What Managed IT & Private Cloud Cost in Southern California — the 2026 Guide
Most IT companies hide pricing behind a "request a quote" form. We publish ours — not just the headline number, but the whole rate card behind it. Managed IT in Southern California typically runs $100–$400 per user a month; here is exactly where ours lands.
Core IT is $125 per user. Secure IT is $250. Cloud Complete starts at $175. No minimum — ten people on Core IT pay $1,250 a month. At the $2,500 monthly minimums common in this market, the same office pays double. Rates updated August 2026.
The headline numbers, then your math
The whole rate card is on this page — here's the shape of it in one glance, and a calculator that prices your actual team. Every detail is below: what's in each plan, the full rate card, and the questions people ask.
Core IT — $125/user
Your complete IT department, per person, per month — no minimum headcount.
What's included →Secure IT — $250/user
Everything in Core IT plus the 24/7 Security Operations Center layer.
The extra $125, itemized →Cloud Complete — from $175/user
Adds hosted desktops in our private cloud — $175 with Core IT, $300 with Secure IT.
How hosting prices →Paid discovery — $1,500–$4,500
A full, documented read of your environment before you commit — credited in full when you join.
Essentials · Standard · Complex →What would your team cost?
No minimum headcount. A ten-person office pays the same published rates as a hundred-person one. The other Orange County provider that publishes complete rates sets a $2,500 monthly plan minimum — roughly sixteen people before a business can buy at all.
Two questions gets you a number. We fill in the rest from a standard build, show you exactly what we assumed, and let you correct any of it — no email required.
Servers, extra devices and remote workers
All zero unless you say otherwise — the number above already works without them.
Adjust our assumptions
Per location — at every office we manage one firewall, one network switch, one Wi‑Fi access point and one battery backup (UPS) at no extra charge; additional devices are billed at the published management rates. The equipment stays yours — we monitor, patch and manage it, we don't supply it. One row per office — each location can be different.
| Office | Firewalls | Network switches | Wi‑Fi access points | Battery backups (UPS) | Copiers | Scanners | Printers |
|---|---|---|---|---|---|---|---|
| Location 1 |
Fully remote — no offices. With no location there’s no on-site network equipment to manage or bill, so this whole section stays out of your estimate. Everyone connects securely from wherever they work, and home Wi‑Fi stays personal equipment.
Hosted environment — the one number that really moves file storage
Backup — priced by retention and by how much data you protect
On Cloud Complete the four servers of the standard hosted build are already backed up in the numbers below — the file server and session host at the full rate, the directory server and gateway at the infrastructure rate, because they rebuild from template. What you set here is your own servers and PCs, on top of that.
Cloud Complete — only affects the two Cloud Complete totals
Company-wide options — counted once, not per office
Pick the one framework that governs you. Two frameworks don't stack — overlapping programs are scoped together at discovery, and the uplift applies to the per-user plan and per-server management, not to hardware or licensing. Compliance programs start on Secure IT: Core IT is not an option for a regulated environment.
Your own equipment, at your offices — click a total to see its math
Core IT
$0
per month · $125 per user
see the math ↓
Secure IT
$0
per month · $250 per user, adds the 24/7 SOC
see the math ↓
Cloud Complete — hosted in our facility, shared desktop
with Core IT
$0
per month · $175 per user
see the math ↓
with Secure IT
$0
per month · $300 per user, adds the 24/7 SOC
shown below
Now compare it to what you pay today
What you pay to start
- IT discovery — Essentials A documented read of your environment before you commit — credited in full against your first invoice$1,500
- Onboarding & transition Includes enrolling every device you already own$0
- If you ever leave — offboarding & full data export Published now, so it can’t become leverage later$0
- Net cost to begin Discovery is credited back in full, and onboarding is free$0
Scoped to your environment and quoted separately, never folded into a headline number: vulnerability assessment from $2,500, external penetration test from $4,500, external and internal from $7,500. Project work is $165 per hour; after-hours and emergency project work is included on Secure IT and billed at 1.5× on Core IT. Adding a user later is $150; removing one is $0.
How we got the Cloud Complete with Secure IT number Click any of the four totals above and this breakdown switches to that number’s own math. Every figure is a published rate from the card below.
This is an estimate, not a quote. We sized the hosted environment with the standard build set out in the rate card below; discovery may size it differently, and that is the number that goes in writing. Core IT and Secure IT assume you keep your own servers on site — add them above if we manage them. Book the free 30-minute assessment →
Prices you can read before you're ready to talk
We surveyed how Southern California IT providers present pricing — and published the review. Of the ten most-visible Orange County providers, only two publish complete rates (we are one), three publish ranges, five publish nothing. Almost none publish what the rest of the invoice looks like. Read the full review, method and all →
That's the gap this page closes. The per-user numbers here match your invoice, and so does everything underneath them — each server, each firewall, each backup retention tier, each hour of project work.
Read the whole bill, not the headline. The other provider that publishes complete rates lists $157 per user per month — then adds $17.85 per computer and $16.90 per mailbox. For one person with one computer and one mailbox, that is $191.75. Core IT is $125, and the computer and the mailbox are already inside it. We don't name competitors — but those are their own published rates, from their own pricing page, checked August 6, 2026, and you can verify them in an afternoon.
Our toolset stays private for security reasons. Our prices aren't a security risk — so here they are.
Two decisions, not three tiers
Secure IT contains Core IT — everything in one is in the other. Cloud Complete adds our private cloud on top of whichever of those two you choose — which is why it carries two prices, and why the gap between them is the same $125 that separates the plans anywhere else. What changes is the depth of security and where your systems run — never how much support you get. Support is unlimited on every plan.
Open any item for the plain-English detail, or
Core IT
The complete IT department (MSP).
$125
per user / month
The foundation every plan builds on:
Per user
- Unlimited helpdesk & onsite support within our 175-mile service radius
Endpoint detection & response (EDR) on every computer
Next-generation antimalware, ransomware mitigation, web threat protection, intrusion detection and network attack defense, with attack visualization and guided response.- Email security & anti-phishing
DNS filtering
A malicious link stops resolving before the page can load — on the office network and off it.Email authentication kept valid
SPF, DKIM and DMARC monitored so nobody can send mail pretending to be you.Business email & identity management
Accounts, mailboxes, MFA, and conditional access rules for who can sign in from where.Employee onboarding & offboarding
A new hire ready on day one, and a departing one cut off the same day across every system.- Patching & updates
- Mobile threat defense on every managed phone and tablet
Disk encryption enforced
BitLocker on Windows, FileVault on Mac, with recovery keys held centrally so a lost laptop is an inconvenience, not a breach notification.
Available on Core IT
- Microsoft 365 backup — one-year immutable retention, $9.50 per user (included on Secure IT)
- Server, PC and disaster-recovery backup — published rates by retention, 30 days to 7 years
- Proactive 24/7 monitoring
- A named lead engineer who knows your environment — you will never re-explain your network
- vCIO strategy & roadmap
Business reviews on your schedule
Quarterly, semi-annual or annual — never fewer than once a year.- Ongoing vulnerability management & remediation
- Incident-response planning
- Vendor, asset & ISP management
Support portal
Open a ticket, track it and see your asset list without waiting on the phone.Standard network equipment managed at each location
Firewall, network switch, Wi‑Fi access point and battery backup (UPS).
Company-wide
Most Popular
Secure IT
Core IT plus a 24/7 security operation (MSP + MSSP).
$250
per user / month
Built on the NIST Cybersecurity Framework 2.0 — the standard cyber insurers and auditors ask about
Everything in Core IT, plus:
Per user
- Security awareness training
- Dark-web monitoring
- Microsoft 365 backup, one-year immutable retention
Company-wide
24/7 Security Operations Center with managed detection & response
Analysts watching the endpoint detection Core IT already gives you — and isolating a compromised machine at 2 a.m. without waiting for you to notice.SIEM log intelligence — one year of log retention included
Longer retention for compliance is priced by the year.Identity threat monitoring — the SOC watches your logins
Most break-ins now start with a stolen password rather than malware, so the SOC watches sign-in behavior as closely as it watches computers: a login from two countries in an hour, a mailbox rule quietly forwarding invoices, an account suddenly granting itself access it never had. Sometimes called ITDR — identity threat detection and response.Application allowlisting — only approved software runs
Only software we’ve approved together can run on your computers. Anything unapproved — including the malware a phishing click tries to launch — is blocked before it starts, and a new app is one approval away, not a support project.- Internal risk & NIST CSF posture assessments
Annual vendor risk review
We inventory the outside companies that touch your data, rank them by risk, and send security questionnaires to the three most critical — the documented answer to the “how do you manage vendor risk?” question auditors and insurers now ask. A larger, continuous vendor-risk program is Virtual CISO scope on the rate card below.Shadow-AI governance
An inventory of which AI services your business already talks to, an acceptable-use policy written with your leadership, and tenant controls and data-loss rules that enforce it.Cyber-insurance questionnaire support
We complete the technical sections and produce the evidence your insurer asks for.
Cloud Complete
Your infrastructure, hosted by us — on either plan (MSP / MSSP + CSP).
from$175
per user / month on Core IT or $300 on Secure IT — the combination we recommend
Everything in the plan you choose, plus:
A shared desktop hosted in our facility (all-SSD)
Each person gets a private, isolated session on a session host built for your company alone.- Private cloud on infrastructure we own — not resold hyperscaler space
- Your environment replicated to a geo-separate facility we also operate
- A managed cloud firewall protecting your hosted environment
- Migration off aging servers or the public cloud
Prefer a dedicated desktop instead of a shared one? Add $85 instead of $50 — $210 with Core IT, $335 with Secure IT.
Geo-separate replication and a managed cloud firewall are included; VPN access and public IP addresses are itemized so you only pay for what you use. The servers that run your hosted environment — along with backup and warm-standby disaster recovery — are itemized at the published rates below.
Full Cloud Complete details →The businesses already paying these rates
Three of nine client reviews — chosen because they answer what a price makes you ask: does the number hold, can they be trusted with the systems the business runs on, and is it worth it. Quoted word for word.
“We've been working with CRC Cloud for well over 15 years, and the relationship has only gotten stronger. … They're genuinely interested in our business and often reach out to see how they can help.”
“CRC Cloud is more than an IT management company — they're a partner we trust wholeheartedly.”
“CRC Cloud's professionalism, responsiveness, and technical expertise have had a meaningful impact on our operations.”
Clients are identified by role and industry rather than by name — the same discretion we apply to everything else about them. Read all nine in full →
All four combinations, in one table
There are two decisions, not three products: how much security you want, and where your systems run. Cloud Complete is the second decision, and it works on either plan — so the price is always the plan you picked plus the desktop. Nothing else moves.
| Where your systems run | Core IT managed IT |
Secure IT adds the 24/7 SOC |
|---|---|---|
| Your own equipment, at your offices | $125 | $250 |
| Cloud Complete — shared desktop | $175 | $300 |
| Cloud Complete — dedicated desktop | $210 | $335 |
Why we point most people at the Secure IT column. Not to upsell — because of who answers at 2 a.m. Core IT already includes endpoint detection and response, email security, MFA, patching, 24/7 monitoring and vulnerability management, so a Core IT environment is not unwatched. What the Secure IT column adds is a staffed Security Operations Center that acts on what the tools find, outside business hours, without waiting for you to notice. Hosting with us doesn't change that math in either direction — our facility is not a substitute for your security program. If you are working toward HIPAA, CMMC, SOC 2 or a cyber-insurance attestation, assume you need the Secure IT column and budget accordingly. See how compliance is priced →
Hosting servers but keeping your local PCs? That's your plan plus published server rates — often less than Cloud Complete, because you're not paying for a hosted desktop per person. We'll tell you which is cheaper for your situation before you ask.
Which software licenses we pay for, and which stay yours
The commonest surprise on an IT invoice is a license somebody assumed was included. Here is the line, drawn before you sign rather than after.
| Included in your per-user rate | Licensed by you, billed at the vendor’s published rate |
|---|---|
On both plans
|
|
We do not mark up a license in either direction. Where a vendor sells to us and we resell to you — Microsoft 365 is the common case — you pay the published rate and we show you the invoice if you ask. Where a license is genuinely yours, it stays in your name, on your account, and it leaves with you. A provider who profits on your licensing has a reason to recommend the wrong one.
How devices are counted. The per-user rate covers a person and the computer they work on — that is one price, not a person price plus a machine price. Every additional device is billed, at what it actually costs to manage rather than at the full plan rate. A second computer — another laptop, a home desktop, a Windows or Mac tablet — runs the same full toolset as a primary machine: remote monitoring, patching, antivirus and endpoint detection. That is $45 on Core IT or $65 on Secure IT.
A phone or tablet — iPhone, iPad, Android — cannot run that toolset at all; it carries enrollment, mobile threat defense and policy enforcement instead — enrollment and policy run on Microsoft Intune under your own Microsoft licensing, managed by us. That is $15 on Core IT or $18 on Secure IT. A phone does not need a helpdesk, an inbox or a seat at a business review, and we do not pretend otherwise. Twenty people with twenty phones and five iPads is $5,450 on Secure IT — not forty-five times the user rate.
What managed IT services cost in Southern California in 2026
The table below compares published industry survey bands for Southern California against CRC Cloud's actual rates, so you can see where each plan sits in the market before you talk to anyone.
| Service level | Typical SoCal market rate (2026) | CRC Cloud published rate |
|---|---|---|
| Basic monitoring & helpdesk only | $100–$150 per user/mo | — (we don't sell partial coverage) |
| Full-service managed IT | $150–$250 per user/mo | Core IT: $125 |
| Managed IT + advanced security (SOC/MDR) | $250–$400 per user/mo | Secure IT: $250 |
| Standalone SOC/MDR retainer (10–50 staff) | $2,000–$5,000 per month, IT not included | included in Secure IT |
| Managed IT + private cloud hosting | quoted by workload, rarely published | Cloud Complete: $175–$335 |
Core IT sits below the full-service band because it's engineered around prevention — systems that don't break cost less to support. Secure IT sits at the bottom of the advanced-security band while including the entire IT layer underneath it. Cloud Complete is the only line in this table where the market has no published comparison at all.
Why a $157 headline can cost more than our $125
The nearest Orange County provider who publishes pricing advertises $157 per user. That is the first of three lines. Here is the same twenty-person business, priced both ways — their figures from their own pricing page, ours from the card below.
| Line | A published Orange County provider | CRC Cloud Core IT |
|---|---|---|
| Per user | 20 × $157 = $3,140 | 20 × $125 = $2,500 |
| Per computer | 20 × $17.85 = $357 | included |
| Per mailbox | 20 × $16.90 = $338 | included |
| Managing the firewall, network switch, Wi‑Fi and battery backup (UPS) | not stated on their published price list | included |
| Monthly total what one person actually costs | $3,835 — $191.75 per user | $2,500 — $125 per user |
Now the part that decides which one you actually want. That provider's help desk runs Monday to Friday, 8 AM to 5 PM Pacific, with a one-hour emergency phone line outside it, as published on its website in August 2026. Ours answers in 15 minutes from 6 AM to 6 PM Pacific on weekdays and 60 minutes nights and weekends, and drives out to 175 miles rather than 25. Around-the-clock coverage and a 15-minute standard are what Secure IT includes at $250, along with a 24/7 Security Operations Center, SIEM, Microsoft 365 backup and security-awareness training. We don't price other providers' services — ask them what those additions cost, and compare the answer to a number that's already on this page.
And the comparison a security buyer actually makes
The table above compares that provider against Core IT, and Core IT wins on price at every size. But if ransomware is what keeps you awake, you are not shopping for Core IT — and their $191.75 bundles a security stack that sits between our two plans. So here is the honest version of that comparison, at the same twenty people. Secure IT costs more. This is what the difference buys.
| What you are buying | A published Orange County provider | CRC Cloud Secure IT |
|---|---|---|
| Monthly, twenty people | $3,835 — $191.75 per user | $5,000 — $250 per user |
| Help desk hours | Monday to Friday, 8 AM – 5 PM Pacific | Weekdays 6 AM – 6 PM Pacific, 24/7 for incidents |
| Response standard | one hour, by emergency phone line | fifteen minutes in business hours, sixty after |
| Security operations | managed detection and response, on the endpoint and email layers they list | managed detection and response plus SIEM log correlation across the whole environment — their published stack lists no SIEM |
| On-site included | within 25 miles of one airport | within 175 miles |
| On-site beyond that | $185 per hour | $145 per hour |
| Monthly minimum | $2,500 — below roughly thirteen people you pay it anyway | none |
| Onboarding | a one-time fee | $0 |
Two things that table decides for you. If you have ten people, their minimum makes them $2,500 a month whatever you use — Core IT is $1,250. If you want somebody awake at 2 a.m., a one-hour callback and a detection product are not the same purchase as a staffed operations center, and we would rather you compared those honestly than by the headline. We don’t name competitors; every figure here is from their own published pricing page.
We are not the cheap option, and we do not pretend to be. We are the one whose number does not change after you sign.
A worked example: twenty people, one office, five working remotely, everyone with a work phone
The same arithmetic the calculator runs, written out — so you can check it, print it, or paste it into a board pack. Cloud Complete, shared desktops, our standard build, nothing held back for the invoice.
| Line | With Core IT | With Secure IT |
|---|---|---|
| Your team — plan + hosted desktop20 people at $175 with Core IT — the $125 plan rate plus a $50 shared hosted desktop — or $300 with Secure IT, the $250 plan rate plus that same $50 desktop · a dedicated desktop instead of a shared one is $210 or $335 | $3,500 | $6,000 |
| Hosted environment — 4 serversThe machines themselves; the labor to run them is the last line. Directory server 2 vCPU / 8 GB $110 · gateway 4 vCPU / 16 GB $175 · file server 4 vCPU / 16 GB $175 plus 1 TB at $75 · session host 8 vCPU / 36 GB $334 | $869 | $869 |
| Server backupFile server and session host at $165 · directory server and gateway at $45, immutable, 1-year retention | $420 | $420 |
| Connectivity1 site-to-site VPN $25 · 1 public IP $12 · 5 remote-user VPNs at $5 | $62 | $62 |
| Office equipment, 1 locationOne firewall, network switch, Wi‑Fi access point and battery backup (UPS) are included at every location at no charge. Billed here: copier $15 · scanner $7 | $22 | $22 |
| Managed phones20 work phones at $15 or $18 each | $300 | $360 |
| Server managementThe labor to run the 4 servers above, separate from hosting them · 4 hosted servers at $125 or $175 | $500 | $700 |
| Total per month$284 and $422 per person, everything in | $5,673 | $8,433 |
Four lines are identical on both plans — hosting, backup, connectivity and office equipment don't change. Only three move. The first is the plan rate inside the top line: the same $125 that separates Core IT from Secure IT everywhere else on this page. The hosted desktop itself is $50 on both plans — choosing Secure IT doesn't make the desktop cost more, it buys the 24/7 Security Operations Center, SIEM, Microsoft 365 backup and security-awareness training that come with the plan. The other two are the per-device rates and server management, which moves $50, not $125, because a hosted server costs less to manage than a person costs to support. For comparison, the same twenty people and twenty phones on their own equipment are $2,822 on Core IT and $5,382 on Secure IT — but that assumes servers you already own, and the day they need replacing is a capital project this line doesn't show.
The rate card
Unfamiliar with a term below? Every one of them is defined in plain English in our glossary. Everything below is a published, standing rate — not an example, not an estimate, not a number that moves once we see your letterhead. These are the numbers on the invoice, and they cover the large majority of what our clients buy. Rates last updated August 2026.
What isn't on this page, and why. A few things are genuinely quoted rather than published: custom-built servers sized to a specific workload, hardware supplied as a monthly service rather than purchased outright, and unusual configurations that don't match a standard size. Those depend entirely on your requirements — printing a number for them would be a guess dressed up as transparency. You'll get a fixed written quote before anything starts, priced off the same labor and infrastructure rates below.
| What you're buying | Core IT | Secure IT |
|---|---|---|
| A person and the computer they work on | $125 | $250 |
| A person with a hosted desktop Cloud Complete, shared session | $175 | $300 |
| … with a dedicated desktop instead | $210 | $335 |
| A second computer for that same person | $45 | $65 |
| A managed phone or tablet | $15 | $18 |
| A server at your premises | $125 | $250 |
| A server we host for you | $125 | $175 |
| Managing your firewall, network switch, Wi‑Fi access point, battery backup (UPS) and internet circuit one of each, at every location — the equipment stays yours | management included | |
| Backing up a server immutable, one-year retention | $165 each | |
| A hosted server in our private cloud | from $110, by size | |
| Storage beyond what the server includes | $75 per TB, billed in whole terabytes, rounded up | |
| Project work migrations, builds, moves | $165 per hour | |
| Onboarding and transition including enrolling every device you already own | $0 | |
| Getting started IT discovery — published by environment, credited in full against your first invoice | $1,500 · $2,500 · $4,500 | |
Everything is per month unless it says otherwise, and every rate above is repeated in full context below. Compliance work, security assessments, backup retention tiers, hosted server sizes, cameras, VoIP, printers and one-time fees all have published rates too — they are in the six groups, grouped so you can open only the one you care about.
Six groups, closed so you can find the one you want. Open any that matter to you.
Servers, network and infrastructureservers, firewalls, switches, Wi-Fi, cameras, VoIP
These are management rates, not rental or purchase prices. The hardware is yours: you own the firewall, the switches, the access points and the servers, and you hold any subscription that runs on them (firewall content filtering, IPS and VPN licensing, for example — see the licensing table above). If you need us to buy equipment for you, that is hardware at cost plus the published 6.5% procurement fee, quoted before anything is ordered. What the rates below buy is the monitoring, patching, configuration, vendor handling and support for each device.
Shared equipment is billed per device. A server at your premises carries the same rate as a person, because it takes comparable work to manage. A server we host never costs more — the same $125 on Core IT, $75 less on Secure IT — because it runs on our template and our hypervisor and nobody drives out to it.
| Item | Rate per month |
|---|---|
| Server at your premises (physical or virtual) | $125 on Core IT · $250 on Secure IT |
| Server hosted in our cloud (our template, our hypervisor, nobody drives out) | $125 on Core IT · $175 on Secure IT |
| Additional computer for the same person (a second laptop, a home desktop, or a Windows or Mac tablet) | $45 on Core IT · $65 on Secure IT |
| Managed phone or tablet (iPhone, iPad or Android) | $15 on Core IT · $18 on Secure IT |
| Business-class firewall (one per location included) | $75 |
| Internet circuit / modem (one per location included) | $25 |
| Network switch (one per location included) | $20 |
| Wi‑Fi access point (one per location included) | $20 |
| UPS (rack or desktop) (one per location included) | $10 |
| NVR / DVR recorder | $35 (cameras billed separately) |
| IP camera | $8 each |
| Network copier or multifunction printer | $15 |
| Network printer | $10 |
| Network scanner | $7 |
| Remote-user VPN — for people working outside the office (not needed if the office connects by site-to-site VPN) | $5 per user |
| Managed VoIP | $8 per seat (carrier service at vendor rates) |
We don't bill you per computer, per mailbox, or per switch. The per-user rate covers the person and the machine they work on, and every location gets a firewall, a network switch, a Wi‑Fi access point and a battery backup (UPS) managed at no extra charge. The rates above apply to the second switch, the fifth Wi‑Fi access point — the equipment a denser office genuinely needs. There is no fee for the address itself, and no separate line for having email.
Backup and recoveryserver, endpoint and Microsoft 365 backup at every retention tier
Every backup we take is immutable and replicated to an offsite data center we own and operate — standard at every retention tier, not a premium upsell. Ransomware cannot encrypt what it cannot modify. Longer retention costs more because it consumes more storage, so retention is priced openly rather than bundled into a single number.
| Retention | Per server / month | Each additional TB |
|---|---|---|
| 30 days | $95 | $30 |
| 90 days | $125 | $40 |
| 1 year — recommended | $165 | $55 |
| 7 years — compliance | $225 | $75 |
| Infrastructure server we host (directory server, access gateway — no unique data, rebuilt from template) | $45 | — |
| Retention | Per device / month | Each additional 250 GB |
|---|---|---|
| 30 days | $20 | $10 |
| 90 days | $26 | $13 |
| 1 year — recommended | $35 | $18 |
| 7 years — compliance | $48 | $25 |
| Retention | Per user / month |
|---|---|
| 1 year (included on Secure IT · add-on on Core IT) | $9.50 |
| 3 years | $10.50 |
| 5 years | $11.75 |
| 7 years — compliance | $13.50 |
How capacity is measured: we bill on the source data under protection, not the stored bytes — your bill reflects the data you have, not how we choose to store it. Capacity is averaged over 90 days and rounded up to the nearest 0.5 TB for servers or 250 GB for endpoints, so one month of temporary files never spikes an invoice. Immutable copies and documented recovery testing are included at every retention tier.
Private cloudhosted server sizes, resources, desktops, disaster recovery, deployment models
Hosted virtual servers are priced by size on all-SSD infrastructure we own. These rates cover hosting only — server management is billed at the hosted-server rate above ($125 on Core IT, $175 on Secure IT), and backup at the retention rates above, so you can see exactly what each layer costs.
A hosted desktop environment needs servers behind it — a directory server, a secure access gateway, file storage, and the machines the desktop sessions actually run on. Each of those is sized on what actually drives it — which is not always headcount — and billed at the server rates below; none of it is folded into the per-user price. Quoting a per-user number and nothing else would be simpler to write and wrong on the invoice.
How we size that environment. Each server scales on the thing that actually drives it, which is not always headcount. Everything below is the standard build the calculator above uses; heavy applications change it, and discovery is where we find that out.
| Server | What drives its size | Standard build |
|---|---|---|
| Directory server | Directory size and login concurrency — not headcount. The platform vendor's own guidance holds one processor core to several thousand users, so a bigger team does not need a bigger directory server. | 2 vCPU / 8 GB. A second one at 50 people, because past that the cost of an authentication outage is larger than the cost of the server. |
| Secure access gateway | Concurrent sessions. This is the one that genuinely grows with your team, and it is the role most often under-built. | 4 vCPU / 16 GB to 75 people, then 8 vCPU / 32 GB. |
| File server | Capacity and disk throughput long before memory. Its size barely moves with headcount; its storage moves with it directly. | 4 vCPU / 16 GB to 100 people, then 8 vCPU / 32 GB. Storage planned at 50 GB per person, billed past what the server includes at the published $75 per TB, in whole terabytes rounded up. |
| Session hosts | People and their applications — memory first, processor second. | One per 25 people. Memory is 1.5 GB per person on top of 6 GB for the server, billed past the base size at the published $6 per GB. |
Worked example — 20 people. One directory server at $110. A gateway at $175. A file server at $250: $175 for the server, plus 1 billed terabyte of storage at $75, because 20 people at 50 GB is 1 TB, the server itself includes 500 GB, and the 500 GB left over bills as one whole terabyte — storage rounds up. One session host at $334: $310 for an 8 vCPU / 32 GB machine plus 4 GB at $6, giving it the 36 GB that 20 people need. That comes to $869 of hosted servers, before management and backup. The session host runs about two and a half people per processor core, which leaves headroom for the mornings when everyone opens everything at once. Every number here comes off the tables in this section — check the arithmetic rather than take our word for it.
| Size | Processor | Memory | SSD storage | Per month |
|---|---|---|---|---|
| Small | 2 vCPU | 8 GB | 250 GB | $110 |
| Standard | 4 vCPU | 16 GB | 500 GB | $175 |
| Performance | 8 vCPU | 32 GB | 1 TB | $310 |
| Intensive | 16 vCPU | 64 GB | 2 TB | $560 |
| Item | Rate |
|---|---|
| Additional processor | $15 per vCPU |
| Additional memory | $6 per GB |
| Additional SSD storage | $75 per TB |
| Archive storage — long-term, non-production | $15 per TB |
| Hosted desktop — shared session host | $50 per user |
| Hosted desktop — dedicated virtual desktop | $85 per user |
| Disaster recovery — warm standby | $175 per virtual server + $75 per TB |
| Managed cloud firewall — protects your hosted environment (one included with Cloud Complete) | $75 |
| Site-to-site VPN — connects a whole office to our datacenter through your firewall | $25 per site |
| Public IP address | $12 each |
| Bandwidth | 5 TB included · $0.02 per GB thereafter |
| Managed website hosting | $45 |
You only pay for the connectivity you actually use. If your office reaches the hosted environment over a site-to-site VPN, everyone at that desk is covered by the one $25 site connection — nobody needs a personal VPN. The $5 remote-user VPN is for the people who work from home or on the road. Charging every seat for remote access when half your team never leaves the building would be easier to bill and harder to defend. A managed cloud firewall is included with Cloud Complete, because a hosted environment can't run without one.
Shared versus dedicated desktops: a shared desktop puts several of your own people on one session host — the server that runs the desktops, never another company’s — each person in a private, isolated session. It is the economical choice for standard office work. A dedicated desktop gives that person their own virtual desktop with reserved processor, memory and storage — the right call for heavy applications or where an environment must be isolated. Both run as virtual machines on our infrastructure; neither is dedicated physical hardware, which is what colocation is for. How our private cloud is built → Below roughly fifteen users a shared environment costs more to stand up than dedicated desktops, and we'll tell you that rather than sell you the wrong one.
Our SSD storage undercuts the major public clouds, which price comparable block storage at roughly $80–$150 per TB per month. Ours is $75, on flash we own. Archive storage carries no retrieval fees and no egress charges — cloud archive is cheap until you need the data back. Disaster recovery is not backup: backup restores your data, disaster recovery keeps a machine standing by to run it, with a 4-hour recovery target, a 15-minute recovery point and a documented failover test every year.
| Model | Pricing |
|---|---|
| Single environment | Published rates — geo-separate replication included (a second copy of your data in our other facility; point-in-time backup and a second running environment are the two rows below) |
| Hybrid — your on-premises or legacy systems extended into our private cloud | Published rates each side, no uplift |
| Multi-Cloud — a second copy of the servers you cannot afford to lose, replicating live and load-balanced (if one fails or gets overloaded, its twin carries the work — you choose which servers get a twin) | +15% on hosted lines |
| Multi-Region — the same live redundancy, with distance between the copies (the second set of servers runs in a different, geographically separate CRC Cloud datacenter, load-balanced across both) | +40% on hosted lines |
| Colocation — your hardware in our facility | Quoted at discovery, managed clients |
| Dedicated — your own cabinet, architected or relocated by us, and managed by us | Quoted at discovery |
Why pay for redundancy when replication is already included? Because they protect against different things. Our platform replicates your environment nightly to a geographically separate facility we also operate, and that replication is standard on every hosted plan at no extra cost. It is a second copy of your data, not a point-in-time restore and not a standby machine — backup and warm-standby disaster recovery are separate services at published rates, both listed above. Multi-Cloud is availability: a second live copy of each server, replicating continuously, so a failed domain controller or an overloaded file server is absorbed instead of noticed. Multi-Region is the same thing with distance between the two copies. Smaller teams are usually well served by the included replication. Once enough people depend on a server that an afternoon without it costs real money, the 15% starts paying for itself. How the private cloud is built →
Security servicesvirtual CISO, vulnerability assessment, penetration testing
These sit above the security layer already included in Secure IT, for organizations that need documented security leadership or independent testing for an auditor, a regulator or a cyber insurer. To be clear about the boundary: ongoing vulnerability management and our internal posture assessments are included in your plan. The services below are different — a formal, point-in-time assessment or an independent penetration test, produced as evidence for a third party.
| Service | Rate |
|---|---|
| Virtual CISO — single framework | $750 per month |
| Virtual CISO — up to 50 users includes the full vendor-risk program: every vendor assessed, remediation tracked, continuous | $1,500 per month |
| Virtual CISO — 51 to 150 users | $2,500 per month |
| Vulnerability assessment | From $2,500 |
| Penetration test — external | From $4,500 |
| Penetration test — external and internal | From $7,500 |
We don't test our own work. Penetration testing is performed by an independent firm and coordinated by us, with remediation managed on your behalf. Testing a network we designed and built isn't a security assessment — it's a self-review, and auditors and insurers increasingly say so.
ComplianceHIPAA, PCI DSS, SOC 2, CMMC and more
Compliance is an uplift on the plan rate, not a separate product — the work is documentation, evidence and audit support on top of the controls you already have. How we run a compliance program →
Compliance work is real, recurring labor — documentation, evidence collection, risk analysis, audit support — so it carries a defined uplift rather than being absorbed and quietly recovered elsewhere. The uplift applies to the per-user plan and per-server management only. Backup, private cloud resources, desktops and add-ons bill at the flat published rates above.
| Framework | Uplift | What it covers |
|---|---|---|
| HIPAA / HITECH | +15% | Risk analysis, documentation, audit support |
| Legal & client confidentiality | +10% | Ethical walls, matter-level access control, retention policy |
| PCI DSS | +10% | Scope segmentation, scan coordination, questionnaire support |
| FTC Safeguards / DOL / IRS WISP | +10% | Written program, annual review, coordinator support |
| SOC 2 readiness | +20% | Evidence collection, control mapping, auditor liaison |
| Financial (SEC / FINRA) | +20% | Audit trails, archiving, regulatory reporting support |
| CMMC / DFARS | +25% | System security plan, plan of action & milestones, enclave design, assessment support |
Published competitor and industry bands for compliance work run 15–30%. Every framework above is at or below that band.
Labor, projects and one-time feesproject rates, on-site, discovery, setup fees
Support is unlimited on every plan, so nothing below is a support charge. These are project work, deployments and the one-time items that come up when you join, grow or leave.
| Item | Rate |
|---|---|
| Project work | $165 per hour |
| After-hours & emergency project work | Included on Secure IT · 1.5× on Core IT |
| On-site support and travel within 175 miles of Newport Beach project hours still bill at $165 — this covers the visit, not the project | Included |
| On-site beyond the service radius | $145 per hour + travel, quoted in advance |
| IT discovery — Essentials one site, cloud-first, 25 users or fewer, no on-premises servers | $1,500, credited in full against your first invoice |
| IT discovery — Standard up to two sites and two servers, up to 50 users | $2,500, credited in full |
| IT discovery — Complex multi-site, on-premises servers, or a regulated environment, up to 75 users | $4,500, credited in full |
| Onboarding / transition (includes enrolling every device you already own) | $0 |
| Offboarding & full data export | $0 |
| Adding a user | $150 |
| Removing a user | $0 |
| Hardware procurement | Cost + 6.5% |
| Deployment | One-time fee |
|---|---|
| Business firewall | $675 |
| Workstation — CAD, design or engineering | $375 |
| Laptop | $350 |
| Desktop computer | $325 |
| Network switch | $275 |
| Rack UPS | $225 |
| Wi‑Fi access point | $175 |
| Network printer | $175 |
| Desktop UPS | $95 |
| Phone or tablet enrollment | $0 |
Our on-site radius is 175 miles from Newport Beach — and it's included. That reaches Los Angeles, San Diego, the Inland Empire, the Coachella Valley and most of Ventura and Santa Barbara counties without a travel charge. Orange County providers commonly cap included on-site at 25 miles and bill $185 an hour beyond it, so check the radius before you compare hourly rates.
Removing a user is free, deliberately. We never want a price tag standing between you and telling us someone left the company — an account that outlives an employee is a security problem, not a billing opportunity.
Enrolling a phone is free for the same reason. Not just during onboarding — always. A setup fee on a phone is a reason to leave one unenrolled, and an unmanaged phone reading company email is a security problem, not a billing opportunity. Bring us every device you have, on day one or in year three, and we will secure it at no charge. Deploying new equipment is different — a computer we procure, build, image and hand over is a project, and it is priced above.
That is the whole card. If a line you need is not on it, it is because we quote it at discovery rather than guess — ask us and we will put a number on it.
Six questions to ask any IT provider before you sign
These are the questions that decide whether an agreement is fair, and they're worth asking every provider you're considering — including us. Here are our answers, in writing, before you ask.
1. What's included, and what's billed separately?
The rate card above. Bundled security tooling, vendor coordination and on-site work inside our service radius are included. Third-party licensing — Microsoft 365, operating systems, database and carrier services — is billed at the vendor's published rate. Hardware is cost plus 6.5%.
2. What's the response time guarantee — and what happens if you miss it?
Fifteen minutes during business hours, 6 AM to 6 PM Pacific, weekdays. Sixty minutes after hours and weekends by phone or remote. On-site within 2.5 hours during business hours, 4 hours after hours, inside our service radius. If we miss the published standard on more than 10% of your tickets in a quarter, you may terminate — including inside the initial term — with no penalty. We report our measured response times to you every month, not our marketing claim.
3. How long is the contract term?
Twelve months initial, then month-to-month. Here's why: we invest real engineering hours up front — discovery, documentation, security baseline, migration — and we charge no onboarding fee and credit discovery in full. The first year lets that investment pay for itself instead of being billed to you on day one. And if we don't perform, the service-failure exit above applies from day one.
4. What are the termination terms?
Sixty days notice after the initial term. We use that time to hand your environment over properly — documentation, credentials, configurations and a complete data export, delivered to you or your next provider at no charge. Sixty days isn't a lock-in; it's how long a clean handover actually takes.
5. Are price increases capped?
Yes — 5% per year, maximum, written into the agreement, never mid-term. The cap covers every line we bill you: service, backup, private cloud, desktops, colocation. Third-party licensing passes through at the vendor's rate with 60 days written notice, and we don't mark it up in either direction. Ask any other provider this question and note whether the answer is a number.
6. Who owns the data and the documentation?
You do. Full export of documentation, credentials, configurations and data at no charge, whenever you ask — including on the way out. Your network diagram, your password vault, your asset register and your runbooks are yours. They were always yours.
What's not included
Naming the exclusions plainly is what makes the rest of this page believable. Nothing here is hidden in a footnote of the agreement.
- Third-party licensing — Microsoft 365, server and desktop operating systems, database licensing, carrier services. Billed at the vendor's published rate, no markup. We don't print a number here because vendor licensing changes and depends on your configuration, but it's itemized on your quote and we'll show you the source. Providers who fold licensing into one seat price are marking it up — they just aren't showing you the line.
- Hardware — billed at cost plus a 6.5% procurement fee covering sourcing, warranty registration, asset tagging and lifecycle records. Most providers never publish a procurement fee at all. Ours is 6.5%, and we print it.
- One-time projects — office moves, server replacements, migrations. Quoted in writing before work begins, at $165 per hour or a fixed project price.
- On-site beyond our service radius — $145 per hour plus travel, quoted in advance.
- Penetration testing — performed by an independent firm, coordinated by us.
- Backup and disaster recovery — server backup, endpoint backup and Microsoft 365 backup each carry their own published rate above, by retention period. The one exception is Microsoft 365 backup at one-year immutable retention, which Secure IT includes. Warm-standby disaster recovery is priced per virtual server plus storage. Hosted plans include nightly geo-separate replication at no extra cost — a second copy of your data, not a point-in-time restore.
What moves the price — and what doesn't
Moves it: total user count · number and complexity of servers · compliance obligations · backup retention · hosted workloads and recovery-time targets · network devices across multiple sites.
Doesn't move it: how often you call. Support is unlimited on every plan. We don't bill per ticket, so nobody on your team hesitates to report a problem while it's still small. Neither does the number of locations by itself — only the equipment in them.
Quoted separately, always in writing first: hardware purchases and one-time projects like office moves or server replacements.
Terms, onboarding, and the exit
- Term: one-year initial term, then month-to-month with 60 days' notice. No exit fees.
- Price cap: 5% per year maximum on every line we bill, written into the agreement.
- Minimum: none. We serve five-person offices on the same published rates as hundred-person companies.
- Onboarding: 2–4 weeks, overlapped with your outgoing provider so nothing drops. No onboarding fee — documentation, discovery, security baseline, agent deployment and enrolling every phone and tablet you already own, all at no charge, however many devices that turns out to be.
- Your engineer: a named lead who knows your environment, joins your reviews, and does not change every time you open a ticket.
- Exit: full documentation, credentials and data export at no charge, delivered inside the notice period.
- First step: a free 30-minute assessment — we'll benchmark your current costs against this page, whether or not you hire us.
Why we publish pricing when almost nobody else does
Three reasons. First, you deserve to budget before you're ready to talk. Second, transparent pricing filters out mismatches early — which respects everyone's time, including yours. Third, we think a company that asks for your trust with its security should be willing to show you a price list.
There's a fourth reason we'll admit to: publishing the whole rate card is hard to copy. Any provider can post a headline per-user number. Publishing what every server, every backup tier, every hour and every setup fee costs means committing to it in public — and most can't, because the margin lives in the parts nobody sees.
Transparency where it's safe; discretion where it protects you. That's the whole philosophy.
Pricing FAQ
If we get breached, is the recovery work billable?
Containment and response run inside the plan — that is what the 24/7 SOC is for on Secure IT, and incident-response planning is included on both plans. Rebuild and recovery labor beyond containment is project work at the published labor rates: after-hours and emergency project work is included on Secure IT and billed at 1.5x on Core IT — always scoped in writing before work starts, never a surprise invoice on your worst day.
How much do managed IT services cost per user in California?
In 2026, Southern California managed IT typically runs $100–$400 per user per month depending on scope. CRC Cloud publishes exact rates. Core IT is $125 per user/month for complete managed IT. Secure IT is $250 per user/month, adding a 24/7 SOC and MDR. Cloud Complete starts at $175 per user/month, adding private cloud hosting on infrastructure we own — $175 on Core IT, $300 on Secure IT, because hosting sits on either plan rather than being a tier of its own.
The per-user rate covers a person and the computer they work on; additional phones, tablets and second computers are billed at published device rates rather than at the full user rate.
Does CRC Cloud publish a full rate card, or just headline prices?
A full rate card — servers, firewalls, network switches, Wi‑Fi access points, cameras, backup at every retention tier, private cloud by server size, Microsoft 365 backup, compliance uplifts, project labor, and one-time setup fees. These are the rates that cover the large majority of what our clients actually buy. A few things are genuinely quoted rather than published — custom-built servers sized to a specific workload, hardware supplied as a monthly service, and unusual configurations — because those depend entirely on your requirements, and inventing a number for them would be the opposite of transparency. Most providers publish nothing at all; a few publish a headline per-user number.
Is $125 per user really all-in? What is not included?
The per-user plan covers each person, their workstation, their mailbox and their everyday peripherals, with unlimited support and no per-ticket fees. Shared equipment — firewalls, switches, printers, cameras — is billed per device at the published rates on this page. Third-party licensing — Microsoft 365, operating systems, database and carrier services — is billed at the vendor list price with no markup. The exclusion worth naming first is backup: server, PC and Microsoft 365 backup each carry their own published rate by retention period — the one exception being Microsoft 365 backup at one-year immutable retention, which Secure IT includes. One-time hardware and projects are quoted in writing before work begins.
What does the jump from $125 to $250 actually buy?
The Secure IT delta funds a 24/7 Security Operations Center with managed detection and response, SIEM log intelligence, application allowlisting (only software we've approved together can run), security awareness training, an annual vendor risk review and dark-web monitoring — the layer that catches and contains threats at 2 a.m. Bought standalone, that layer alone typically costs a 10–50 person company $2,000–$5,000 per month.
What is your response time guarantee, and what happens if you miss it?
Fifteen minutes during business hours, 6 AM to 6 PM Pacific, Monday to Friday. Sixty minutes after hours and weekends by phone or remote. On-site within 2.5 hours during business hours and 4 hours after hours, inside our service radius. If we miss the published standard on more than 10% of your tickets in any quarter, you may terminate — including inside the initial term — with no penalty. We report our measured response times to you monthly.
Are price increases capped?
Yes. Five percent per year, maximum, written into the agreement, and never mid-term. The cap covers every line CRC Cloud bills you — service, backup, private cloud, desktops and colocation. Third-party licensing passes through at the vendor list price with 60 days written notice; we do not mark it up in either direction.
How long is the contract, and what are the termination terms?
Twelve months initial, then month-to-month with 60 days notice. We use that notice period to hand your environment over properly — documentation, credentials, configurations and a complete data export, delivered to you or your next provider at no charge. There is no onboarding fee and no exit fee.
Who owns the data and documentation?
You do. Full export of documentation, credentials, configurations and data at no charge, whenever you ask — including on the way out.
How much does private cloud hosting cost?
Cloud Complete sits on whichever plan you choose, so there are four published rates: $175 per user per month with Core IT and a shared desktop, $210 with Core IT and a dedicated desktop, $300 with Secure IT and a shared desktop, and $335 with Secure IT and a dedicated desktop. Every one is the plan rate plus the desktop rate — $125 or $250 for the plan, $50 or $85 for the desktop — with no separate cloud premium.
It includes a managed cloud firewall protecting your hosted environment. VPN access and public IP addresses are itemized: a site-to-site VPN at $25 per site connects a whole office, and a remote-user VPN at $5 per user is only needed for people working outside the office. Hosted virtual servers are priced by size from $110 to $560 per month, with additional processor, memory and storage published by the unit. The servers that run a hosted desktop environment — a directory server, a secure access gateway, file storage and the machines the sessions run on — are sized to your headcount and billed at the published server rates, not folded into the per-user price.
Backup and warm-standby disaster recovery are also separate services at published rates. If you want to host servers but keep local PCs, that is your plan plus published server rates — often less, and we will tell you which is cheaper for your situation.
Can we use your cloud without buying the 24/7 SOC?
Yes. Cloud Complete is a hosting decision, not a security tier — it sits on Core IT at $175 per user per month or on Secure IT at $300, and the difference between those two numbers is exactly the $125 that separates the plans anywhere else. Nothing about the hosting changes. What changes is who acts at 2 a.m. Core IT already includes endpoint detection and response, email security, MFA, patching, 24/7 monitoring and vulnerability management, so a Core IT environment is not unwatched; Secure IT adds a staffed Security Operations Center that responds to what those tools find without waiting for you to notice.
Hosting with us does not substitute for that — our facility protects the infrastructure, not your users' inboxes and credentials. If you are working toward HIPAA, CMMC, SOC 2 or a cyber-insurance attestation, plan on Secure IT.
How many servers does a hosted desktop environment actually need, and how do they scale?
Four for most teams: a directory server, a secure access gateway, a file server and one session host. They do not all scale the same way, because they are not driven by the same thing. The directory server is driven by directory size and login concurrency rather than headcount — the platform vendor's own guidance holds a single processor core to several thousand users — so it stays at 2 vCPU and 8 GB whether you have ten people or a hundred.
What changes is that we add a second one at 50 people, for authentication redundancy rather than capacity. The secure access gateway is driven by concurrent sessions and genuinely does grow: 4 vCPU and 16 GB to 75 people, then 8 vCPU and 32 GB. The file server is capacity-bound rather than memory-bound, so its size barely moves — 4 vCPU and 16 GB to 100 people — while its storage moves with you directly, planned at 50 GB per person and billed past what the server includes at the published $75 per TB, in whole terabytes rounded up.
Session hosts are one per 25 people, with memory at 1.5 GB per person on top of 6 GB for the server itself: a twenty-person team gets 8 vCPU and 36 GB, which is $310 for the base server plus 4 GB at $6, or $334 a month, and two to three people per processor core. A second session host appears at 26 people and a third at 51. Heavy applications — CAD, video editing, large databases — change all of it, and discovery is where we establish yours.
Below roughly fifteen people a shared environment costs more to stand up than dedicated desktops, and we will say so rather than sell you the wrong one.
Do you charge a fee per location?
No. A second office costs exactly what its equipment costs — its firewall, its internet circuit, its network switches and its Wi‑Fi access points, at the published rates on this page. Nothing for the address itself.
You are not the cheapest. Why should we pay more?
We are not, and we will not pretend otherwise — several Southern California providers advertise $95 to $110 per user. Three things are worth comparing before price. First, what the number actually covers: providers who quote a low per-user rate often add per-computer and per-mailbox charges, which is how a $157 headline becomes closer to $192 in practice. Second, whether a 24/7 security operations center is included or sold separately — that layer alone runs $2,000 to $5,000 a month standalone for a 10 to 50 person company.
Third, the response standard and the on-site radius: ours is 15 minutes during business hours and 175 miles included, where 25 miles and then $185 an hour is common locally. If after comparing all of that the cheaper provider is genuinely the better fit for you, we will tell you so on the assessment call.
Is there a minimum contract size?
No minimum. We serve five-person offices and hundred-person companies on the same published rates. Several Orange County providers publish a monthly minimum in the $2,500 range, which excludes most businesses under about fifteen people. We do not.
Do you mark up hardware and software?
Software licensing is billed at the vendor's published rate with no markup. Hardware is billed at cost plus a 6.5% procurement fee covering sourcing, warranty registration, asset tagging and lifecycle records. Most providers never publish a procurement fee at all; ours is 6.5% and it is on this page — and unlike most providers, we tell you what it is.
Per-user or per-device IT pricing — which is better for us?
It depends on the shape of your office, so here is the honest version. Per-device pricing can genuinely cost less when many people share a few machines — a shop floor, a front desk, shift work — or for unattended kiosks. Per-person pricing wins when each person actually uses a computer all day, because one number covers that person's workstation, mailbox and everyday peripherals with nothing metered behind it. What to check on any per-device quote: whether each computer, mailbox, server, firewall and switch is a separate line; whether the security stack is priced on top "as needed"; whether there is a monthly minimum that quietly raises the effective rate for a small office; and what after-hours or on-site visits cost.
Then put both quotes on one page of math for your actual headcount and equipment — the unit price is not the monthly total. Our model is per-person with published rates for genuine extras, and the full arithmetic is on this page, worked in the open.
