The questions to ask a managed IT provider are the ones whose answers should end up in the contract. Ask how quickly they respond, what the monthly fee covers and leaves out, and how they protect their own access to your systems. Ask when your backups were last restored in a test, how onboarding and an exit work, and who owns the accounts and documentation. Then get every answer that matters written into the agreement before you sign.
Proposals for managed IT services often read alike. The differences show up on the morning a server will not start, or in the week you decide to change providers. By then, the signed agreement is what you have to work with. Bring this checklist to every provider meeting so each one answers the same questions.
What should you ask a managed IT provider about response times?
Ask for response commitments by priority. A clear agreement defines urgent problems, such as a server down or an office unable to work, and routine ones, such as a new user account. Then it states how quickly each level gets a response during covered hours.
Response and resolution are different promises. A response can be an automatic email, a ticket number or a technician on the phone, so ask which one the agreement means. Check whether evenings and weekends are covered, whether after-hours work costs extra, and how a ticket moves up when the first technician cannot fix it.
Say you run a small law office in Media and the file server stops on a Monday morning before a filing deadline. That morning, a general promise of fast service gives you nothing to point to. You want the agreement to say how soon a technician calls back when something stops the office working.
What does a managed IT contract cover, and what costs extra?
Get the scope as a list of devices, users, locations and software. The monthly fee pays for what is on that list. Anything not on the list is quoted separately or billed by the hour, and some of it ends up being nobody’s job.
The Cybersecurity and Infrastructure Security Agency (CISA) and its partner agencies have published guidance for managed service providers and their customers. It says a provider should explain which services the customer is buying, which it is not, and how incident response and recovery will work. Get that explanation in writing, with the exclusions listed.
The gray areas deserve the most attention. Will the provider call your accounting software vendor when that program breaks? Are new staff setups and on-site visits included? Are moving offices, replacing a server, and buying hardware or licenses covered, or quoted separately? If you are also weighing hosted VoIP or an on-site phone system, ask which parts the IT agreement covers. The same goes for a failing cable run: is that support, or a structured cabling and network infrastructure project with its own price?
How will the provider protect its access to your systems?
A managed IT provider usually holds administrator access to your network, so its security is part of yours. CISA’s guidance says these providers typically need privileged access to customer systems, and that attackers have targeted them as a way into their customers’ networks. It suggests making sure the agreement:
- spells out which security duties belong to the provider and which stay with you
- requires multifactor authentication on every account the provider uses to reach your systems
- stops the provider from reusing administrator credentials across its customers
- states how and when the provider will tell you about an incident that affects you
Then ask how they apply software updates, and how you will know the updates happened. Find out whether they use subcontractors, such as an outside after-hours help desk, and whether you can see a record of when their staff connected. CISA also advises limiting the provider’s accounts to the systems it manages, rather than adding them to your own administrator groups.
How do you know your backups will restore?
Ask when someone last restored files or a full system from your backups, and ask to see the result. CISA’s #StopRansomware Guide recommends offline, encrypted backups of critical data, regularly tested for availability and integrity in a disaster recovery scenario. Where a provider looks after the backups, the guide suggests writing those requirements into the contract.
Find out what is backed up: the server, the workstations, and the email and files kept in cloud services such as Microsoft 365. Ask where the copies are stored and whether they sit apart from your network, since CISA warns that many ransomware variants look for reachable backups to encrypt or delete. Get the provider’s own estimate of how long a full restore would take, and find out who decides how long copies are kept.
What happens during onboarding, and what happens if you leave?
Onboarding should leave you with a record of every device, account, license and vendor, with the administrator passwords in a password manager your business controls. Ask what onboarding includes, who on your staff needs to take part and when full support begins. If you are replacing another provider or an in-house IT person, ask whether the passwords they knew will be changed.
Ask about the exit while you are still choosing. What is the notice period, and does the term renew automatically? What will the provider hand back: administrator passwords, documentation, backup copies, license records? Is help with the transition billed? CISA notes that disabling a provider’s accounts can be overlooked when a contract ends, so put account removal in the exit terms.
Who should own the accounts and documentation?
Your business should. Put the domain name, the Microsoft 365 or Google Workspace account, software licenses and the backup storage account in your company’s name. Make sure your company also controls the administrator logins for the firewall and Wi-Fi, with at least one held by someone on your own staff.
Treat documentation the same way. The network diagram, equipment list, license records, vendor contacts and backup schedule are records of your business. Find out where they will be kept and whether you can see them at any time. Our guide to planning integrated security and technology makes the same point about cameras, doors and phones: the business should own the accounts, so a staffing change does not leave it dependent on one person.
What does managed IT support from Logic LC include?
Logic LC provides managed IT services in the Philadelphia area. We start by reviewing your computers, servers, network and business applications. Then we recommend a support plan and identify equipment or software that needs attention. The agreed scope sets out what our team will manage.
We agree on coverage and escalation steps before service begins. We also agree on support contacts, service hours and maintenance responsibilities, so your staff know how to get help. Day to day, support can mean monitoring your network, managing computers and servers, answering help desk requests, sorting out software and access problems, and planning what to upgrade next. Our article on server and network monitoring explains more about the monitoring side. Tell our team your location and support needs, and we will confirm coverage and the right service plan.
What should you do before you sign?
- Write down what you have: devices, users, locations, software, internet and phone providers, and current contracts.
- Send every provider on your shortlist the same questions and ask for written answers.
- Read the full agreement and statement of work, not only the proposal.
- Compare the exclusions side by side.
- Decide who on your staff will hold the administrator accounts.
- Have your attorney review the term, renewal and exit sections.
Keep the written answers with the signed agreement, where the next person to manage the relationship can find them.
