Most businesses can tell you what they pay for IT support each month. Far fewer can say exactly what they get for it.
That gap is where problems hide: the same issues coming back every month, nobody able to show that backups actually work, security tools you assume are running but nobody checks, and admin passwords only your provider knows. An IT provider has deep access to your systems, which is why federal cybersecurity agencies, including CISA and the FBI, urge businesses to spell out security responsibilities in their managed service provider contracts.
These ten questions will tell you whether your provider is accountable, or whether you're paying for inadequate service.
10 questions to ask your IT provider
- What exactly is covered, and what costs extra? Get a written list of the users, devices, applications and locations covered, and what triggers a separate bill. Surprise invoices are often a sign the scope was never clear.
- What are your response and resolution times, in writing? A service level agreement (SLA) should state how fast urgent, high and normal requests get a response, and what happens after hours and on weekends.
- What do you report to us, and how often? Ask for regular reports covering tickets, recurring problems, patch status, security alerts and backup results. If you never see a report, you can't tell whether work is being done.
- Can you show us a successful restore? Backups that "run" are not the same as backups you can recover from. Ask when they last restored files and a full system for you, and how long it took.
- Who is responsible for security, and what is monitored 24/7? Clarify who handles endpoint protection, email security, multi-factor authentication, patching and alert response. Ask whether anyone is watching for threats overnight, or only during business hours.
- How do you protect your own access to our systems? Providers are targets because one breach can reach many customers. Ask whether their staff use multi-factor authentication, separate admin accounts, and logged, limited remote access.
- Who owns our accounts, licenses and documentation? Your business should own its domain names, Microsoft 365 or Google tenant, software licenses and administrator credentials, and have current documentation of your network. Ask for a copy.
- How do you plan ahead with us? A good provider meets with you regularly about aging equipment, upcoming projects, budget and risk, instead of only reacting when something breaks.
- What happens to recurring problems? Ask how they find root causes so the same issue doesn't keep coming back, and how they track whether fixes worked.
- What happens if we leave? Contract length, termination terms and a clear handoff process matter. You should be able to get your credentials, documentation and data without delay, and the provider should remove its access when the relationship ends.
Warning signs you're paying for inadequate service
- The same problems come back month after month.
- You can't get a straight answer on what your monthly fee covers.
- You have never seen a report, a backup test or a security review.
- Response times depend on who you know at the provider.
- Only the provider knows your administrator passwords.
- Every project is a surprise, with no planning or budget conversation ahead of time.
How to use these questions
You don't need to switch providers to get answers. Send the list to your current provider and ask for written responses. A strong provider will welcome the questions and answer them quickly. Vague answers, or no answers, tell you what you need to know.
If you're comparing providers, ask every candidate the same ten questions so you can compare real commitments instead of sales promises. Our guide on how to choose a managed IT provider covers the selection process, and our comparison of managed IT and break/fix support explains the difference in accountability between the two models.
Where to start
Start with questions 4, 5 and 7: proof that backups restore, clarity on who owns security, and confirmation that your business owns its accounts and documentation. Those three answers reveal the most risk.
HUFF DATA SYSTEMS provides managed IT services and CTO-level technology leadership for Texas businesses in Victoria, Houston and beyond. If you would like a second opinion on your current IT support, talk with our team.
Sources
- Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A), CISA, NSA, FBI and international partners
- Risk Considerations for Managed Service Provider Customers, CISA