Managed IT for Mac and Google Workspace Firms in Chicago

CIO Landing provides managed IT services for Chicago-area businesses that run on Apple Macs and Google Workspace. Many IT providers treat a Mac as the exception and Google Workspace as an afterthought to Microsoft 365. We manage both as first-class platforms, using Addigy for Apple device management and native Google Workspace administration, alongside the Windows machines most offices still have.

Why Mac and Google Workspace firms need a different kind of IT provider

Most managed IT providers in Chicago were built around Windows, Active Directory and Microsoft 365. When a firm that runs Macs and Google Workspace signs with one of them, the gaps show up quickly: Macs are "supported" but not actually managed, Google Workspace security settings are left at defaults, and the help desk keeps suggesting Windows fixes for macOS problems.

Creative agencies, consultancies, law firms, architecture and engineering studios, software companies and professional services firms across Chicagoland chose Macs and Google Workspace on purpose. The IT partner should fit that choice rather than push a migration to Windows and Microsoft 365. CIO Landing has supported Chicago businesses since 2012, and our managed IT plan treats Apple devices and Google Workspace as core platforms, not exceptions.

This page explains how we manage Macs, how we administer and secure Google Workspace, what the monthly plan includes, and how the service works day to day.

Mac management with Addigy and Apple Business Manager

We manage Apple devices with Addigy, a cloud-based Apple device management (MDM) platform built for managed service providers. Addigy connects to your Apple Business Manager account so that Macs, iPhones and iPads you buy through Apple or an authorized reseller are assigned to your organization and enroll automatically the first time they are turned on. What that gives your team:

• Zero-touch deployment. A new Mac can ship straight to the employee. Through Automated Device Enrollment it joins management on first boot, receives your settings, security policies and standard applications, and is ready to work without a technician unboxing it first.
• Disk encryption and compliance. FileVault encryption is enforced on every managed Mac and recovery keys are escrowed, so a lost laptop is a replaceable asset rather than a data breach. Addigy monitors compliance in real time and remediates drift automatically.
• macOS updates and patching. Operating system updates and third-party application patches are scheduled and enforced, with deferral windows so updates do not interrupt client work or deadlines.
• Software deployment. Google Chrome, Google Drive for desktop, Zoom, Adobe, Slack, QuickBooks and your line-of-business tools are deployed and kept current from a central catalog instead of being installed by hand.
• Remote support, lock and wipe. Our technicians can see device status and remotely assist users. A lost or stolen Mac, iPhone or iPad can be locked or wiped from the console.
• Onboarding and offboarding. New-hire setups are standardized: Mac enrolled, Google Workspace account created, groups and Shared Drives assigned, security training enrolled. When someone leaves, the account is suspended, data is transferred to a manager, and the Mac is wiped and reassigned.

Addigy also manages iPhones and iPads, and our plan covers Android devices as well, so a company that issues phones alongside Macs has one place to manage them all.

Google Workspace administration and security

Google Workspace management and license tracking are included in our monthly plan. That means more than adding and removing users. We treat the Google Admin console as the identity and security backbone of your company and configure it the way Google recommends for business customers:

• Identity and access. 2-Step Verification is enforced for every user, with security keys or passkeys for administrators and finance roles. Single sign-on (SAML) is configured so Google is the identity provider for your other cloud apps, and super-admin accounts are separated from day-to-day accounts.
• Context-aware access. Where your license tier supports it, access to Gmail, Drive and other apps can be limited by device status, location or network, so a stolen password alone is not enough to get in.
• Third-party app controls. OAuth access by unknown apps and browser extensions is reviewed and restricted. Employees can still use the tools they need; unvetted apps cannot silently read your email and files.
• Drive and Shared Drive governance. Company data lives in Shared Drives that the business owns, with external sharing rules, link-sharing defaults and retention set by policy rather than by individual users.
• Gmail protection. Anti-spam and anti-phishing, attachment and link scanning, SPF, DKIM and DMARC configuration, plus ongoing DMARC monitoring so no one can send email that appears to come from your domain.
• Licenses and cost. We track Business Starter, Standard, Plus and Enterprise seats, remove licenses from departed users, and advise when a tier change (for example, to get Vault or more storage) is worth it.
• Google Vault and retention. For firms with legal, financial or client-confidentiality obligations we configure Vault retention and holds on the tiers that include it.

Backup for Google Workspace and Macs

Google keeps Workspace running, but it does not protect you from deleted files, a ransomware-encrypted Drive sync, a departing employee who clears a Shared Drive, or a retention mistake. Our plan includes daily backups of mailboxes, cloud storage and collaboration platforms, which for a Google Workspace company means Gmail, Google Drive, Shared Drives, Calendar and Contacts. Mac workstations are backed up as well. Off-site copies are retained for 90 days in redundant U.S. data centers, encrypted in transit and at rest, and our target is to begin a restore within 24 hours of your request.

Security that covers Macs, not just Windows

The idea that Macs do not get malware is out of date, and insurers and clients know it. Every managed device, Mac or Windows, gets the same security stack:

• Next-generation AI antivirus with managed detection and response (MDR) on macOS and Windows.
• Disk encryption (FileVault on Macs, BitLocker on Windows) with escrowed recovery keys.
• Privileged access management, so users are not running as local administrators all day.
• Security patching for the operating system and common applications.
• Email protection and DMARC monitoring for your Google Workspace domain.
• Online security awareness training for your staff.

Optional add-ons include a company password manager, vulnerability assessments, email encryption and archiving, DNS filtering, and SASE secure remote access for distributed teams. These controls are what cyber-insurance applications, SOC 2 questionnaires and client security reviews ask about, and we help you answer them.

Mixed environments: Macs, Windows and everything in between

Very few Chicago businesses are 100% Mac. The finance team may need Windows for QuickBooks Desktop or a bank's software; a manufacturer or law firm may have a Windows server or a line-of-business application that only runs on Windows. We support the whole environment under one agreement: Macs managed through Addigy, Windows devices managed through our Windows tooling, Google Workspace or Microsoft 365 (or both, during a migration), network equipment, printers, NAS devices and cloud resources. One help desk number, one Client Success Manager, one invoice.

How the service works

• Help desk. Monday to Friday, 7am to 7pm Central, by phone, email or the client portal. Monitoring runs 24/7, and after-hours urgent issues reach an on-call technician on a best-effort basis.
• Response targets. Priority 1 (everyone down) within 1 business hour; Priority 2 within 2 hours; Priority 3 within 4 hours; Priority 4 (one user affected) within 1 business day. These are service goals, not guarantees. See our Service Levels page for the full matrix.
• Client Success Manager (CSM). Your account manager, with a small client list so the service stays white-glove, who runs regular Technology Business Reviews.
• Technology Alignment Manager (TAM). Reviews your environment against our standards, keeps Mac and Google Workspace configurations aligned, and builds the roadmap.
• Fractional CIO (vCIO). Available when you need executive-level technology leadership for board discussions, budgeting or a major project.
• Pricing. Managed IT plans run $150 to $225 per user per month depending on the complexity of your environment. A one-time onboarding fee equal to one month of service covers deploying our tools. Projects, hardware, Google Workspace and other software licenses, and third-party fees are quoted and billed separately. See our pricing page for examples.
• Onboarding. Switching from your current provider or from self-managed IT typically takes about a month. We document the environment, connect Addigy to Apple Business Manager, take over Google Workspace administration, deploy security tools and establish the backup, then hold a review once everything is stable.

Who we serve and where

CIO Landing has two offices, at 1 Northfield Plaza, Suite 300, Northfield, IL 60093 and 680 N Lake Shore Dr, Suite 821, Chicago, IL 60611. We provide on-site and remote support to businesses within a two-hour drive of Northfield: Chicago, the North Shore, the western and south suburbs including Naperville, Oak Brook, Schaumburg and Tinley Park, Northwest Indiana, and Southeast Wisconsin including Milwaukee and Kenosha. Many clients also have satellite offices across the U.S. and remote staff, and we support them wherever they work.

Our sweet spot is businesses with 25 to 300 employees. We do not take clients with fewer than 10 employees.

Frequently asked questions