Managed IT Services Proposal for Brightwell Manufacturing LLC

Brightwell Manufacturing is not simply looking for better IT support. You are managing a convergence of three distinct pressures — operational reliability, regulatory exposure, and internal capacity — and all three are compounding at the same time.

Your current estate is a mixed environment of on-premises servers and cloud services across one primary facility and three satellite offices, supporting approximately 85 employees. The honest assessment: nobody has a complete picture of how those systems interact, what dependencies exist, or where the single points of failure sit. That is not a criticism — it is an extremely common outcome when infrastructure grows organically over time and one person is responsible for all of it. Two unplanned outages in the quarter preceding this engagement are the predictable result. They will not be the last, absent a structured intervention.

The Q1 2027 audit is the forcing function here. Auditors will expect documented controls, evidence packages, and demonstrable remediation activity — not a to-do list. If that work has not started by November 2026, you will not have enough runway to produce what the auditors need.

The production constraint matters too. Your Q4 schedule is locked, your customers have zero tolerance for delays, and any migration event that causes more than two hours of downtime is unacceptable. That constraint shapes everything about how we plan and execute the transition — it is not a footnote.

Finally, your internal IT resource is operating well beyond sustainable capacity. Asking one person to manage day-to-day operations, chase cybersecurity compliance, and absorb the fallout from unplanned outages simultaneously is not a staffing model — it is a liability. The goal is to give that person a defined, manageable role alongside a structured partner, not to simply offload tickets.

Our first obligation is simple: keep Brightwell's production floor running. Every technical decision we make across this engagement is filtered through that constraint. Here is how we execute.

Phase 1 — Discovery & Transition Planning (September 7, 2026 to October 2, 2026) begins with a structured audit of your full IT estate — on-premises servers, cloud tenancies, endpoint inventory across your Columbus facility and all three satellite offices. We map every dependency before we touch a single system. The output is a verified baseline, not our best guess. This phase is where we build the Migration Runbooks that govern every cutover sequence, including documented rollback procedures for each system. If a migration event cannot complete within the two-hour downtime ceiling, we do not proceed — we execute rollback and reschedule the change window. That is non-negotiable.

Our recommendation on scheduling: we target all primary system cutovers during low-production windows — nights or weekends — so that your Q4 run rate, which begins in November, is never at risk. The mid-October transition deadline in your brief is achievable, and we will hold to it.

---

Phase 2 — Infrastructure Transition & Compliance Assessment (October 5, 2026 to October 30, 2026) runs the actual cutovers against the approved runbooks. Critically, the Cybersecurity Gap Assessment runs in parallel with the infrastructure transition — not after it. We do this deliberately. Your Q1 2027 audit does not leave room for a security review that starts in November. Identifying gaps now gives us the full duration of Phase 3 to remediate, gather evidence, and produce a defensible Compliance Remediation & Evidence Package before the auditors arrive.

---

Phase 3 — Active Management & Compliance Remediation (November 2, 2026 to September 3, 2027) is steady-state. We own the monitoring, ticketing, patching, and incident response. Your internal IT person is freed from firefighting and can focus on internal projects — or simply not burn out.

On the question of your team's time: we need structured access during Phase 1 for interviews and system walkthroughs, concentrated over the first four weeks. After that, day-to-day demands on Brightwell staff drop significantly. We are designed to reduce your team's operational burden, not add to it.

This engagement covers Brightwell Manufacturing LLC's full IT estate — the Columbus primary facility and all three satellite offices, serving approximately 85 employees across four sites. Every server, network device, managed endpoint, and cloud tenant in that estate falls within scope. Nothing is carved out by location.

---

What Is Covered

Infrastructure Transition & Onboarding

We will discover, document, and take managed ownership of your on-premises servers, cloud services, and network infrastructure across all four sites. Every migration event is planned and executed within the agreed two-hour maximum downtime constraint — no exceptions. Where a system cannot be cut over inside that window, we stage it across multiple change windows rather than ask you to absorb extended downtime during your Q4 production run.

Ongoing Systems Management

Once transitioned, we own day-to-day operations: patch management, capacity monitoring, backup verification, and incident response for all in-scope servers, endpoints, network devices, and cloud tenants. Your internal IT person is relieved of reactive firefighting. We carry the operational load.

Cybersecurity Compliance Program

We will assess your environment against the applicable compliance framework governing the Q1 2027 audit, identify and remediate control gaps, and produce a complete audit-ready evidence package — policies, configuration records, and logs — before that audit window opens. The framework must be confirmed by you before Phase 2 begins; scope assumes a single framework.

Helpdesk & End-User Support

All 85 employees across the Columbus facility and three satellite offices are covered under a tiered helpdesk service. Tickets are classified and resolved against contracted response and resolution targets. No employee is out of scope by site.

---

Who Buys What

Licences, hardware, and cloud subscriptions are procured by Brightwell and passed through at cost. They do not sit inside the monthly managed services fee. We will advise on what to buy and from whom — procurement decisions and vendor relationships remain yours. If a new endpoint needs to be added to the managed estate mid-term, a true-up applies to the per-user rate at the next billing cycle.

---

What Is Explicitly Excluded

The following items are outside this engagement. Any work in these areas requires a separate statement of work and separate pricing.

• Third-party software, hardware, and cloud subscription costs — passed through at cost, not included in the fee
• Development, customization, or configuration of bespoke business applications — ERP, MES, or any production system software is out of scope
• Physical cabling, structured wiring, or hardware installation at any site
• Compliance framework registration fees, external audit fees, and third-party penetration testing — these are your direct costs
• Support for personally owned devices (BYOD) not enrolled in the Meridian-managed endpoint estate
• Any work arising from a security incident that predates September 7, 2026 — pre-existing incidents are not covered under this agreement

Our recommendation: Before kickoff, Brightwell should confirm in writing which devices are enrolled in the managed estate and which are BYOD. Any gap between what's enrolled and what employees actually use will affect both helpdesk coverage and the cybersecurity compliance posture — and it is better to resolve that in Phase 1 than to find it during the Q1 2027 audit.

---

Key Dependencies

This scope holds on three conditions: your current IT person remains available during Phase 1 to provide credentials and context; all four sites have internet connectivity sufficient to support remote monitoring agents; and no in-scope system requires air-gapped or physically isolated access beyond normal site visits. If any of these conditions are not met, we will flag the impact on timeline immediately — we will not quietly absorb it.

Every commitment in this engagement is tied to a named deliverable with a fixed target date. The schedule below shows exactly what lands when — no ambiguity, no moving parts.

---

Phase 1 is discovery and planning. Nothing is touched on production systems until we understand what we're inheriting. The IT Environment Baseline Report documents every server, endpoint, network device, cloud service, and dependency across your Columbus facility and all three satellite offices. The Migration Runbooks follow directly from that inventory — per-system cutover plans that specify pre-migration checks, the exact steps to complete each migration within your two-hour downtime constraint, and defined rollback procedures if anything goes wrong mid-cutover. Both of these land by the end of Phase 1 and must be accepted before any production migration begins.

The runbooks are your fallback guarantee. Every cutover has a documented rollback path agreed in advance. If a migration cannot be completed within the two-hour window, we stop, roll back, and reschedule — no exceptions, no improvisation.

---

Phase 2 is where systems move. The Managed Systems Handover confirms that all primary systems are under Meridian management — monitoring agents deployed, backup jobs confirmed running, credentials transferred and verified. This is the deliverable your production schedule depends on, and it is the hard deadline that governs the entire transition. Concurrent with migration execution, our Cybersecurity Analyst begins structured assessment work. The Cybersecurity Gap Assessment Report identifies every control gap between your current environment and the requirements of your compliance framework, with each gap risk-rated and paired with a remediation recommendation. Both deliverables land by the end of Phase 2.

These four deliverables — Baseline Report, Runbooks, Handover, and Gap Assessment — collectively trigger the transition and assessment payment milestone.

---

Phase 3 runs the full managed service and drives you to audit readiness. The Compliance Remediation & Evidence Package is the deliverable your Q1 2027 auditor will examine. It contains implemented technical and procedural controls addressing every gap from the assessment, plus the full evidence package — policies, logs, and configuration records — in the format your audit requires. This is not a document produced the week before your audit; remediation work begins at the start of Phase 3, giving us the full run of the engagement to close gaps methodically and build defensible evidence.

The Monthly Managed Services Report runs throughout Phase 3, covering incident volume, patch status, backup success rates, uptime, and open change activity every month. It is also the deliverable that closes the engagement.

The phase schedule and deliverable target dates follow immediately below.

Phase schedule

Phase	Dates	Duration	Deliverables completed
Discovery & Transition Planning	Sep 7, 2026 – Oct 2, 2026	4 weeks	IT Environment Baseline Report; Migration Runbooks
Infrastructure Transition & Compliance Assessment	Oct 5, 2026 – Oct 30, 2026	4 weeks	Managed Systems Handover; Cybersecurity Gap Assessment Report
Active Management & Compliance Remediation	Nov 2, 2026 – Sep 3, 2027	44 weeks	Compliance Remediation & Evidence Package; Monthly Managed Services Report

Deliverables

#	Deliverable	Description	Target date
1	IT Environment Baseline Report	A documented inventory of all servers, endpoints, network devices, cloud services, and dependencies across all four sites, produced during Phase 1 discovery.	Oct 2, 2026
2	Migration Runbooks	Per-system cutover plans for each primary system, specifying pre-migration checks, rollback procedures, and the steps required to complete migration within the two-hour downtime constraint.	Oct 2, 2026
3	Managed Systems Handover	Completed transition of all primary systems to Meridian management, with monitoring agents deployed, backup jobs confirmed running, and access credentials transferred.	Oct 30, 2026
4	Cybersecurity Gap Assessment Report	A written assessment identifying control gaps between the current environment and the requirements of the applicable compliance framework, with each gap assigned a risk rating and a remediation recommendation.	Oct 30, 2026
5	Compliance Remediation & Evidence Package	Implemented technical and procedural controls addressing all gaps identified in the assessment, together with the audit-ready evidence package — policies, logs, and configuration records — required for the Q1 2027 audit.	Sep 3, 2027
6	Monthly Managed Services Report	A recurring operational report delivered each month covering incident volume, patch status, backup success rates, uptime, and open change activity across all in-scope systems.	Sep 3, 2027

The total engagement value is $72,000 across the initial 52-week term, structured as a hybrid of a one-time transition investment and a recurring managed services fee. This structure was chosen deliberately: it separates the cost of getting your estate into a known, documented, manageable state from the cost of running it month to month. You are not subsidizing our onboarding work through inflated monthly fees.

The recurring managed services component is priced on a per-user basis across your 85-employee estate. If headcount changes during the term, we true up the monthly charge at the next billing cycle — additions are billed pro-rata from the date of onboarding, and reductions take effect from the following cycle. We do not carry ghost users or back-bill reductions.

We recommend Brightwell designates a single approver with payment authority before kickoff. Every milestone payment is triggered by written sign-off, and delays in sign-off directly delay the schedule — which, given your mid-October transition target, is a risk you cannot afford.

The initial term runs 52 weeks. At expiry, the engagement rolls month to month automatically on the same commercial terms. Either party may exit on 60 days' written notice. There is no penalty for rolling onto month-to-month, and no lock-in beyond that notice period.

Third-party software, hardware, and cloud subscription costs are not included in these fees. Licensing for endpoint protection, Microsoft 365, backup storage, or any other platform is procured by Brightwell directly — or passed through to you at cost with zero markup — and will appear as a separate line item on your invoices. This keeps your managed services fee clean and auditable, which matters when you're heading into a compliance audit.

All amounts are in USD, payable net 30 days from invoice.

Payment schedule

#	Milestone	%	Amount	Trigger
1	Acceptance deposit	25%	$18,000.00	On acceptance of this agreement
2	Transition & assessment completion	8%	$5,760.00	On completion: IT Environment Baseline Report; Migration Runbooks; Managed Systems Handover; Cybersecurity Gap Assessment Report
3	Monthly managed services instalment (1 of 11)	7%	$5,040.00	On the scheduled date
4	Monthly managed services instalment (2 of 11)	6%	$4,320.00	On the scheduled date
5	Monthly managed services instalment (3 of 11)	6%	$4,320.00	On the scheduled date
6	Monthly managed services instalment (4 of 11)	6%	$4,320.00	On the scheduled date
7	Monthly managed services instalment (5 of 11)	6%	$4,320.00	On the scheduled date
8	Monthly managed services instalment (6 of 11)	6%	$4,320.00	On the scheduled date
9	Monthly managed services instalment (7 of 11)	6%	$4,320.00	On the scheduled date
10	Monthly managed services instalment (8 of 11)	6%	$4,320.00	On the scheduled date
11	Monthly managed services instalment (9 of 11)	6%	$4,320.00	On the scheduled date
12	Monthly managed services instalment (10 of 11)	6%	$4,320.00	On the scheduled date
13	Monthly managed services instalment (11 of 11)	6%	$4,320.00	On the scheduled date: Monthly Managed Services Report
	Total	100%	$72,000.00

Commercial summary

Item	Detail
Total investment	$72,000.00
Acceptance deposit	25% ($18,000.00) on signature
Payment terms	Net 30 days
Start	September 2026
Duration	52 weeks
Initial term	12 months
Renewal	Rolls month to month
Notice to end	60 days

The honest answer to these questions is not a list of badges — it is our method, and our method is documented before any engineer touches your environment.

Knowledge retention starts on day one. Every system we manage is backed by a living runbook, updated continuously as we learn your estate. If an engineer moves on, their replacement inherits a complete, tested document — not a conversation or a sticky note. Brightwell's environment, across your Columbus facility and three satellite offices, will be fully documented in writing before we close Phase 1. That documentation is yours. It does not leave with us.

The single biggest risk in a managed services transition is undocumented tribal knowledge. We build the documentation first, on purpose, before any cutover happens — so that risk never materializes.

On client profile: we work with organizations in operational environments where downtime has a direct production cost. That is the profile we plan for. Your two-hour maximum downtime constraint during migration is not unusual for us — it is exactly the kind of hard boundary that shapes how we sequence change windows and build rollback procedures into every runbook.

On credentials: rather than list certifications here, we will provide current attestation documentation as part of pre-contract due diligence. If you or your insurer need specific security or compliance documentation before signing, tell us and we will produce it.

---

What we will not do is ask you to trust a logo on a slide deck. The IT Environment Baseline Report and Migration Runbooks are verifiable. Your Q1 2027 audit either passes or it does not. That is the accountability we operate under.

To move forward, sign and return the enclosed agreement along with your 25% acceptance deposit of $18,000. Once both are received, the engagement starts September 7, 2026 — no staging period, no provisional kick-off.

---

Before day one, we need three things from you:

1. Network access credentials — read-only initially — for your on-premises servers and cloud tenants across all four locations
2. A named point of contact at Brightwell who can authorize change windows and escalate internally during the transition
3. Your current IT person's availability for a structured handover session in Week 1 — their institutional knowledge of the existing estate is the fastest path to an accurate baseline

The September 7 start date is firm. Your mid-October transition target and the Q1 2027 audit timeline both depend on it. Slipping the start slips everything downstream.

Your first invoice — the acceptance deposit — is due on net 30 terms from agreement execution. The transition milestone payment follows on completion of Phase 1.

To proceed, or to schedule a pre-signature call with our team, reply directly to this proposal.