Choosing an IT company is a long relationship decision. The right provider becomes the team your staff call when work stops, the people who hold your passwords and the advisor who shapes your budget. These questions help you compare providers on what matters.
Start with how support works
Ask each provider to walk you through a real problem, start to finish.
- Who answers? A help desk that knows your systems, or a call center reading a script?
- How are urgent issues handled? What counts as urgent, how you reach someone and how you are kept updated.
- Remote or on site? Most issues should be fixed remotely. Ask what happens when someone needs to come to your office, and who that person is.
- What hours are covered? Know exactly when support is available, and get it in writing.
Be wary of vague promises. A clear description of the process tells you more than a bold claim on a website.
Ask about security
Security should be standard in any managed IT agreement, not an optional extra. Ask whether these are included:
- Multi-factor authentication for email, remote access and admin accounts.
- Managed endpoint protection on every device.
- Patching on a schedule, with reporting.
- Backups that are monitored daily and test restored.
- Monitoring for suspicious sign-ins and mailbox changes.
- Security awareness training for staff.
Ask how they would help with a cyber insurance questionnaire. A good provider will tell you which controls you are missing before you sign the form.
Understand pricing
Providers price per user, per device or both. Ask:
- What exactly is included in the monthly fee?
- What is billed extra: projects, on-site visits, new hire setup, work outside office hours?
- How does the price change when you add or remove people and computers?
- Are software licenses and security tools included or separate?
Get two or three quotes for the same scope. Our guide to managed IT pricing explains the common models.
Read the agreement
The agreement matters as much as the sales pitch. Check:
- Length. Managed IT agreements are usually longer-term. Know the term and the renewal terms.
- Scope. What is covered and what is excluded, in writing.
- Exit terms. What happens at the end, how much notice is needed and how handover works.
- Documentation. Who owns your network diagrams, passwords and system records. It should be you.
Check fit
Finally, ask whether the provider knows your industry. A dental office needs someone who understands imaging and HIPAA training. A law firm needs email fraud protection and secure document access. A defense supplier needs CMMC preparation from people who know NIST SP 800-171. Ask for examples of similar clients and the software they support.
Ask how they protect their own access
An IT provider holds the keys to your systems, and attackers know it. In July 2021, criminals exploited remote management software used by many providers and pushed ransomware to hundreds of downstream businesses in a single attack. Ask any provider:
- Do your engineers use MFA on every tool that can reach our systems?
- Are admin rights to our systems limited to named engineers, and logged?
- How quickly do you remove access when one of your employees leaves?
- Do you carry cyber insurance and professional liability coverage?
A provider that answers these clearly takes security seriously. One that hesitates may be your weakest link.
Ask about the first months
The start of a relationship sets the tone. Ask what onboarding looks like:
- Discovery. They should document every device, account, license, vendor and network setting.
- Security baseline. Expect MFA, endpoint protection, patching and backup checks to be set up early.
- Quick wins and known risks. A written list of urgent problems found during onboarding, with a plan.
- Introductions. Who your staff will talk to, and how to reach the help desk.
Ask whether onboarding has a separate fee and what it covers.
Ask for reporting
You should not have to guess whether the work is getting done. Good providers send regular reports on tickets, patch status, backup results and security alerts, and meet with leadership to review them and plan the year ahead. Ask to see a sample report.
Talk to references
Ask for two or three clients of similar size and industry, and call them. Useful questions:
- How do they handle an outage or a security scare?
- Do they explain things in plain language?
- Have invoices matched what was promised?
- How did onboarding go, and what would you do differently?
Red flags
- No written scope, or a scope that changes with each conversation.
- Pressure to sign before you have read the agreement.
- The provider keeps your admin passwords and documentation to themselves.
- Security tools sold as add-ons to every line item.
- Big promises with no detail about how support actually works.
Plan the switch
Changing providers goes smoothly when you plan it. Make sure you hold admin credentials for your Microsoft 365 tenant, domain registrar, firewall and backups before the old agreement ends. Ask the outgoing provider for documentation and a handover call, and give the new provider time to overlap. Your staff should know exactly when to start calling the new help desk.
Questions for regulated businesses
If your industry has security rules, the provider becomes part of how you meet them. Ask questions that match your obligations:
- Health care: Will the provider sign a business associate agreement under HIPAA? How do they support your security risk analysis without taking it over?
- Tax and accounting: Can they implement and document the technical safeguards your written information security plan describes under the FTC Safeguards Rule?
- Financial advisors: How do they help with books and records archiving and the vendor oversight required under Regulation S-P?
- Defense suppliers: Do they understand that a provider with access to your CUI environment is part of your CMMC assessment scope? How are their own tools and staff prepared for that?
- Banks and credit unions: Will they support your vendor management program, provide reports for the board and work within the risk assessment you own?
A provider that has done this work before will answer quickly and specifically. Ask for sample documentation, such as a business associate agreement or a quarterly board report, with client names removed.
A short checklist
- Can they describe how an urgent issue is handled, step by step?
- Is security included, and does it cover MFA, backups and monitoring?
- Is pricing clear, with exclusions listed?
- Do you own your documentation?
- Do they know your industry software and rules?