Multi-site managed IT: one scope, many sites

The site is the unit of scope, not the company

A group with forty locations usually contracts as one legal entity, and the compliance duties attach to that entity rather than to the address count. One covered entity can hold a single business associate agreement covering every location whose systems a provider touches, because 45 CFR 164.308(b)(1) requires satisfactory assurances before a business associate may create, receive, maintain or transmit electronic protected health information, and 45 CFR 164.504(e)(2)(ii) pushes the same restrictions down to that business associate's own subcontractors. What the agreement must not do is leave the locations implicit. A master services agreement and its business associate terms should attach a site schedule that names each address, and a responsibility matrix that says which of those addresses the provider actually operates. The practical consequence is that opening a site is a contract change, not a purchase order: if the schedule is not updated, the new location is either uncovered or covered by language nobody has read.

• One legal entity, one programme: sites are locations of the entity, not entities of their own.
• Attach a site schedule naming every address, and a matrix saying what the provider owns at each one.
• Treat a new address as a contract change — amend the schedule before the site goes live.
• A supplier's certificate or attestation may name a scope narrower than your site classes; read the scope statement, not the certificate.

Where the service really begins: the demarcation point

The circuit does not arrive at your rack. Under 47 CFR 68.105 the minimum point of entry is either the closest practicable point to where the wiring crosses the property line or the closest practicable point to where it enters a multiunit building, and in multiunit premises the carrier may place the demarcation point at that minimum point of entry. Where it does not, the premises owner determines the location and whether there is one demarcation point for all customers or a separate one for each — subject to the rule that a customer's point may not sit further than twelve inches inside where the wiring enters that customer's premises. The same section gives the owner a right to the information: the carrier must disclose where the demarcation point is within ten business days of a request, and if it does not, the owner may presume it at the minimum point of entry. Where the demarcation point is not already there, the carrier must negotiate a relocation in good faith and conclude those negotiations within forty-five days. For a portfolio this is the fact that decides who pays for the last hundred feet: in a strip centre, a mall or an office tower the handoff is often in a telecom room several floors or several units away, and the extension from there to your equipment is a build, with conduit, riser, firestopping and a landlord's permission attached to it.

• Record the demarcation point for every site; do not assume it is in the suite.
• State who builds and who pays for the extension from the demarcation point to the rack.
• Name the test point that defines an outage, and require the provider to test at the demarc before calling a fault customer-side.
• In multiunit premises, ask the landlord whether the demarcation point is one for the building or one per tenant.

One availability figure cannot describe forty buildings

An availability target is only meaningful once it is converted into time. Expressed over a year of 8,760 hours, a target of 99.9% permits a little under nine hours of downtime, and 99.99% permits a little under one. Both figures are arithmetic on the promise, not a measurement of any particular site, and the arithmetic is the easy part. The hard part is the measurement point. A provider can meet its commitment at the carrier demarcation while the location is unusable because the local switch, the in-building cabling or the wireless is down, and nothing in a demarcation-measured service level obliges anyone to fix that. The second variable is geography. A site inside a metropolitan dispatch area and a site three hours from the nearest technician do not have the same achievable restoration time whatever the contract says, so commitments belong to site classes rather than to the portfolio, and any location outside normal dispatch coverage should be listed by name with its own terms.

• Convert every availability figure into permitted downtime per year before comparing offers.
• Say where the clock is measured: carrier demarcation, managed edge device, or an end-user test point.
• Set commitments by site class, and name the sites that fall outside normal dispatch coverage.
• Write down what is excluded — utility power, building access, customer LAN — and what happens when an exclusion is the cause.

The site schedule and the responsibility matrix

Two documents carry a multi-site engagement. The site schedule is the inventory: for each address, the suite and rack, the circuit identifier and carrier, the access technology and committed rate, the demarcation point, who owns the equipment on the premises, who is responsible for power and cooling, the landlord's access rules and hours, the named business owner and escalation path, and the site class that sets the service level. The responsibility matrix is the answer to the question a dispute turns on: at this site, at this layer, whose job is it. Both should be living documents with a change-control clause, because the most common failure in a portfolio is not a provider that performs badly but a schedule that stopped matching the estate two acquisitions ago.

• One row per site, one owner per layer, and a revision date on the schedule.
• Record access constraints — hours, escorts, lifts, loading docks — because they set what a dispatch can achieve.
• Keep the schedule in the customer's own repository, not only in the provider's portal.

Opening a site is a staged project, not an order

A new location is delivered in stages, and each stage produces an artefact a buyer can accept or reject. The survey records the demarcation point and the building entry, whether the address is served by existing facilities or needs construction, what extension is required, where the rack goes, power and cooling, landlord approvals and access rules. The order fixes the circuit identifier, the target ready-for-service date and the tests that will be run. Staging fixes the asset tag, the baseline configuration, the addressing for that site and a bench test before anything ships. Cutover fixes the window, the rollback deadline, the approvers and the test script. Acceptance fixes the criteria, the period for reporting latent defects and the milestone at which recurring billing starts — which should be ready-for-service or acceptance, never the day the equipment left a warehouse. One expectation is worth correcting before a portfolio is planned: there is no universal installation interval. A location with facilities in place and a location that needs construction are different products, so the interval to hold a provider to is the one its carrier accepts, with the clock defined — business or calendar days — and the date it starts stated in the order.

• Require a survey deliverable: demarcation point, construction need, rack, power, access, approvals.
• Fix the billing start milestone in writing; shipment is not acceptance.
• Ask which clock the installation interval runs on, and when it starts.
• Keep the old service live until the replacement passes its acceptance test.

Closing a site is the half nobody writes down

Portfolios shrink as well as grow, and the closure path is usually missing from the agreement. Four different events get treated as one: suspending service, shutting a site temporarily, cancelling a circuit, and decommissioning a location for good. They carry different billing consequences and different recovery obligations, so the contract should name them separately and say what each requires. A controlled closure reconciles the inventory first — circuits, equipment, licences, addresses, SIMs, keys and credentials — confirms replacement connectivity before anything is disconnected, and issues the disconnect order with its effective date and any early-termination consequence. It then removes what outlives the site: monitoring, tunnels, firewall objects, DNS records and remote-access accounts, with equipment either returned or wiped and certified, and a final reconciliation against the last invoice. Skipping that sequence leaves two liabilities that surface months later: a closed location still billing, and a decommissioned one whose credentials still work.

• Distinguish suspension, temporary shutdown, cancellation and decommissioning in the agreement.
• Reconcile the inventory before disconnecting anything.
• Remove monitoring, tunnels, firewall objects, DNS entries and remote access as named closure tasks.
• Require a wipe-or-return certificate for any equipment that held data.
• Reconcile the final invoice against the schedule, per site.

The compliance layer multiplies by address

Regulatory obligations do not scale with headcount; they scale with the systems and people at each location. A HIPAA risk analysis must be an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of the entity's information — 45 CFR 164.308(a)(1)(ii)(A) — and for a group operating forty sites that environment includes each location's connectivity, endpoints and local workflow, so an assessment written at head office and applied downwards is incomplete. The inventory discipline is published too: NIST SP 800-53 Revision 5 requires an inventory that accurately reflects the system and avoids duplicate accounting (CM-8), updates it as components are installed and removed (CM-8(1)), and separately requires an inventory of organisational systems (PM-5). In practice that means a location-attributed configuration database — site identifier, address, system and asset owner, network segment, device class, support tier, and whether the item is inside or outside the managed scope. Breach notification adds a different axis: duties attach by the residence of the affected individuals, and states define personal information, the trigger, the deadline and the regulator to be notified differently, so one incident across a twelve-state footprint is twelve analyses rather than one. The agreement should therefore require jurisdictional analysis after an incident, name who drafts the notices, and allocate the cost of them.

• Scope the risk analysis to the whole estate, site by site, not to the head office.
• Require a location-attributed asset inventory, updated on installation and removal.
• Ask which subcontractors are dispatched to which sites, and see the flow-down terms.
• Put jurisdictional breach analysis and notice drafting in the incident clause.

What to send before a portfolio is priced

A portfolio quote is only as good as the inventory behind it, and the inventory is the buyer's to produce. Start with the site schedule: address with suite, rack location, access hours, landlord contact and the site's operational criticality. Add the circuit inventory per site with identifiers, carrier, technology, committed rate and contract end dates, because the renewal dates decide the order in which sites can move. Add asset counts per site by type, the applications that cannot stop and the sites that depend on them, the compliance regime that applies at each address, and the existing agreements with their notice clauses. HighGround works from that inventory to scope each location separately and to test whether a single agreement or a staged programme fits the estate. HighGround may receive provider compensation on completed purchases, and an inquiry places no order and switches no supplier.

• Site schedule with address, suite, rack, access rules and criticality per location.
• Circuit inventory per site with identifiers and contract end dates.
• Asset counts per site, and the applications that cannot stop.
• Existing agreements with notice clauses, and the dates you have to act on.

PUT THE OPTIONS SIDE BY SIDE

Your comparison checklist

Common questions