Senior IT-director judgment and hands-on execution for companies of 10 to 250 people. A few focused hours a week, and everything written down.
Most businesses between ten and a couple hundred people have the first job covered. Somebody resets passwords, swaps out the dead laptop, calls the internet company when the line drops. The computers work.
What they usually do not have is the second job: one accountable person who knows what the company pays for, who can get in, and what is at risk.
That second job is the one I take. I do not resell hardware, software, or anybody's managed service, so there is nothing to steer you toward. I make money paying attention.
The part that isn't fractional is the accountability.
Kris Ostopchuck, Fractional IT LLC
Four questions. Yes or no.
Depending on how we work together, you receive some or all of four things you can hold, hand to your board, or give to the next provider. Here is what each one looks like — reduced, but real in shape. The samples below are illustrative, not taken from any client.
A fixed-scope document of what exists, who can get into it, what is at risk, and what to do next — in priority order. You keep it whether or not we continue.
Every recommendation carries a rationale, a cost, and the alternative that was considered — and how to reverse it. That is what makes a decision defensible a year later.
Approved · Owner
A living list, ranked, each line with an owner, a status, and a rough cost. It is the agenda for every report that follows, so there are never surprise findings.
| # | Risk | Likelihood | Impact | Owner | Status |
|---|---|---|---|---|---|
| R-01 | Backups have never been test-restoredRough cost: time only — one restore drill | Likely | High | IT Director | In progress |
| R-02 | Accounts for former staff still enabledRough cost: time only — plus a written offboarding step | Likely | High | Office Manager | Open |
| R-03 | Company web domain registered to one person's private accountRough cost: low — registrar transfer and a shared record | Possible | High | Owner | Scheduled |
| R-04 | One shared admin password on the firewallRough cost: low — named accounts, password vault | Possible | High | IT Director | Closed |
Written for an owner or CFO, not for another technician. What changed, why, what is next, and what needs a decision from you. Quarterly, the roadmap and budget get the same treatment.
Thirty minutes is enough to tell whether the written baseline is worth doing for your company.
Each area is written up the same way — what exists, what is at risk, what changed. The assessment is where most engagements begin.
Executive IT direction without the full-time hire.
Budgeting. A 12-to-24-month roadmap. Vendor and MSP management — contracts, renewals, and accountability for what they promised. Leadership reporting a CFO or owner can act on without a translator.
Infrastructure that is stable, documented, and manageable.
Windows Server and Active Directory. Microsoft 365 — Exchange, SharePoint, Teams. Intune device management. Cisco Meraki networking. Hybrid on-premises and cloud, kept in a state someone else could inherit.
Practical security improvement, grounded in your actual risks.
A living risk register. Control validation — checking that the protections you pay for are actually on. Patch and vulnerability oversight, admin-access review, vendor risk. Insurance and client security questionnaires answered from documentation instead of memory.
Order and governance for Microsoft 365.
Licensing that matches what you actually use. Access control that reflects who works here today. Offboarding that genuinely shuts things off — mail, files, devices, and the logins nobody remembers.
Know where you stand — and what to do next.
A fixed-scope, written baseline of what exists, what is at risk, and a prioritized roadmap. It is a useful document whether or not you continue with me, and it is where pricing for anything further is set out in writing. This is where most engagements begin.
Start with an assessmentOwn your IT — the access, the documentation, and the plan.
Moving on from a previous provider: securing admin access, verifying the backups, documenting what exists so it belongs to the company and not to whoever set it up. Also incident response and recovery — ransomware, email compromise — handled as structured containment with a written log, by someone who has done it before.
Four phases, each with something on paper at the end of it. Nothing gets changed before it has been understood.
Find out what exists, who can get into it, and what is genuinely at risk. Domains, accounts, devices, vendors, subscriptions, admin rights — all of it inventoried before anything is touched.
Yields: the written baseline and the first ranked risk register.
Secure administrative access so it belongs to the company. Confirm that backups actually restore. Close the accounts that should have been closed. Catch the renewals and expirations already in motion.
Yields: a change log — what changed, why, and how to reverse it.
Put order around the environment: licensing matched to use, access control that mirrors the org chart, an offboarding routine that shuts things off, vendors held to their contracts, a renewal calendar somebody reads.
Yields: the decision log and the first monthly owner's report.
Work the risk register in priority order against a 12-to-24-month roadmap and a budget your CFO can defend. Monthly reports for owners; quarterly roadmap and budget review.
Yields: monthly reports, quarterly roadmap and budget, a register that gets shorter.
The environment, the decisions, and the risks are written down as we go — not reconstructed afterward. If I were hit by a bus tomorrow, the next person could pick up the binder and keep going.
Every recommendation carries a rationale, a cost, and the alternative that was considered. It has to stand up to leadership, an auditor, an insurer, or a new provider reading it cold.
Pricing is set out in the written assessment, where it can be tied to what you actually have — not on a web page.
Fixed scope, fixed deliverable. The written baseline, the ranked risk register, and a prioritized roadmap. Yields Deliverables A and C.
You keep the document either way.
Start with an assessmentA set number of hours each month for leadership, infrastructure, and reporting. The register gets worked; the owner's report arrives every month.
Yields all four deliverables, every month.
Defined scope with a defined end — a migration, a takeover from a previous provider, a cleanup after an incident.
Documented as it happens, handed over when it's done.
It needs a few accountable hours. That is what a fractional arrangement buys: the judgment, without the headcount.
Not sure which model fits? Thirty minutes will settle it, and the answer may be "none yet."
I have spent my career doing the hands-on work rather than advising on it from a distance: building, securing, and running IT for small and midsize organizations, and leading recoveries from ransomware and email compromise when the phone rang at the wrong hour.
That matters for a fractional role because the job is not to produce recommendations. It is to make the change, write down what was done, and be the one who answers for it next month. I am on-site for the greater Philadelphia region and remote for everyone else.
Most engagements go wrong on the things nobody said out loud at the start. These are mine.
These apply to every engagement, in writing, before work starts.
They come up often enough to deserve a written answer. Here they are — before the call rather than after it.
Good. Keep them. This practice does not replace the person who fixes things; it adds the person that work answers to — the one who owns the plan, the contracts and the budget. In my experience the in-house technician is usually relieved when someone finally owns the contracts, the budget and the risk conversations — nobody had asked them to, and they never had the hours for it.
Fixing things and being in charge are two different jobs. Both of them still get done.
Too small for a full-time one. But the insurer's questionnaire, the renewal notices, the admin passwords and the departures all arrive at a thirty-person company exactly as they do at a three-hundred-person one — there is simply nobody whose job it is to catch them. The arithmetic is in the engagement section above; the short version is that the role is needed, the headcount is not.
Small companies don't have smaller risks. They have fewer people watching them.
It depends on what exists and what is at risk, and a number guessed at on a web page would be exactly the kind of number this practice avoids. Almost every engagement therefore starts with the written assessment: fixed scope, a document you keep, and a plain statement of what is worth doing and what it would roughly cost — before anything ongoing is agreed. The exceptions are the ones that can't wait, like a takeover from a departing provider or an active incident.
From there the options are a monthly retainer with a set number of hours, a defined project, or nothing further, because the document said enough.
Start with an assessmentThen the next person picks up the binder and keeps going. The environment, the decisions, the access, the vendor list, the risk register — all written down, in the company's own systems, in plain language, so a new provider could read it cold on a Monday morning.
The point of having someone in charge of IT is that the company stops depending on any one person's memory. That includes mine.
Anything not answered here is a fair question for the thirty minutes.
No forms, no pitch deck. Tell me what you have and who currently looks after it, and I'll tell you honestly whether an assessment is worth your money.
On-site across the greater Philadelphia region. Remote for everyone else.
Booking opens a Microsoft Bookings page in a new tab. Prefer email? A few lines about your situation is plenty to start.