Frequently Asked Questions About Tech Group

Tech Group is a Vermont-based managed IT services, cybersecurity, and technology consulting firm headquartered in South Burlington. We have supported Vermont organizations since 1992.

For organizations without internal IT staff, we operate as your IT department: servers, workstations, network, cloud, security, and the help desk your people call when something stops working.

For organizations that already have IT staff, we work alongside them. Sometimes that means owning a specific layer such as backup, monitoring, or after-hours escalation. Sometimes it means adding capacity for a project, a compliance push, or coverage while someone is out.

Either way, one team is accountable for the outcome. That is the part most organizations are actually buying.

Since 1992. Three decades in a single market is unusual in this industry, and it changes how we work. We are still supporting organizations we onboarded in our first decade, which means we live with the consequences of the recommendations we make. That tends to produce more conservative advice and fewer forklift upgrades than a firm that expects a three-year client relationship.

The company was founded by Steve Loyer and his partners as Computer Services of Vermont, and was re-formed as Tech Group in 2006. In October 2020, Tech Group joined New Charter Technologies, a national partnership of independently operated IT and cybersecurity firms.

We describe it as the Human Side of IT, and it is a hiring standard before it is a marketing line.

Technical skill is the entry fee. What separates a good technology partner from an adequate one is judgment and conduct: whether an engineer explains a decision in language a business owner can evaluate, whether the person answering the phone treats a frustrated user with respect at 4:45 on a Friday, and whether anyone tells you the truth when the honest answer is “we should have caught that.”

We also start upstream of the technology. Before recommending a solution we want to understand what the business is trying to do, who the stakeholders are, and where the actual friction is. Plenty of IT problems turn out to be process problems wearing a technical costume, and buying hardware does not fix those.

Yes. Tech Group joined New Charter Technologies in October 2020.

New Charter is a partnership of independently operated IT and cybersecurity companies across North America, founded in 2019 and backed by Oval Partners. It now includes roughly 30 operating companies serving about 50 markets, with approximately 1,300 employees. (Figures per newchartertech.com, as of August 2026.)

The model matters more than the numbers. New Charter is not a roll-up that absorbs brands into a call center. Each company keeps its own name, its own leadership, and its own client relationships, and shares engineering depth, security tooling, and back-office scale with the others. That is why your Tech Group team still looks and sounds like Tech Group.

Locally, very little. Same engineers, same phone number, same building on Gregory Drive.

What changed is what stands behind them.

Engineering depth beyond one market. Every organization eventually runs a project it has never run before. Our engineers can pull specialists from across the partner network rather than learning on your budget.

Security tooling at national scale. Detection, monitoring, and response tooling is bought and operated at the scale of the full partner group, not the scale of one Vermont company.

Coverage where your people are. If you open a location outside our region, you do not have to change IT partners.

Continuity you can plan around. Ownership succession and long-term investment are settled questions here. That matters when you are choosing a partner for a five-year infrastructure plan rather than a one-year contract.

Vermont is our home market and where most of our clients are, particularly Burlington and Chittenden County. We support organizations throughout New England, and through the New Charter partner network we can cover multi-site clients well beyond it.

If you have offices in several states, you do not need several IT vendors. One relationship, one point of accountability, engineers who can actually get to the site.

Managed and co-managed IT. Proactive monitoring, patch management, endpoint protection, backup management and auditing, server and workstation support, network administration, help desk, and regular executive reporting.

Cybersecurity. Around-the-clock monitoring through a 24×7 Security Operations Center, identity and endpoint protection, vulnerability scanning, penetration testing, security risk assessments, and incident response.

Compliance and CMMC support. Gap assessments and control implementation for organizations working under HIPAA, PCI DSS, NIST, or CMMC obligations.

AI enablement. AI readiness assessments, Microsoft Copilot deployment, AI security and governance, workflow automation, and role-based training.

Strategy and consulting. vCIO services, technology roadmaps, budget and lifecycle planning, business process optimization, and IT due diligence support for private equity firms and their portfolio companies.

Cloud and Microsoft. Microsoft 365 and cloud migrations, tenant administration, identity management, and licensing strategy.

Business continuity and disaster recovery. Backup design, recovery planning, and continuity testing.

Managed application services. Ongoing management and support of the business applications your operation actually runs on.

Custom software and business solutions. Application development, integration, and document management.

Infrastructure and end-user services. Network and wireless design, firewall and perimeter management, server and storage projects, Apple and mixed-platform support, and VoIP phone systems.

Web design, development, and hosting.

Some of this is delivered by our Vermont team, and some draws on specialists from across the New Charter partner network. From your side it works the same way either way: one agreement, one point of accountability, one team you call.

Our largest industry concentrations are legal, healthcare, financial services, construction, manufacturing, nonprofit, state and local government including municipalities, and private equity along with the portfolio companies they own.

We also support academia, biotech, engineering, accounting, insurance, and software development firms.

Industry experience matters most where the rules are external. A law firm’s obligations around client confidentiality, a healthcare organization’s HIPAA exposure, a manufacturer’s uptime tolerance on the production floor, a municipality’s public records and procurement requirements, and a private equity firm’s need for consistent security posture across a portfolio are all different problems. They are not solved by the same template with a different logo on the cover.

Frequently, and it is one of our strongest engagements.

Internal IT people are rarely short on ability. They are short on hours and on coverage. The work that consumes them is also the work that is easiest to systematize: patching, monitoring, alert triage, after-hours escalation, onboarding and offboarding, and coverage during vacation or leave.

In a co-managed arrangement we take those layers so your staff can spend their attention on the systems and relationships only they understand. We also give them something most internal teams never get, which is a peer group. Your IT manager gets to compare notes with engineers who see hundreds of environments instead of one.

A vCIO, or virtual Chief Information Officer, is a senior advisor who owns the strategic side of technology without being a full-time executive hire. The work is budget planning, lifecycle forecasting, risk review, vendor evaluation, and a roadmap your leadership team and board can evaluate without a translator.

You probably need one if technology spending arrives as a series of surprises, if nobody can say when the current server or firewall reaches end of life, if your cyber insurance renewal produced questions nobody could answer, or if you are being asked to approve IT investments you cannot independently assess.

You probably do not need one if you already have an IT director operating at that level. In that case what you likely need is capacity underneath them, not another strategist above them.

Our security work covers monitoring and detection through a 24×7 Security Operations Center, identity and endpoint protection, vulnerability scanning, penetration testing, security risk assessments, CMMC and compliance gap assessments, and incident response.

The order matters. Most organizations buy tools before they know what they are protecting or who can currently reach it. An assessment first tells you which controls actually reduce your exposure and which ones are simply a line item. We would rather you spend less on the right three things than more on the wrong seven.

We can help with the technical side, and it is worth being precise about where the line falls, because this industry is loose with the word compliant.

No IT provider can make your organization compliant. Compliance is an organizational obligation. It involves your policies, your counsel, your training, your contracts, and your people, and most of that sits outside any technology vendor’s control.

What a technology partner can do is implement the technical controls a framework calls for, document how they are configured, monitor them over time, and produce the evidence your auditor, prime contractor, or cyber insurance carrier asks for. That is the commitment we make, and it is the one we can keep.

Organizations in regulated industries should also have counsel involved and appropriate agreements in place, such as a Business Associate Agreement where HIPAA applies.

CMMC, the Cybersecurity Maturity Model Certification, is the U.S. Department of Defense program that verifies whether contractors and subcontractors have implemented required safeguards for federal contract information and controlled unclassified information.

It reaches further down the supply chain than most companies expect. If you manufacture a component, provide engineering or professional services, or supply a firm that holds a defense contract, the requirement can flow to you through your contract even if you have never dealt with the DoD directly. The trigger is usually a clause in an agreement, not a letter from the government.

The right first step is a gap assessment against the requirement level your contract specifies. That tells you the real distance between where you are and where you need to be before you commit to a timeline you cannot meet. Certification work takes longer than most organizations plan for, and the scoping decisions made at the start drive most of the eventual cost.

You can read more on our CMMC readiness and compliance page.

Yes. Our AI work runs across five areas: planning and readiness, security and responsible use, implementation and integration, everyday efficiency and automation, and training with ongoing support.

In practice most engagements start with a readiness assessment rather than a deployment, for a reason worth understanding before you buy licenses. See the next question.

More detail is on our AI Services page.

Start with the fact that most organizations get wrong:

AI does not create new access to your data. It surfaces the access your people already have.

Copilot respects existing Microsoft 365 permissions. It does not grant anyone rights they did not have. The problem is that in most tenants, permissions have drifted for years through shared links, inherited folder rights, all-company groups, and departed employees who were never fully removed. Nobody notices, because finding a file you should not see requires knowing it exists and where it lives. An AI assistant removes that friction entirely. Someone asks a plain question and receives an answer assembled from everything they are technically allowed to reach.

A readiness review should answer four questions with evidence rather than opinion:

1. Who can currently reach what? An audit of permissions, sharing links, and group membership across SharePoint, OneDrive, and Teams. This is where most of the remediation work turns up.

2. Is the data in usable shape? Sensitive information should be labeled and retention should be governed. Abandoned sites and duplicated files degrade the quality of what the assistant returns.

3. Are the licensing and technical prerequisites in place? The right Microsoft 365 plan, the required identity configuration, and the supporting services the tool depends on.

4. Do you have a governance decision? Which tools are approved, what data may go into each, and who signs off on new ones. This should be one page your staff will actually read.

Sometimes the honest answer is not yet. That answer is worth considerably more than a fast rollout, because permissions problems discovered after deployment are discovered by users, and by then the exposure has already happened.

It depends entirely on which tool, configured how, under what agreement, and with what governance behind it. Those are answerable questions, and they should be answered before adoption rather than after.

Three principles we work from:

Consumer tools and business tools are not interchangeable. The terms governing a free public chatbot and an enterprise service purchased under a business agreement differ in ways that matter to a regulated organization, particularly around data handling and retention.

Permissions come first. An assistant operating inside your tenant inherits your access model. If that model has not been reviewed, the tool is not the risk. The model is.

Obligations do not pause for new technology. If you operate under HIPAA, PCI DSS, CMMC, or client confidentiality requirements, AI adoption has to happen inside those obligations. Regulated organizations should involve counsel and have appropriate agreements in place before confidential information touches any new platform.

We help organizations make those decisions deliberately, write them down in a policy people will follow, and configure the environment to match.

The honest answer is that it is not always the right call. If technology is genuinely core to what you sell, you may want that capability in house.

For most organizations, though, the economics are hard to argue with. Our entire business is optimized around managing IT infrastructure more effectively and at lower total cost than doing it internally. We maintain the professional monitoring and management tooling, and an engineering team that keeps current across the technologies we support.

The part that gets underestimated is coverage. One internal IT person is a single point of failure with a vacation schedule, a sick day, and eventually another job offer. Depth is what you are actually buying.

Anyone who quotes a number before seeing your environment is guessing, and you should treat that as information about them.

That said, you should understand how the pricing works before you take a single meeting.

Most managed services are priced per user or per device, billed monthly. Per user tends to be fairer when people carry several devices. Per device can be better in shift environments where one workstation serves many people.

Co-managed arrangements are usually scoped to the layers you hand over rather than your whole environment, so they price differently.

Projects, migrations, and compliance work are typically quoted separately from the recurring agreement.

What actually drives your number: how many users and locations, how much of your infrastructure is on premises versus cloud, the age and consistency of what you own, your security and compliance requirements, and the service levels you need. Two companies with identical headcount can differ substantially on all five.

The comparison worth making is not price against another provider’s price. It is total cost against what you spend today across salaries, tooling, vendor contracts, and unplanned downtime. That number is usually larger than expected, and most organizations have never assembled it. We will help you build it whether or not you hire us.

With an assessment, not a proposal.

Before anyone can responsibly recommend a service level or a security investment, someone has to look at what you actually own. Our Full Network Assessment includes an on-site evaluation by a senior network engineer, a review of your backup and security posture, and a written roadmap of what to address first, in priority order.

You should finish reading it knowing which items to fund this quarter, which can wait a year, and what each decision costs if you defer it. It is a useful document even if you never become a client, and it is the right first step whether you have inherited an environment you did not build, lost the person who understood it, or been asked for evidence you cannot currently produce.

Tech Group
21 Gregory Drive, Suite 120
South Burlington, VT 05403
802-862-1197
helpdesk@tgvt.net

Or use our contact form and someone will get back to you.

If your question is not answered here, ask it. The unusual ones are how we learn what to put on this page.