Critical PHP vulnerability patched 21 October. Most business websites are affected. What to ask your web host →

Choosing an IT Provider

12 questions to ask an IT provider before you sign

Most managed IT proposals look roughly the same. Similar bullet lists, similar language, a number at the bottom. The differences that matter are rarely on the page — you have to ask.

Here are the questions worth asking any provider you’re considering, including us. If a provider gets uncomfortable with several of these, that itself is the answer.

About what you’re actually buying

1. What exactly is included, and what gets billed separately?

Ask for the exclusions list, not the inclusions list. Every agreement has one. The gap between “unlimited support” and “unlimited support excluding projects, moves, new user setup, and anything on-site” is where most billing disputes live.

2. Is this per user or per device, and what counts as a device?

Per-device pricing looks cheaper until you count the tablets, the second monitor station, the back-office PC nobody uses. Ask what happens when you add a location, and whether the count trues up automatically or gets renegotiated.

3. What’s the contract term, and what does it take to leave?

Three-year terms with automatic renewal are common and not automatically bad — but you should know before you sign, not eleven months in. Ask specifically: what notice period, what happens to your data, and will they help with the transition or make it painful.

4. Who owns the documentation and the credentials?

This is the one most people forget, and the one that costs the most later. If your provider holds your firewall passwords, your domain registrar login, and your only network diagram, leaving them is genuinely difficult. The answer should be that you own all of it and can request a copy at any time.

About how they actually work

5. Who answers when I call?

A named person who knows your setup, or a queue that starts from scratch? Both are legitimate models at different price points. Just know which one you’re buying.

6. What’s the response time, and is it in the contract?

A response time on a website is marketing. A response time in the agreement, with a defined remedy if it’s missed, is a commitment. Ask which one you’re being offered.

7. What happens after hours?

If you run a restaurant, retail shop, or anything with evening or weekend trade, this is not a small question. Find out whether after-hours is included, billed hourly, or simply unavailable until Monday.

8. Have you seen my environment before you quoted?

A provider who quotes a monthly figure without looking at what they’re taking responsibility for is guessing. That guess gets corrected later, usually upward, usually in a conversation you didn’t want to have.

About security and risk

9. Is the security tooling monitored, or just installed?

Endpoint protection that nobody watches is a checkbox, not a control. Ask who reviews the alerts, how quickly, and what happens at 2am on a Sunday when something fires.

10. When did you last test a restore?

Backups that have never been restored are a hypothesis. Ask for the date of the most recent test restore and what it covered. “We back up nightly” is not an answer to this question.

11. If we take card payments, how is that network segmented?

Your guest Wi-Fi, your point-of-sale, and your back-office should not be on the same flat network. If a provider doesn’t raise segmentation before you do, they’re not thinking about PCI at all.

12. What are you not good at?

The most revealing question on this list. Every provider has a boundary somewhere. We build the network your point-of-sale system runs on, for instance, but we don’t install or support the POS software itself — that’s your POS vendor’s job, and we’d rather coordinate with them than pretend otherwise.

A provider who claims to do everything equally well is either much larger than they appear or not being straight with you.

A note on comparing quotes

When you have two or three proposals, normalize them before you compare the monthly figures. List every service each one explicitly includes and explicitly excludes. Work out the true all-in first-year cost, onboarding included. Check whether security tooling and backup are in the base price or bolted on.

A quote that looks a third cheaper often isn’t, once the scope matches. Occasionally it genuinely is — and then the question becomes what they’ve left out.

Where we’d start

We built Groundwork partly because question eight kept coming up. It’s a fixed-fee audit that documents what you actually have and produces a prioritized fix list with real costs. You keep the report whether or not you hire us, and the fee is credited back in full if you start a managed plan.

Take it to another provider if you’d rather. A documented picture of your own environment makes every quote you receive easier to judge.

Next step

Let's talk about what you're running.

A short call to understand your setup. We'll tell you what we'd do first — whether or not you hire us.

Book a call