Most businesses only think seriously about IT support during an outage, which is the worst possible moment to evaluate a provider. By then the questions that matter — who has the passwords, when was the backup last tested, which supplier owns the internet line — are being asked under pressure by people who are not sure of the answers. Choosing a managed IT partner well is largely about asking those questions on a calm Tuesday instead.
Reactive support is a floor, not a service
A provider that answers the phone and fixes what broke is meeting a minimum. The value in a managed arrangement comes from the problems that never reach you: the disk replaced before it failed, the certificate renewed before it expired, the account disabled the day someone left. Judge a provider on incidents avoided, which means asking what they monitor and what they act on without being asked.
The questions that reveal the difference
- What do you monitor continuously, and what happens automatically when a threshold is crossed?
- How often are backups tested by restoring them, and can we see the last test report?
- Who holds administrative credentials, and how do we retrieve them if we part company?
- What is your patching schedule, and how are exceptions approved and recorded?
- What happens outside business hours, and is that the same team or an overflow service?
Documentation is the real deliverable
Ask to see the documentation a provider maintains for an existing client, with details removed. If it does not exist, or exists only in one engineer’s memory, you are buying a dependency rather than a service. Good providers hand over a current network diagram, an asset register and a list of suppliers without hesitation — because they expect you to own it.
Service levels that mean something
Response time targets are often written to be easy to meet. Look for definitions that reflect business impact rather than ticket categories.
| Severity | Example | What to expect |
|---|---|---|
| Critical | Whole office offline, systems unavailable | Immediate acknowledgement, continuous work until resolved |
| High | One department blocked, a key system degraded | Same-day engagement, named engineer |
| Standard | Individual user issue with a workaround | Handled within the working day |
| Scheduled | New starter setup, planned changes | Booked in advance with a confirmed date |
Security belongs in the contract
Baseline security should be part of the service rather than an upsell after an incident: multi-factor authentication on every account that supports it, endpoint protection with central visibility, a joiners-and-leavers process that actually removes access, and a written incident response plan naming who is called and in what order. Data protection obligations sit with your business regardless of who administers the systems, so confirm current requirements with a qualified adviser rather than assuming your provider has interpreted them for you.
Onboarding a new provider properly
- Take a full inventory of hardware, software, licences, domains and supplier contracts before transition.
- Transfer ownership of domains, hosting and administrative accounts into your own name.
- Agree the monitoring set and alert thresholds in writing.
- Run a restore test in the first month, not the first year.
- Hold a review after ninety days against the service levels you agreed.
Cost and what drives it
Per-user pricing is simple to budget but can penalise businesses with many light users. Fixed-fee arrangements suit stable environments; time-and-materials suits low-change ones but removes the provider’s incentive to prevent problems. Whichever model you choose, make sure the incentives point the same way as your interests — a partner who earns more when things break is structurally misaligned with you.
A sensible first move
Before renewing or replacing anything, ask your current provider for three things in writing: the date of the last successful restore test, a current list of administrative accounts, and the network diagram. How quickly and completely those arrive will tell you more about the relationship than any proposal document.
