, paid IT discovery is optional ($1,500–$4,500 by environment, published on the rate card). It is paid up front and not refundable unless we haven’t delivered within 45 days after you give us access, and it is credited in full against your first invoice if you sign within 60 days of receiving the report. The report usually comes within 10 business days after you give us access, or 15 for the Complex tier — a target, not a guarantee. What the call covers →
How do I get support as a current client?
By phone, text, email, the portal, the support icon on your computer, or chat — with a 15-minute response standard during business hours (6 AM–6 PM PT, Monday–Friday). After hours, use phone, text, email or the portal, where our response standard is 60 minutes; for an emergency, call. Every channel is listed on the support center page. All support channels →
Pricing & plans
How much do managed IT services cost?
National 2026 guides put managed IT at roughly $100–$400 per user per month; published Orange County rate cards we checked in September 2026 run about $75–$250. CRC Cloud publishes its pricing: Core IT $125 per user/month, Secure IT $250 per user/month with the 24/7 SOC, and Cloud Complete — private cloud hosting on either plan — from $175 per user/month on Core IT ($125 plus a $50 shared hosted desktop), or from $300 on Secure IT ($250 plus the same desktop). The pricing page includes a live cost calculator. See pricing & calculator →
What contract terms does CRC Cloud use?
A one-year initial term, then month-to-month with 60 days’ notice and no fee to leave. Leaving during the initial term costs half of the remaining months’ fees. There is never an offboarding fee. Your documentation — passwords, configurations, network maps — is yours from day one, kept current, and handed over at no charge with a copy of the data we host and the latest restore point of each backup, whenever you ask. Plan details →
Do I need cyber insurance?
We ask every client to carry cyber insurance with at least a $1,000,000 limit, covering your own losses (incident response, data restoration, business interruption, extortion) and your liability to others. New clients have 60 days to put it in place. A serious incident can cost far more than any IT provider’s fees. If you choose not to carry it, that’s your decision: you bear the losses the insurance would have paid, and our liability limit under the agreement is halved. Cyber insurance readiness →
Can we see your response times?
Yes. We record the response time of every ticket. Ask for a report for any of the last 12 months whenever you want, or choose automatic monthly reports in your service order. Support center →
What is included in Core IT at $125 per user?
Unlimited remote help desk; on-site support within 175 driving miles of Newport Beach when a problem can’t be fixed remotely; proactive 24/7 monitoring, patching and updates; email, identity and device management with MFA; disk encryption; and vendor and asset management — a complete IT department at a flat per-user rate. Managed IT details →
Per-user or per-device IT pricing — which is better?
Per-device can cost less when many people share a few machines or for unattended kiosks; per-person wins when each person uses a computer all day, because one number covers their workstation, mailbox and everyday peripherals. On any per-device quote, check whether servers, firewalls, mailboxes and the security stack are separate lines, and whether a monthly minimum raises the real rate for a small office — the unit price is not the monthly total. CRC Cloud prices per person, with the full arithmetic published and worked in the open. The worked comparison math →
Is the 30-minute assessment really free?
Yes — 30 minutes on the phone with the owner, structured around the NIST Cybersecurity Framework 2.0. You leave with a read on your posture that is yours whether or not you hire us, and a written quote follows within one business day. Book the assessment →
Security & the SOC
What does the 24/7 Security Operations Center actually do?
Humans plus tooling watching around the clock: managed detection and response (MDR), SIEM log intelligence, dark-web monitoring, and containment authority — built so threats get isolated at 2 a.m., not discovered at 9. It ships inside Secure IT rather than as an add-on. Cybersecurity & SOC →
What is the difference between an MSP and an MSSP?
An MSP keeps IT running — helpdesk, hardware, updates, uptime. An MSSP keeps it safe — threat detection, response, compliance alignment. Most businesses otherwise juggle two vendors; CRC Cloud operates as both in one accountable partner. MSP vs MSSP compared →
How fast does CRC Cloud respond?
The published standard is measured on client tickets: 15 minutes during business hours (6 AM–6 PM PT, Monday–Friday) and 60 minutes nights, weekends and holidays when you call, text, email or use the portal. Emergencies are worked 24/7 on every plan, and on Secure IT the SOC watches continuously regardless of the hour. If we miss our response standard on more than 10% of your tickets, and on at least three of them, two quarters in a row, you can leave with no early-exit charge — including inside the initial term. We record the response time of every ticket: ask for a report for any of the last 12 months, or choose automatic monthly reports in your service order. Support center →
Private cloud & your data
What makes CRC Cloud’s private cloud different from the big public clouds?
Public cloud rents you a metered slice of a hyperscaler. CRC Cloud runs your servers and applications on a redundant pool of servers we own — network, power, internet, storage, and compute all redundant — replicating to a second site we operate. Predictable monthly cost, one accountable partner — and colocation is available if you’d rather run your own hardware in the facility where our cloud runs. Private cloud details →
Where is my data hosted?
In a carrier-neutral Southern California datacenter engineered to a concurrently maintainable design, with N+1 power and cooling. Its operator holds SOC 1 and SOC 2 Type II attestations, ISO 27001 and PCI-DSS certifications and NIST 800-53 (PE) High alignment — those are the facility operator’s credentials, not CRC Cloud’s. The 99.9% uptime service level on hosted systems is CRC Cloud’s own commitment, and hosted environments are replicated nightly to a second site we operate, in a separate access-controlled building in the same region. The exact location stays confidential by design — that discretion protects clients. Datacenter details →
Do you own the datacenter?
We own the infrastructure — the servers, storage, and network your workloads run on — housed in a third-party facility held to published standards. That distinction is stated plainly because it matters: the facility’s certifications belong to the facility; the hardware, architecture, and accountability are ours. How the facility is certified →
Compliance
Can CRC Cloud make us compliant with CMMC, SOC 2, or HIPAA?
No provider can truthfully sell “compliance” — we align, implement, manage and prepare; certification and audit belong to authorized assessors and auditors. Our practice is built on the NIST Cybersecurity Framework 2.0, and we prepare clients for CMMC, SOC 2, HIPAA, DOL cybersecurity expectations, ALTA Best Practices, and the IRS WISP. Compliance alignment hub →
Do you work with defense contractors on CMMC?
Yes — CMMC 2.0 alignment for small defense suppliers is a core lane, including NIST 800-171 control implementation and assessment preparation. The Department of War suspended the Phase 2 third-party assessment phase-in on July 13, 2026. DFARS 252.204-7012 still requires NIST SP 800-171, and CMMC self-assessments — with the SPRS posting and annual affirmation that go with them — still apply wherever a contract calls for Level 1 or Level 2 (Self). CMMC alignment →
