Questions to ask an IT support company before you sign
Eighteen questions to put to every IT support company on your shortlist, grouped by topic, each with a one-line guide to what a good answer and a weak answer sound like.
You have four IT support quotes on the desk and an hour booked with each provider. Most of those hours get spent watching a slideshow. Spend yours asking questions instead.
This is the companion to our guide on how to choose an IT support provider. That article weighs things up. This one is the list to take into the room. Print it and mark every answer good or weak as you go.
Several questions come from the NCSC guidance on choosing an MSP, the best free due-diligence document in the UK for this job. We have noted where.
Response and support
1. Who answers the phone when I ring, and are they an engineer? Good: an engineer on the service desk picks up and starts work on the call. Weak: a call handler logs a ticket and "someone will ring you back".
2. How do you measure response time, and from when? Good: from the moment the ticket is logged, on every ticket, reported to you monthly. Weak: "we're usually pretty quick", with no figure and no report.
3. What counts as urgent, and who decides? Good: written priority definitions you have seen, and you can escalate. Weak: whoever picks up the ticket decides on the day. The NCSC treats a response under one hour for urgent issues as standard, so anything slower needs a reason.
4. What are your support hours, and what happens outside them? Good: clear hours and a priced out-of-hours option backed by a real on-call rota. Weak: "just ring the owner's mobile".
Slow answers here are expensive. We worked out what a slow IT response costs a 25-person firm, and the gap between 20 minutes and two hours runs to tens of thousands a year.
Security
5. What security is included in the monthly price, and what costs extra? Good: an itemised list, so you can compare like with like across quotes. Weak: "all our clients are fully protected", with no list.
6. How quickly do you patch, and how do you know it has happened? Good: critical updates applied within 14 days of release, the NCSC's benchmark, with a compliance report to prove it. Weak: "it's all automatic", which usually means nobody checks.
7. How do your own engineers get into our systems? Good: named accounts per engineer, two-step verification on every one, least privilege, and access removed the day someone leaves. Weak: a shared admin login that everyone knows. The NCSC guidance asks specifically whether MSPs protect their own access with 2SV.
8. What happens if you are breached? Good: a written incident plan, notification within a set number of hours, a named contact for you, and the provider's own certifications on the table. Weak: "that won't happen to us". The NCSC says the contract should set out how and when security incidents are notified, so ask to see that clause. More in what cyber security your IT provider should include.
The NCSC also suggests checking whether the provider itself holds Cyber Essentials Plus. If you are heading for certification yourself, read what Cyber Essentials actually involves first.
People and continuity
9. Who owns the admin passwords, the domain, the licences and the backups? Good: you do, every one of them, held in a password manager you can open today. Weak: "we look after all that for you". This is the question most providers hope you will not ask.
10. What happens when our named engineer is on holiday or leaves? Good: your environment is documented well enough that any desk engineer can pick it up, and they can show you that documentation. Weak: "Dave knows your system inside out". Dave will leave eventually.
Contract and exit
11. What is the minimum term, and what is the notice period? Good: 12 months or rolling, with 90 days' notice, in writing. Weak: 36 months with automatic renewal and a notice window you have to hit to the day. The full list of clauses is in what should be in an IT support contract.
12. If we leave, what do we get back, when, and what does it cost? Good: all documentation, passwords, licences and data handed over within a set number of days at no charge. Weak: an exit fee, or "we'd work something out". A clean exit is what makes it possible to switch IT provider without downtime.
13. Is there a written matrix of who is responsible for what? Good: yes, and it is in the contract. The NCSC recommends a matrix of responsibilities so neither side assumes the other is handling backups or renewals. Weak: "we handle everything", which in practice means nobody handles some things.
14. How do price rises work? Good: fixed for the term, then written notice and a cap linked to an index. Weak: "we review annually", with no cap and no notice.
Onboarding
15. What does onboarding involve, and how long does it take? Good: an audit of what you have, documentation written from scratch, monitoring installed, a named project lead and a date. Weak: "we just take over from your current lot".
16. Will you audit us before quoting? Good: yes, and you keep the report whether or not you sign. Weak: a quote worked out from your headcount alone, without anyone looking at your systems.
Reporting
17. What is in the monthly report? Good: tickets logged and closed, response times against target, patch compliance, backup success and failure, and a summary of security alerts. The NCSC lists most of these for an infrastructure health report. Weak: there is no report, or the report is the invoice.
18. How often do we review the service, and who turns up? Good: a scheduled review every quarter with an account manager and an engineer, plus a plan for the year ahead. Weak: "ring us if there's a problem".
Some answers should end the conversation outright. We have collected those in red flags when hiring an IT support company.
What we do
Systemwork has supported businesses across Leeds and Yorkshire since 2005. Our managed IT support is a fixed monthly price per user, with a service desk staffed by engineers and proactive monitoring included. Site visits are included too, except for project work.
We would rather you asked us these questions than not. We are not the right fit for everyone. If you need round-the-clock support across several time zones, say so early and we will tell you honestly whether we can cover it.
Every new client starts with a free IT audit. Book one and bring this list. Call 0113 898 0565 or use the button below.
Frequently asked questions
How many IT support companies should I shortlist?
Two to four is enough. Fewer than two and you have nothing to compare against. More than four and you will not have time to ask each one the full list properly.
Should I ask an IT support company for references?
Yes, and ask for clients of a similar size and sector to yours, then actually ring them. The NCSC guidance recommends asking for references from other small businesses. Ask the reference how the provider handled their worst day, not their best.
What if a provider will not say who owns the admin passwords?
Treat it as a no. Admin credentials, your domain, your licences and your backups belong to your business, and a provider that is vague about handing them over is making your exit harder before you have joined. Put the ownership in the contract and ask to see the password manager before you sign.
Can I put these questions to my current IT support company?
You can, and it is a useful exercise before a renewal. Ask how they measure response time, who owns the passwords, what the notice period is and what leaving would involve. If the answers are vague after years of working together, that tells you what you need to know.