Questions we hear from owners.

General

• Where are you based and who do you serve?

  CoreSouth Systems is based in Macon, GA. We serve businesses across Middle Georgia: Warner Robins, Perry, Forsyth, Fort Valley, Dublin, Milledgeville, and the surrounding counties. Our office is at 5844 Columbus Rd, Macon, GA 31206.

• Do you serve businesses outside Macon?

  Yes. We work with businesses across Middle Georgia. We schedule on-site visits when an engagement calls for it; day-to-day support is mostly remote, which is faster anyway.

• What size businesses do you support?

  Businesses with 10 to 150 users for fully managed work, and organizations with 50+ users and internal IT for co-managed work. The right service model depends on whether you have internal IT to coordinate with, not just headcount.

• What is the 90-Day Guarantee?

  During the first 90 days of a managed engagement, if you decide we are not the right fit, you can exit without penalty. The guarantee covers the early window when most fit issues actually surface.

• How does onboarding work?

  Discovery and documentation in the first few weeks, tooling deployment and standardization next, then steady-state managed support with quarterly business reviews. The 90-Day Guarantee covers the early window.

• How are you billed?

  Managed engagements are fixed monthly fees on a 12-month term. Project work is scoped and billed separately. We do not nickel-and-dime tickets, and our pricing page lays out what determines your number.

• What is a discovery call?

  A 30-minute conversation about your business, your current IT, and what is or is not working. No pitch deck, no commitment. If we are a fit we move to a deeper assessment; if not, we say so.

• Who is the team?

  We're a small, locally owned company in Macon. We build long-term relationships with our clients. It won't take long before your team starts calling us by name instead of 'the IT company.'

Managed IT

• What is a managed services provider (MSP)?

  A managed services provider, or MSP, is an outside IT company that takes ongoing responsibility for a business's technology for a flat monthly fee. That includes helpdesk support, server and network management, cybersecurity tooling, backup, patching, and Microsoft 365 administration.

• How much does managed IT cost in Middle Georgia?

  Most fully managed engagements are priced per user, per month, with the rate depending on the size and complexity of the environment. We publish our starting price and tier structure on our pricing page. The total cost varies by company, but the monthly fee is predictable and includes everything in scope.

• Do you support businesses in Warner Robins and Perry?

  Yes. We work across Middle Georgia, including Warner Robins, Perry, Forsyth, Fort Valley, Dublin, and Milledgeville. On-site visits are part of how we work.

• Do you require a long-term contract?

  Our fixed-fee managed engagements run on a 12-month term. Most MSPs in our market lock clients into 36-month initial agreements, which we think is a high bar to ask someone to clear before they've worked with you. The 90-Day Guarantee covers the start of any engagement, so you can see how we work before you're committed.

• Can you help with cybersecurity?

  Yes. Cybersecurity is part of every managed engagement. We cover the fundamentals (endpoint protection, email security, multi-factor authentication) and the documentation cyber insurance underwriters now require. The dedicated cybersecurity service page goes deeper.

• Can you help us migrate to Microsoft 365?

  Yes. We migrate businesses from on-premises Exchange, Hosted Exchange, GoDaddy email, IMAP-based providers, and Google Workspace to Microsoft 365 regularly. Migration is usually a project engagement that leads into a managed relationship.

• Do you work with defense contractors or businesses near Robins AFB?

  Yes, where it's a fit. We're aligned with NIST 800-171 and can support businesses that need SPRS scoring and CMMC-aware controls. We're not a CMMC-certified MSP today, but we can work alongside a CMMC consultancy as the day-to-day IT provider.

• How quickly can you respond when something goes wrong?

  Critical issues are worked immediately. For everything else, a technician (not an auto-reply) responds within 30 minutes during business hours and keeps you posted until it's resolved. After-hours emergency coverage is included in every managed plan. Our monitoring catches most problems before users notice, which is the point.

• What size businesses do you work with?

  For fully managed engagements, businesses with roughly 10 to 150 users and no internal IT. For co-managed work, organizations with 50 or more users and an internal IT person or team, with no upper limit.

• How is CoreSouth different from other MSPs in Middle Georgia?

  We're a small, locally owned company, and we build long-term relationships. It won't take long before your team starts calling us by name instead of 'the IT company,' and we'll know their setup without asking. We explain things in simple terms, we don't disappear behind a ticketing system, and we back the engagement with a 90-Day Guarantee.

Co-Managed IT

• What is co-managed IT?

  Co-managed IT is an arrangement where an outside MSP works alongside a business's internal IT staff to handle specific functions, typically including senior escalations, after-hours coverage, projects, cybersecurity tooling, and vendor management.

• How is co-managed IT different from fully managed IT?

  Fully managed means the outside provider runs IT end to end. Co-managed means the business has an internal IT person or team and the outside provider plugs in to fill specific gaps.

• What size businesses use co-managed IT?

  Typically organizations with 50 or more users and at least one full-time internal IT person. There's no upper limit.

• Do you require a long-term contract?

  Our fixed-fee managed engagements run on a 12-month term. Most MSPs in our market lock clients into 36-month initial agreements, which we think is a high bar to ask someone to clear before they've worked with you. The 90-Day Guarantee covers the start of any engagement, so you can see how we work before you're committed.

• Will my internal IT person feel threatened by you?

  Sometimes, briefly. The pattern we see most often: internal IT is initially cautious, becomes a strong advocate within 60-90 days, and ends up wondering how they ever did the job without us.

• Do we still control our IT environment?

  Yes. Your internal IT remains responsible for the strategic direction and the team relationship. We work alongside them, with clear lanes for what we own and what they own.

• Can you handle after-hours emergencies?

  Yes. After-hours and weekend coverage is one of the most common reasons businesses bring us in for co-managed engagements.

• Do you bring your own tools, or use ours?

  Mostly ours, configured to your environment. Remote monitoring, EDR, ticketing, documentation. We bring a mature toolset that would be impractical to build in-house at your scale.

• Can co-managed evolve into fully managed?

  Yes. Some businesses start co-managed and transition to fully managed when their internal IT leaves or the workload shifts.

• What if my IT person leaves?

  We help you bridge the gap. We've covered short-term transitions before.

AI for Your Business

• Do I have to be a managed IT client to work with you on AI?

  No. AI consulting sessions stand on their own. Plenty of businesses start here with an IT provider they're happy with. If we're a good fit for more down the road, we'll talk about it then.

• Should we use Copilot, ChatGPT, or Claude?

  It depends on the work. Copilot lives inside Microsoft 365 and works with your email, files, and Teams. ChatGPT and Claude are stronger general-purpose tools for writing, analysis, and building reusable templates. Many businesses end up with one main tool and a short list of approved extras. We'll test them against your actual work before you pay for licenses.

• Is our data used to train the AI?

  On business plans from the major vendors, generally no, and you can confirm it in the terms. On free personal accounts, the rules are looser and change often. That gap is why most businesses need an AI use policy and an approved tools list. Free accounts are where company data leaks out.

• What does an AI use policy cover?

  Which tools are approved, what information can and can't go into them (customer data, financials, employee records), who reviews AI-written work before it goes out, and what happens when someone breaks the rules. Ours fit on a page or two. A policy nobody reads protects nobody.

• Do we need Copilot licenses for everyone?

  Usually not. Copilot is a per-user add-on, and most businesses get the payoff from a handful of heavy users first. We'll help you figure out who those people are before you buy seats you won't use.

• Can AI connect to our other software?

  Sometimes, with the right setup. When the job is connecting systems or building a tool around your workflow, that's a custom build, and we cover it on our Custom Apps & Integrations page.

• What does an AI working session cost?

  Sessions are billed by the hour, with no managed IT agreement required. We quote the session up front, and most businesses get what they need from one or two before deciding whether to go further.

• Will AI replace people in my office?

  In a 10 to 150 person business, rarely. What it does is take the first draft and the repetitive paperwork off people's plates: quotes, proposals, job reports, spreadsheet cleanup, meeting notes. The people stay. The work they spend their day on changes.

• Is Microsoft Copilot worth it for my business?

  For some people in your business, yes. For everyone, usually not. Copilot is a per-user add-on, so we help you figure out who would actually use it before you buy seats, and we check your file permissions first, because Copilot can surface any file a user already has access to.

Workflow Automation

• What kinds of tasks can you automate?

  Anything your team does the same way every time, in whatever software it lives in. Approvals, data entry, filing, and reports are common, but most of what we build is specific to one business: a distributor's order confirmations, a contractor's daily job reports, the intake process at a billing office. If someone could write the steps on an index card, it can probably be automated.

• Do we need to buy new software?

  Usually not. Most Microsoft 365 business plans include Power Automate, and it connects to Outlook, Teams, SharePoint, Excel, and Forms out of the box. Some connections to outside systems need a premium license or a tool like Zapier. We'll tell you before we build if anything costs extra.

• Power Automate or Zapier?

  If you're on Microsoft 365, we usually start with Power Automate because you already pay for it and it keeps your data inside your Microsoft account. Zapier and Make connect to more outside apps and can be the better fit when most of your work lives outside Microsoft. We pick based on the systems involved, not a preference.

• What happens when an automation breaks?

  Automations break when something around them changes, like a password or a form field. We set them up to alert someone when a run fails, document how each one works, and fix them when they stop. Because we also manage your IT, we usually know about the change that caused it.

• How much does it cost?

  We quote each automation up front after we map the process with you. Simple ones take a few hours. Bigger workflows that touch several systems are scoped as a project. Either way, you know the price before we start.

• Do I need to be a managed IT client?

  No. Automation work stands on its own. It does go faster when we already know your systems, and managed clients get priority scheduling.

Custom Apps & Integrations

• What kinds of things do you build?

  Internal tools for small and mid-sized businesses: quoting and estimating tools, job and project trackers, field forms, intake and request forms, dashboards and reports, and the connections that move data between systems like QuickBooks, Microsoft 365, CRMs, and scheduling or project software. If it replaces a spreadsheet that three people email back and forth, it's probably a fit.

• Do you use AI to build these?

  Yes. AI lets us write and test code much faster than a traditional software shop, which brings projects that used to cost tens of thousands of dollars within reach of a 20-person business. A person still designs the tool, reviews every line that ships, tests it against your real data, and supports it afterward.

• Who owns what you build?

  You do. The code and the data live in accounts your business owns, usually your Microsoft 365 or cloud environment. We document what we build so another developer could pick it up if they ever needed to.

• How much does a custom build cost?

  It depends on the scope. We start with a paid discovery session, then give you a fixed price for a defined first version. Small integrations and simple tools are often a few weeks of work. Ongoing support and changes are billed monthly or as needed, your choice.

• What if there's already software that does this?

  Then we'll tell you to buy it. Building custom only makes sense when the off-the-shelf options don't fit or cost more than they're worth. Part of discovery is checking for that.

• Do I need to be a managed IT client?

  No. Custom work stands on its own. It does go smoother when we already know your environment, and managed clients get priority scheduling.

• What happens to a custom tool if we stop working with CoreSouth?

  You keep it. The code and data live in accounts your business owns, and we document what we build so another developer could pick it up. Nothing we build depends on a CoreSouth subscription to keep running.

• How long does a custom integration take?

  Small integrations and simple internal tools are usually a few weeks from discovery to a working first version. Larger builds are scoped and priced as a fixed project after a paid discovery session.

Cybersecurity

• What is managed cybersecurity?

  Managed cybersecurity is an ongoing arrangement where an outside provider takes responsibility for deploying, monitoring, and maintaining the controls that protect your business from cyber threats. It typically includes endpoint protection, email security, multi-factor authentication, security awareness training, patching, backup, and incident response readiness.

• Will my cyber insurance underwriter be happy with what you deploy?

  Almost always, yes. The controls we deploy as standard practice (MFA, EDR, email security, training, documented backups, incident response plan) cover the core requirements on most underwriter questionnaires.

• Do I need NIST 800-171 if I'm not a defense contractor?

  Probably not directly, but the controls overlap meaningfully with what cyber insurance and many commercial contracts now require. NIST 800-171 is a strong framework even for businesses that aren't formally subject to it.

• What is EDR and why does it matter?

  EDR (endpoint detection and response) is a modern replacement for traditional antivirus. Instead of looking only for known threats, EDR watches behavior on each device and detects unusual activity. It can isolate a compromised device automatically, which limits damage.

• Is multi-factor authentication really necessary?

  Yes. MFA is the single most effective control against credential theft. It's also a baseline requirement for nearly every cyber insurance underwriter.

• What happens if we have an incident on your watch?

  We act fast and we keep you informed. Containment first, then investigation, then recovery, then a written postmortem. We coordinate with your cyber insurance carrier, breach counsel, and law enforcement if appropriate.

• Do I need to be a Managed IT client to get cybersecurity?

  No. We deliver cybersecurity as part of Managed IT and as standalone projects.

• Do you serve businesses in Warner Robins and Perry?

  Yes. We work across Middle Georgia, including Warner Robins, Perry, Forsyth, Fort Valley, Dublin, and Milledgeville.

Security Compliance

• What do cyber insurance carriers require now?

  Nearly every carrier asks about multi-factor authentication on email, remote access, and admin accounts; endpoint detection and response on every device; and backups that are tested and protected from ransomware. Many also ask about patching, email filtering, security training, a written incident response plan, and, more recently, how your business uses AI tools.

• Will you help with our insurance renewal?

  Yes. For our clients, it's part of the job. We'll help you answer the carrier's questions accurately and fix any gaps before you sign. An answer that overstates your controls can give a carrier grounds to deny a claim, which is the worst time to find out.

• Does the FTC Safeguards Rule apply to my business?

  It applies to businesses the FTC considers financial institutions, which is broader than it sounds: collection agencies, auto dealers that arrange financing, tax preparers, mortgage brokers, and others. Covered businesses need a written information security program, a qualified person responsible for it, MFA, encryption, and since May 2024, notice to the FTC within 30 days of a breach affecting 500 or more consumers.

• What is a WISP?

  A written information security plan. The IRS requires one for every paid tax preparer, regardless of size, and the FTC Safeguards Rule requires an equivalent for every covered business. It describes how you protect customer information and who's responsible. We write it to match how your business actually runs.

• What changed with PCI DSS 4.0?

  All of the new requirements became mandatory in March 2025. For many smaller merchants, that means quarterly vulnerability scans and protecting your payment pages against script attacks. Some businesses that used to qualify for the shortest self-assessment now have more to prove.

• Do you do CMMC and NIST 800-171?

  Yes. Defense contractors have their own page covering CMMC and NIST 800-171, including what changed when the DoD suspended Phase II in July 2026.

CMMC & NIST 800-171

• Didn't the DoD just suspend CMMC?

  Part of it, yes. In July 2026 the Department suspended Phase II, the rollout stage where third-party certification assessments were going to become mandatory in contracts, and opened a 60-day review of the program. Phase I self-assessments are still required, DFARS 7012 is still in every affected contract, and NIST 800-171 is still the standard, now enforced through your self-reported SPRS score and select government-led assessments. So the certification is paused. The requirement to protect the data never was. We keep this page updated as the review plays out.

• What is a good SPRS score?

  A perfect score is 110. Every unmet 800-171 control deducts points (deductions range from 1 to 5 per control), and the scale runs all the way down to negative 203. So "good" depends on where you're starting, but the only score worth having is an accurate one. A self-reported 110 that wouldn't survive an assessment is a legal liability, not an asset. Most contractors' first careful assessment lands well below 110, and that's fine. The score is a starting line. The remediation plan is what matters.

• Do I need CMMC Level 1 or Level 2?

  It depends on what data touches your business. If you only handle Federal Contract Information (FCI), you're in Level 1 territory: an annual self-assessment against 15 basic safeguarding requirements, which is still required today. If you handle Controlled Unclassified Information (CUI), the standard is NIST 800-171, all 110 controls, with your score filed in SPRS. Third-party Level 2 certification assessments are suspended as of July 2026 while the DoD reviews the program, but the underlying obligation didn't move. Not sure which you are? Check your contracts for the 252.204-7012 clause and look at what your prime actually sends you. Technical drawings and specs are often CUI even when nobody stamped them clearly. We sort this out in the first conversation.

• What does CMMC certification actually cost?

  Right now, possibly nothing, because third-party certification assessments are suspended while the DoD reviews the program. Before the suspension, the Level 2 assessment by a certified third-party assessor (C3PAO) commonly ran $30,000 to $60,000 for a small contractor, and some form of verification will likely return. The cost that never went away is implementation: actually meeting the 110 controls of NIST 800-171. A 20-user shop already on Microsoft 365 with decent practices might have a modest remediation bill. A shop that needs a GCC migration plus a dozen technical controls will spend more. If a firm quoted you certification prep before July 2026, the scope just changed. Our second-opinion review is free, and this is a good month to use it.

• Can my current IT company handle this?

  Maybe, and it's a fair question to ask them directly. Have they read NIST 800-171? Can they produce a System Security Plan and a POA&M? Do they understand how to scope a CUI enclave? If they're good at day-to-day IT but new to this framework, that's not a reason to fire them. We work co-managed engagements where your existing IT keeps doing what they do well and we own the compliance program. What you can't afford is an IT provider who says "we've got it" and finds out otherwise during your assessment window.

• What is DFARS 7012 and does it apply to me?

  DFARS 252.204-7012 is the contract clause that has required defense contractors to implement NIST 800-171 since 2017. If it's in your contract, it applies, and it has since the day you signed. It also requires reporting cyber incidents to the DoD within 72 hours, and it requires that any cloud service storing your covered defense information meets FedRAMP Moderate equivalency (this is where the Microsoft 365 GCC conversation usually starts). The companion clauses, 7019 and 7020, are what require your SPRS score to be on file and current. The July 2026 CMMC suspension didn't touch any of this.

• How long does it take to get compliant with NIST 800-171?

  For a 10 to 50 user contractor with real gaps, plan on six to twelve months from gap assessment to a defensible SPRS score with the technical work behind it. A GCC migration alone takes careful planning, and policies need time to become practice. The suspension of third-party assessments doesn't buy that time back, because your score is on file now and government-led assessments don't come with scheduling courtesy. If the review ends and verification returns, the contractors who used this window to implement will be bidding while everyone else scrambles.

Microsoft 365 & Cloud

• How long does a Microsoft 365 migration take?

  For a typical 25-50 user migration from a single source system, four to six weeks from kickoff to cutover is realistic. The timeline depends on the source system, mailbox sizes, file storage volumes, and how much cleanup happens along the way.

• Can you migrate us from GoDaddy email to Microsoft 365?

  Yes. We migrate from GoDaddy regularly. The process includes setting up the M365 tenant, configuring DNS, migrating mailboxes (with some history limitations depending on the GoDaddy plan), and decommissioning the old system.

• Can you migrate us from on-premises Exchange to Microsoft 365?

  Yes. Exchange migrations are a recurring engagement for us. Hybrid migrations preserve mailbox history and let us cut over in stages.

• Can you migrate us from Google Workspace to Microsoft 365?

  Yes. We migrate mail, calendars, contacts, and Google Drive content with established tooling.

• Do I need backup for Microsoft 365?

  Yes. Microsoft is responsible for the platform's availability. You're responsible for your data. Accidental deletion, malicious deletion, ransomware, and account compromise are all your problem to recover from.

• Should we be using Teams, SharePoint, and OneDrive together?

  Usually yes, and they need to be configured to work together. Most businesses we meet are using a fraction of what they're paying for.

• What's Intune and do I need it?

  Intune is Microsoft's device management platform. It lets you push policies, deploy apps, enforce security baselines, and manage devices remotely. For most businesses with 25+ users, it's worth deploying.

• What licenses should my business be on?

  The right answer depends on your size and your security and compliance needs. We help you right-size during onboarding.

• How do you handle DNS during a migration?

  Carefully. We document the existing DNS, plan the changes, schedule cutover for minimal disruption, and keep the old environment alive long enough to confirm the new one is working.

Server & Network Infrastructure

• Do you still support on-premises servers?

  Yes. We design, deploy, and maintain Windows Server environments, including Active Directory, file and print servers, application servers, and virtualization.

• What kinds of networks do you work on?

  Small to mid-sized business networks with managed switches, business-grade firewalls, enterprise wireless, and multi-site connectivity.

• Can you help with a server refresh?

  Yes. We design replacements that fit the workload, plan the migration to minimize downtime, and document the new environment.

• Do you do Remote Desktop Services and FSLogix work?

  Yes. RDS design and FSLogix profile container deployments are areas of specific expertise.

• What's RDS and why might my business need it?

  Remote Desktop Services lets users access a centralized server environment from any device. It's useful for businesses with shared applications, contractors needing controlled access, mobile staff who need consistent performance, and environments where standardizing the user experience matters.

• What's FSLogix?

  FSLogix is a Microsoft profile container technology that solves the long-standing problem of slow login and inconsistent user experience in RDS and virtual desktop environments.

• Do you support multi-site businesses?

  Yes. Site-to-site VPN, SD-WAN, LTE/5G failover, point-to-point wireless, and centralized management.

• Can you support hybrid cloud environments?

  Yes. We run hybrid environments where the workload calls for it (some Azure, some on-prem) and design migrations between them when it makes sense.

• Do you do cabling?

  Light cabling work where it integrates with a project. Heavy structured cabling we'll coordinate with a specialist. We're not a low-voltage shop.

• Do you sell hardware?

  We resell when it makes sense for the project. We're not a hardware-resale business and we'll tell you when buying direct is cheaper than buying through us.

Industry-specific questions