[{"data":1,"prerenderedAt":185},["ShallowReactive",2],{"publication:en:P118":3},{"meta":4,"copy":17,"relatedArticles":143,"terms":177,"term":178,"resourceParent":179,"glossaryParent":182},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P118","\u002Fblog\u002Fsecurity-maintenance-sla","article","website security maintenance agreement","Website security maintenance agreement: scope, hours and handover","Website security maintenance agreement checklist","Define assets, recurring tasks, service hours, response measures and change authority. Use an operational checklist before agreeing website maintenance scope.",[13,14],"\u002Fcare","\u002Fone-time-help","2026-06-28","2026-10-30",{"intro":18,"sections":19,"checklist":96,"faq":105,"links":115,"sources":135,"cta":138},"A website security maintenance agreement should define covered assets, recurring tasks, authorized actions, service hours and evidence of completion. If it includes an SLA, distinguish receipt of a request, first response, starting work and restoring a business function. The clock, timezone, dependencies and exclusions must be understood before either party relies on a timing measure.",[20,30,66,72,82,90],{"title":21,"paragraphs":22,"sources":26},"Begin with the assets and repeated work being commissioned",[23,24,25],"Identify the websites, hosting, accounts, components and integrations within scope. Define the recurring tasks in plain language: checking a backup result, applying an approved update, reviewing access or assessing a notification. “Website security” alone leaves too much room for different expectations.","Separate routine maintenance, an unexpected fault and a suspected security incident. They may need different authority, contacts, evidence and additional work. A recurring package does not automatically include every possible investigation, custom code correction or recovery exercise.","ASD ACSC’s managed-provider guidance discusses clear security expectations and the boundaries of provider access. Apply those principles to the operating arrangement you actually need. This guide supplies practical questions for defining work; it does not draft binding terms or establish universal legal requirements.",[27],{"label":28,"url":29},"ASD ACSC (reviewed April 2023): managing security with a service provider","https:\u002F\u002Fwww.cyber.gov.au\u002Fpublication\u002Fhow-to-manage-your-security-when-engaging-a-managed-service-provider",{"title":31,"paragraphs":32,"table":35},"Specify the service fields that an operator can verify",[33,34],"Write down who requests work, who approves changes and who receives results. Include the contact channel and what information is needed for a usable request. Record how to proceed when the usual approver is unavailable instead of leaving a technical operator to infer authority.","The original worksheet below helps both parties check that the operating arrangement is understandable. It is not a description of automatic CyberFixCrew coverage or a promised service level. Populate it from the actual offer and agreed responsibilities.",{"caption":36,"headers":37,"rows":41},"Website maintenance operating-agreement worksheet",[38,39,40],"Field","Definition to agree","Evidence or practical check",[42,46,50,54,58,62],[43,44,45],"Covered assets and tasks","Specific systems and repeated operations","Inventory and readable task list",[47,48,49],"Service hours","Days, timezone, holidays and contact channel","Same schedule understood by requester and provider",[51,52,53],"Timing measure","Receipt, response, start or restoration","Defined start, end, pause and dependency conditions",[55,56,57],"Severity and authority","Who classifies impact and approves action","Contact route and escalation ownership",[59,60,61],"Changes and acceptance","Permitted actions, preparation and completion checks","Change record and relevant functional evidence",[63,64,65],"Reporting and exit","Results, exceptions, account\u002Fevidence handover","Useful record and supported access-closure process",{"title":67,"paragraphs":68},"Distinguish the clocks before comparing service promises",[69,70,71],"An automated receipt confirms a submission was accepted by a channel. A first response may acknowledge and qualify the problem. Starting work means an operator has begun the relevant activity. Restoration describes an agreed function returning under stated conditions. These events can occur at different times and should not be treated as interchangeable.","Define whether time runs continuously or only during agreed service hours, including timezone and holidays. Establish what information makes a request actionable and what happens while waiting for an owner, developer, host or other provider. A pause rule should be visible to both parties, not discovered only after a disputed outage.","Do not compare a short first-response target with a different offer’s restoration target as if they measure the same result. Any escalation, remedy or contractual effect needs its own appropriate review. The operational point is that everyone can reconstruct which event and interval were actually measured.",{"title":73,"paragraphs":74,"sources":78},"Define how routine changes and unexpected work are accepted",[75,76,77],"For updates or configuration changes, identify the preparation, authorization, relevant dependencies and checks after implementation. WordPress’s update guidance includes preparation and backup; the actual website may also need form, store or external-integration acceptance under controlled conditions.","State what counts as completion. A setting changed, a component updated and a business workflow verified are different observations. Record limitations when the necessary provider or test environment is unavailable instead of declaring a broad success from a version number alone.","For a fault or suspected incident, define who may limit a function, preserve evidence and authorize additional scope. A maintenance arrangement should make the next decision easier, without implying that every employee can approve sensitive operations or that every event is included at no extra cost.",[79],{"label":80,"url":81},"WordPress: preparation, backup and update process","https:\u002F\u002Fdeveloper.wordpress.org\u002Fadvanced-administration\u002Fupgrade\u002Fupgrading\u002F",{"title":83,"paragraphs":84,"example":87},"Use a fictional request to check that both parties read the clock the same way",[85,86],"Walk through an invented out-of-hours request, an incomplete report and a dependency on another provider. Ask the requester and operator to identify the measured start and end events. Differences in their answers reveal ambiguity before a real incident occurs.","Keep the exercise separate from a live customer outage. It tests the clarity of the arrangement rather than the actual performance of a supplier or a platform. Record the definitions and questions requiring clarification.",{"title":88,"text":89},"Illustrative example: elapsed time and service time differ","A fictional arrangement operates Monday to Friday in one agreed timezone. A request arrives on Saturday at 14:00; the defined service clock begins on Monday at 09:00. A meaningful first response occurs at 09:15, work begins at 10:00 and the agreed function is restored at 12:00. Those are distinct events: 15 minutes to first response on that service clock and 46 hours of elapsed time from submission to restoration. These invented times are not CyberFixCrew commitments or a measured provider result.",{"title":91,"paragraphs":92},"Keep reporting, ownership and exit useful throughout the relationship",[93,94,95],"A recurring report should identify the reviewed period, tasks completed, evidence, incidents, exceptions and decisions still needed. It should distinguish a missed check, an excluded system and a verified passing result. Keep the owner of each unresolved item and its next review visible.","Agree on the accounts, licenses, configuration records and protected evidence needed for continuity when the relationship changes. Temporary access closure and preservation duties need coordination with the actual owners. A provider handover should help maintain the business workflow rather than leave ownership discoverable only during an outage.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide. Our practical Israeli website and digital-infrastructure knowledge helps define the technical scope and handover of maintenance work. Describe the systems, desired recurring tasks and operating constraints first. Actual hours, response measures, responsibilities and pricing are agreed for the engagement; this article does not create a service commitment.",[97,98,99,100,101,102,103,104],"List the actual covered systems and recurring tasks.","Separate routine work, faults and suspected security incidents.","Define contact channel, approvers and escalation owners.","Specify service hours, timezone and the event each metric measures.","Clarify clock starts, pauses, dependencies and completion.","Agree on change preparation and controlled acceptance evidence.","Test understanding with a fictional request scenario.","Document reporting, open exceptions, licenses and exit ownership.",[106,109,112],{"question":107,"answer":108},"Does a first-response target guarantee that the website will be restored by then?","No, receipt, first response, starting work and restoration measure different events. Confirm the exact definition and agreed operating conditions.",{"question":110,"answer":111},"Does having a maintenance plan mean someone monitors the website at all hours?","Only if the actual arrangement explicitly includes that coverage and responsibility. A plan name, alerting tool or contact channel does not establish continuous human response.",{"question":113,"answer":114},"Is every security incident included in routine maintenance?","Do not assume so: define incident triage, authority, included work, additional scope and provider dependencies in the actual arrangement.",[116,119,122,125,128,130,132],{"path":117,"label":118},"\u002Fblog\u002Fwebsite-security-cost","Separate recurring work from other cost components",{"path":120,"label":121},"\u002Fblog\u002Fchoose-website-security-provider","Evaluate fit, evidence and supplier boundaries",{"path":123,"label":124},"\u002Fblog\u002Fwebsite-security-for-agencies","Apply the operating record across agency clients",{"path":126,"label":127},"\u002Fblog\u002Fvendor-access-review","Plan access and supplier exit",{"path":13,"label":129},"Review existing maintenance-plan scope",{"path":14,"label":131},"Review one-time work separately",{"path":133,"label":134},"\u002Fresources\u002Fmonthly-security-checklist","Use an English owner and evidence record for recurring work",[136,137],{"label":28,"url":29},{"label":80,"url":81},{"title":139,"description":140,"button":141,"type":142},"Define a maintenance scope the business can rely on","Describe the systems, recurring tasks and operating constraints. CyberFixCrew can clarify technical responsibilities, service arrangements and completion evidence before work is commissioned.","Discuss maintenance scope","maintenance",[144,153,161,169],{"id":145,"path":146,"title":147,"description":148,"category":149,"artwork":150,"order":151,"publishedOn":152},"P099","\u002Fblog\u002Ffree-scan-vs-paid-audit","Free website scan vs paid security audit: compare actual coverage","Compare website scans and security audits by access, scope, evidence and retesting. A price or green score alone does not show what was verified.","operations","security-diagnostics",24,"2026-07-14",{"id":154,"path":155,"title":156,"description":157,"category":149,"artwork":158,"order":159,"publishedOn":160},"P100","\u002Fblog\u002Fwebsite-monitoring-alerts","Website security monitoring alerts: signals, owners and action","Plan website monitoring around availability, business workflows, access and backups. Assign recipients, response scope and controlled alert acceptance.","performance",18,"2026-06-12",{"id":162,"path":163,"title":164,"description":165,"category":149,"artwork":166,"order":167,"publishedOn":168},"P190","\u002Fblog\u002Fmaintenance-vs-security","Website maintenance vs website security: coverage and responsibility","Compare website maintenance and security by tasks, owners and evidence. Review updates, access, recovery and incidents without assuming package coverage.","plan-care",15,"2026-05-27",{"id":170,"path":171,"title":172,"description":173,"category":149,"artwork":174,"order":175,"publishedOn":176},"P121","\u002Fblog\u002Fnew-business-security-starter","Cybersecurity checklist for a new business: a launch-ready foundation","Build a new business security foundation around account ownership, email, website data and recovery. Use launch gates, synthetic checks and named owners.","websites",13,"2026-05-11",[],null,{"path":180,"label":181},"\u002Fresources","Website security resources and templates",{"path":183,"label":184},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058549]