Almost every IT support arrangement is organised into tiers, usually described as first line, second line and third line. The terms appear in job adverts, service agreements and escalation policies, but they are used inconsistently between providers and rarely explained to the organisations paying for the service. If you are comparing support contracts or reviewing your own internal setup, understanding what each tier is actually for makes it much easier to tell a well-designed service from a badly designed one.
What is first line support?
First line support is the initial point of contact for anyone reporting an IT problem. It receives the call, email or portal ticket, records the issue, gathers the details needed to understand it, and resolves everything that can be fixed from documented procedures and standard access. It is also responsible for keeping the user informed and for routing anything it cannot resolve to the right place.
First line is often described as the tier that handles "simple" problems, which undersells it. A better description is that first line handles known problems: issues that have been seen before, have a documented fix, and do not require specialist knowledge or elevated system access. The work typically includes:
- Password resets, account lockouts and multi-factor authentication issues
- New starter accounts, leaver removals and permission changes
- Printer, peripheral and basic connectivity faults
- Software installation, updates and licence assignment
- Guiding users through Microsoft 365, Teams and email problems
- Logging, categorising and prioritising every ticket accurately
- Initial triage of anything that needs escalating
The last two points are where first line quality really shows. A ticket that arrives at second line with clear reproduction steps, the affected user and device identified, and the diagnostic steps already tried gets resolved far faster than one that says "email not working". Poor triage does not just delay one ticket; it consumes second line time that should be spent on harder problems.
What is second line support?
Second line support handles problems that first line cannot resolve from documented procedures. This tier has deeper technical knowledge, broader system access and more time per ticket. Second line engineers investigate rather than follow a script.
Typical second line work includes:
- Faults with no known fix, requiring genuine diagnosis
- Server, network and infrastructure issues
- Configuration problems in Microsoft 365, Azure or on-premises systems
- Backup failures and restore requests
- Hardware diagnosis, repair and replacement
- Security alerts that need investigating
- Producing documentation so a recurring issue becomes a first line fix next time
That final responsibility is the one most often neglected. Every time second line solves a problem that could reasonably be handled at first line, it should write the procedure up. If that does not happen, the same issue escalates repeatedly and second line gradually fills with work that should never have reached it.
What is third line support?
Third line support is the deepest technical tier, dealing with problems that require specialist expertise, vendor involvement or changes to the underlying systems. It usually involves the people who designed or built the environment.
Third line work includes:
- Complex infrastructure and architecture faults
- Application and database level problems
- Escalation to software or hardware vendors
- Root cause analysis after a significant incident
- Design changes and major project work
- Security incidents requiring forensic investigation
Third line is deliberately not a queue you should reach often. If a meaningful share of tickets is arriving at third line, the problem is rarely that the issues are unusually hard. It is more often that the environment is fragile, that documentation is missing, or that the lower tiers are under-resourced.
Service desk or help desk: does the distinction matter?
The two terms are frequently used interchangeably, and in most UK small and medium-sized organisations they describe the same function. Where a distinction is drawn, a help desk is understood as reactive and incident-focused, fixing things that break, while a service desk covers a broader remit including service requests, change management and asset management alongside incidents, usually following an ITIL-aligned process.
The label matters far less than what is actually in scope. When comparing providers, ask what happens to a service request such as onboarding a new starter, not just what happens to a fault. That answer tells you more than whichever term appears on the website.
How many tiers should you actually have?
Three tiers is a convention, not a requirement. The right structure depends on scale.
A very small organisation may sensibly have two tiers, or even one competent generalist team, because formal escalation between tiers adds handoffs and each handoff costs time. Layering process onto a team of three people slows them down without improving outcomes.
Larger and more complex environments benefit from clearer separation, because it lets you resource each tier appropriately. High-volume, repeatable work is handled efficiently at first line, while expensive specialist time is reserved for problems that genuinely need it. Some organisations also add a "zero line" of self-service: a knowledge base, password self-reset and automated account provisioning that resolve issues before a ticket is ever created.
The failure mode to avoid is tiering as a queueing system. If your tiers exist mainly to move tickets away from whoever received them, users experience the structure as being passed around. Tiers should exist to match each problem to the right level of expertise on the first attempt.
Signs your support tiers are not working
A few patterns reliably indicate a structural problem rather than a busy week:
- A low first contact resolution rate. If first line resolves only a small minority of tickets, it is either under-trained, lacks the access it needs, or has no usable documentation. All three are fixable.
- The same issue escalating repeatedly. This means second line is solving problems without writing them up, so knowledge never moves down a tier.
- Tickets bouncing between tiers. Usually a sign that ownership is unclear and nobody is accountable for resolution.
- Third line permanently busy. Often a symptom of underlying fragility in the environment that no amount of support process will fix.
- Users bypassing the process. If people phone a favourite engineer directly, the official route is not working, and you lose visibility of the true ticket volume.
What to ask a provider about their tiers
If you are evaluating outsourced support, the structure behind the service is worth interrogating:
- What percentage of tickets are resolved at first contact, and how is that measured?
- Does first line have the access needed to resolve common issues, or does everything requiring administrative rights escalate?
- Who owns a ticket once it is escalated: does the original handler retain ownership, or does it change hands?
- How is knowledge moved down from second line to first line, and how often is documentation reviewed?
- Are response and escalation targets written into the agreement, and what happens when they are missed?
- Will we deal with a named team who know our environment, or the next available agent?
A provider with a genuinely well-run desk will answer all six comfortably and be able to show the numbers. Vague answers about "our expert team" in place of measured figures are the thing to be cautious of.
Frequently asked questions
What is first line support?
First line support is the first point of contact for IT problems. It logs and triages every incoming ticket, gathers the information needed to understand the issue, resolves anything covered by documented procedures and standard access, keeps the user updated, and escalates what it cannot fix. Typical first line work includes password resets, account and permission changes, connectivity and printer faults, software installation and Microsoft 365 issues.
What is the difference between first line and second line support?
First line handles known problems with documented fixes and standard access. Second line handles problems with no known fix, which need genuine diagnosis, deeper technical knowledge and broader system access, such as server and network faults, backup failures and complex configuration issues. Second line is also responsible for documenting new fixes so that recurring issues can be resolved at first line in future.
What does third line support do?
Third line support handles problems requiring specialist expertise, vendor escalation or changes to the underlying systems. That includes complex infrastructure and architecture faults, application and database level issues, root cause analysis after major incidents, security investigations and significant project work. It is intended to be a small proportion of overall ticket volume.
Is a help desk the same as a service desk?
In most UK small and medium-sized organisations the terms describe the same function. Where a distinction is made, a help desk is reactive and incident-focused while a service desk has a broader ITIL-aligned remit covering service requests, change and asset management as well as incidents. What matters when comparing providers is what is actually in scope, not which term is used.
How many lines of IT support does a small business need?
Many small organisations are well served by two tiers, or a single capable generalist team, because each escalation handoff costs time and adds little value at small scale. Clearer separation into three tiers becomes worthwhile as the environment grows more complex, because it allows high-volume repeatable work to be handled efficiently while reserving specialist time for problems that need it.
What is a good first contact resolution rate?
There is no single universal figure, because it depends heavily on the mix of work reaching the desk and on how much access first line holds. The more useful approach is to measure your own rate consistently, understand which ticket categories escalate most often, and work to move recurring categories down a tier through documentation and access changes. A rate that improves over time matters more than hitting a benchmark borrowed from another organisation.
Getting the structure right
Support tiers are a means of matching problems to the right expertise, not an organisational chart to be admired. The tests that matter are whether users get their issues resolved without being passed around, whether recurring problems get documented so they stop escalating, and whether expensive specialist time is spent on genuinely hard problems.
If your current arrangement is failing those tests, the fix is usually not another tier. It is better documentation, more access at first line, and clear ownership of every ticket from the point it is raised.
Synergi Tech provides outsourced IT helpdesk services to organisations across the UK, with response commitments set out in writing and reporting that shows where tickets are being resolved and which issues keep recurring. If you would like to review how your support is structured, get in touch.