At Ceifa, critical issues get a response within 30 minutes during business hours. It is one of the first things people read about us, and it is one of the most misunderstood lines in any support agreement. Some people read it as "fixed in 30 minutes." Others assume every ticket they send will be treated that way. Neither is quite right.
I run how our helpdesk works day to day, so I want to explain what that commitment actually covers, how we decide what is critical, and what you can do on your side to get a problem fixed faster. The same mechanics apply whoever supports your IT.
Response is not resolution
A response means a technician has picked up your issue, understood it well enough to act, and made contact with you. It is not an automated email saying your ticket was received. For a critical issue, it usually means a phone call or a message from a named person who is already working on it.
Resolution is when the problem is gone. That time depends on the problem. A locked account can be resolved in minutes. A failed firewall that needs a replacement unit cannot, no matter how fast someone picks up the ticket. What a provider can promise is that the right person is on it quickly, that you know what is happening, and that the work does not stop until service is restored or a workaround is in place.
That is why I care about the response number more than any made-up resolution target. A fast, real response is what stops a bad morning from turning into a lost day. It gets a workaround in place, it tells you whether to send people home or keep them working on something else, and it means nobody is sitting in a queue wondering if anyone saw the email.
How tickets are prioritized
Most helpdesks, ours included, sort incoming work by two questions: how many people are affected, and how badly is the business stopped. The combination of those two gives you the priority.
Critical
The business, or a key part of it, cannot operate and there is no workaround. Examples:
- The whole office has no internet, or the main server or line-of-business application is down.
- Nobody can sign in to email or files.
- A suspected security incident is in progress: ransomware notes on screen, a mailbox sending phishing to clients, a payment request you think came from a compromised account.
- A single person is blocked from something that cannot wait, such as running payroll before a bank cut-off or a clinic's front desk being unable to book patients.
High
Something important is broken, but people can still work in a reduced way. A shared printer the whole team relies on is down, one department cannot reach a shared folder, or a manager's laptop will not boot but they can use a spare. These get worked ahead of routine requests.
Normal
One person has a problem that is annoying but not blocking, or someone needs a change: a new shared mailbox, software installed, a monitor that flickers. This is most of the volume on any helpdesk, and it is handled in order of impact and age.
There is usually a lower tier too, for planned work and requests with a future date, like setting up a new hire who starts in two weeks.
What to report as critical, and what not to
If you are not sure, call and say so. A good helpdesk would rather downgrade a ticket than discover an hour later that a real outage sat in the normal queue. That said, the critical tier only works if it is used for genuinely critical problems. When everything is marked urgent, nothing is.
A useful test: if this is not fixed in the next hour, does money, safety, client data or a legal deadline take a hit? If yes, it is critical. If the answer is "it is frustrating and I would like it sorted today," it is probably high or normal, and it will still get handled.
Always treat a possible security problem as critical, even if it seems small. A single odd sign-in prompt, a click on a link that looked wrong, or a client asking why you emailed them an invoice you never sent: report it straight away. The cost of a false alarm is a few minutes of a technician's time. The cost of waiting can be an attacker with a day's head start.
How to log a ticket that gets fixed fast
The biggest delay on most tickets is not technical. It is the back and forth needed to work out what is actually wrong. A well-written ticket can skip that entirely. Here is what I ask our clients to include:
- Who is affected. Just you, your team, or the whole office? Names help.
- What you were trying to do and what happened instead. "Outlook is broken" is a starting point. "Outlook opens but says it is disconnected, and I cannot send since about 9:15" is a ticket we can act on.
- When it started, and whether anything changed just before: an update, a new device, a move to another desk, a password change.
- The exact error message, ideally as a screenshot. Error codes that look meaningless to you often point us directly at the cause.
- The device name or asset tag if you have it. It is often on a sticker on the laptop.
- What you have already tried, so we do not ask you to restart a machine you just restarted.
- The best way to reach you in the next hour, especially if your email is the thing that is broken.
Keep it to one issue per ticket. If your printer is jammed and you also need access to a new folder, those are two tickets. Combined tickets get stuck because one half is waiting on something while the other could have been closed.
Use the phone for critical issues
Email and portal tickets are perfect for normal requests. For anything critical, call the helpdesk and then follow up in writing if asked. A phone call removes any doubt that the issue has been seen, and a technician can ask the two or three questions that matter in a minute instead of over several emails.
What happens on our side
When a critical ticket comes in during business hours, a technician takes ownership and contacts you. Their first job is to confirm the scope and stop the damage, which might mean isolating a device, failing over to a backup internet connection, or resetting a compromised account. Their second job is to restore service, even if that is a temporary workaround. The proper fix and the root cause come after people can work again.
Throughout, you should get updates at sensible intervals without having to chase them. If you have to ask "any news?" on a critical ticket, something in the process has slipped, and I want to know about it.
After the dust settles, a critical incident should leave a short written summary: what happened, what was done, and what will stop it happening again. That last part is where most of the value is. A provider that fixes the same outage every few months without asking why is not really managing anything.
Questions to ask any provider about response times
- What exactly counts as a response? Is it an auto-reply or a person?
- Which hours does the commitment cover, and what happens outside them?
- Who decides the priority, and can I raise it if I disagree?
- Do your monthly reports show how you performed against your response commitment?
- What does a post-incident summary look like?
Clear answers to those questions tell you more about a helpdesk than any headline number.
Frequently asked questions
Does a 30-minute response mean the problem will be fixed in 30 minutes?
No. It means a technician is working on the issue and in contact with you within 30 minutes during business hours. How long the fix takes depends on the problem, but the work continues until service is restored or a workaround is in place.
Who decides whether my ticket is critical?
The helpdesk sets the priority based on how many people are affected and how badly work is stopped. If you think a ticket has been rated too low, call and explain the business impact. Context like a payroll deadline or a client meeting changes the priority.
Should I report a suspicious email or sign-in as critical?
Yes. Treat any possible security incident as critical and call it in straight away. A false alarm costs a few minutes. A real incident left until later can cost far more.
Is it better to email or call the helpdesk?
Email or the portal works well for normal requests and changes. For anything critical, call, so a technician can confirm the scope and start work immediately.
How Ceifa handles it
Our managed services include unlimited helpdesk support during business hours for one flat monthly fee per user, so nobody on your team hesitates to call because of the cost. Critical issues get a response within 30 minutes during business hours, and our monthly reports show how the helpdesk performed. If you are a client, the fastest way to reach us is on our support page. If you are not yet, and you want to see how our IT support would work for your team, get in touch.