How to choose an IT support provider for your business
A three-year IT support contract outlasts most of the laptops it covers. Here is the selection process we would use ourselves, from working out what you need to the clauses that decide whether you can ever leave.
A three-year IT support contract outlasts most of the laptops it covers. Sign the wrong one and you spend those years waiting on tickets, or find out on the day you try to leave that your provider holds every admin password and none of it is written down. For a business of 10 to 80 people the shortlist is usually a handful of local firms that all sound the same. This is how to tell them apart.
Decide what you actually need before you ask for quotes
Most buyers start by collecting quotes. Start by writing down what you are buying. A 15-person firm fully on cloud email and files needs a very different service from a 60-person manufacturer with servers on site.
Write a one-page description of your setup, your busiest hours, your busiest days and what "down" costs you. Our slow response article works that sum for a 25-person firm: the gap between a two-hour fix and a 20-minute fix is roughly £27,000 a year.
Then decide whether you want fully managed support or a top-up to someone in house. If an office manager already resets passwords and orders laptops, say so and ask for a price that reflects it. Our cost guide covers what the UK market charges for each model.
How fast will they respond, and who picks up?
Every provider says they are responsive. Ask for the number. The NCSC's guidance on choosing a managed service provider, published in November 2025, suggests urgent issues should get a response in under an hour and general requests within one business day. Treat that as the floor.
Then ask the harder question: who responds? A ticket acknowledged by an auto-reply in four minutes and touched by an engineer four hours later has a four-hour response time, whatever the dashboard says.
Ask these in the sales meeting.
- Is the first person I speak to an engineer, or a call logger?
- What is your average time from ticket to first engineer action, and can I see last quarter's figure?
- What happens at 5.30pm on a Friday?
- How many of your clients are my size?
Put the answers in the contract. We have a longer list in questions to ask an IT support company.
Is security included, or bolted on?
A support provider has administrative access to everything you own. The NCSC puts it plainly: a third party is a third attack surface, and attackers target support firms because one break-in opens many doors.
So security cannot be an optional extra on page three of the quote. The monthly price should include the controls the NCSC lists in its MSP guidance.
- Critical and high-risk patches applied within 14 days of release.
- Two-step verification on every account, including the provider's own access.
- Backups with a tested restore, not just a schedule.
- Logs kept long enough to investigate an incident, and a written procedure for one.
Ask two things about their own access. Does each engineer use a named account, or a shared one? The NCSC says actions must be traceable to an individual, and that providers should not hold permanent global admin rights as a matter of routine.
And do they hold Cyber Essentials themselves, or have a date to? The NCSC calls it the minimum standard the Government recommends for organisations of any size, so ask where they stand. We explain what Cyber Essentials actually involves separately.
The trade-off is cost. Built-in security is one reason a managed service costs more per user per month than a pay-as-you-go firm. When a law firm needed Cyber Essentials Plus for a tender, we got them certified in a month.
What should the contract say?
The contract decides whether you are a client or a hostage. Four clauses matter most.
- Notice period and term. Twelve months with 90 days' notice is common. Auto-renewal for a further year without a reminder is a problem.
- Who owns the admin credentials. Every password, software licence, domain and cloud tenant should be in your company's name, in a vault you can access. The provider works in your tenant. They do not own it.
- Documentation. Network diagrams, asset lists, configuration notes and the password vault are yours, kept current, and handed over in full on exit at no charge.
- Exit assistance. A fixed number of hours at a stated rate to hand over to a new provider. Without it, leaving becomes a negotiation.
The NCSC adds two more: a responsibility matrix saying who does what, and a duty to tell you about security incidents on their side within a set time. Our contract guide goes through each clause, and how to switch IT provider without downtime shows good exit terms in practice.
Take references, and know the warning signs
Ask for two references from businesses within 20 people of your own size. A 400-person client tells you nothing about how the desk treats a firm of 25. Ring them and ask what went wrong last year and how it was handled. "Nothing ever went wrong" is itself a warning sign.
Watch for these too.
- A quote that will not separate what is included from what costs extra.
- Response targets measured from "engineer assigned" rather than "ticket raised".
- Reluctance to say how many engineers are on the desk.
- Admin accounts in the provider's name, or a single shared login.
- Pressure to sign a 36-month term before you have seen the full contract.
We cover the full list in red flags when hiring an IT support company.
What we do
Systemwork has supported businesses across Leeds and Yorkshire since 2005. Our managed IT support is a fixed monthly price per user, with proactive monitoring included, and an engineer answers when you ring.
Where we are not the right fit, we will say so. A two-person firm with nothing but email usually does not need us.
Book a free IT audit. We will look at your setup and your current contract, and tell you plainly what we would change. Call 0113 898 0565 or use the button below.
Frequently asked questions
How long should an IT support contract be?
Twelve months is a fair starting point for a business of 10 to 80 people. Longer terms can earn a lower monthly price, but only agree one once you have read the exit clauses and notice period. A provider confident in its service does not need a three-year lock-in.
Should my IT support provider hold Cyber Essentials?
It is a good sign. The NCSC describes Cyber Essentials as the Government's minimum recommended standard for organisations of any size, and its MSP guidance suggests looking for Cyber Essentials Plus or equivalent. Ask whether they hold it, or when they will.
What response time should I expect from IT support?
The NCSC suggests under an hour for urgent issues and one business day for general requests. Ask how the provider measures it, because an automated acknowledgement is not a response. The figure that matters is time to first action by an engineer.
Who should own the admin passwords, us or the IT provider?
You. Every administrative account, licence, domain and cloud tenant should be registered to your business, with credentials in a vault you can open without the provider's help. The provider should work from named individual accounts in your tenant, so every change can be traced to a person.