How to choose an IT support provider: 10 questions to ask

Most small businesses pick an IT provider the same way they pick a plumber: someone recommended them, the price sounded fair, and nobody asked what happens when something goes wrong. With IT, the provider ends up with access to your email, your files, your devices and frequently your administrator accounts — so the choice deserves more care.

The UK National Cyber Security Centre publishes guidance for smaller organisations on choosing and working with a managed service provider, including a checklist for sourcing one. The ten questions below follow the same spirit and are the ones we would ask if we were the customer.

1. Can I see the price before I talk to a salesperson?

Managed IT is usually priced per user, per month. If a provider will only give a figure after a sales call, you cannot compare it with anyone else. Published prices — with the minimum monthly charge stated — let you check like with like before you spend an hour on a call.

2. Exactly what is included, and what is not?

“Unlimited support” means different things at different firms. Ask what is covered (helpdesk, device management, Microsoft 365 administration, security tools, backup monitoring) and what is a separate project with a separate price, so there are no surprises on the first invoice.

3. Who is responsible for what?

Even with a good provider, some security tasks stay with you — approving access for new starters, for example. The NCSC encourages customers to be clear about which duties sit with the provider and which stay in-house, and to make sure cybersecurity services are written into the scope of work. Patching and antivirus are not the same thing as someone actively watching for threats.

4. How do you handle security, and can you show it?

Ask about multi-factor authentication, how admin access to your systems is protected, and how the provider secures its own tools. Certifications such as Cyber Essentials or ISO 27001 are a useful sign that a firm takes security seriously, and they can usually be verified — ask for the certificate number. A certificate does not replace correct configuration of your own services, so ask how that is done too.

5. What happens when something goes wrong?

Ask how quickly you can expect a reply, how urgent problems are handled, whether there is out-of-hours cover, and how the provider will tell you if it has a security incident of its own. A calm, written answer to these questions is a good indicator of how they behave under pressure.

6. Can I speak to other clients like me?

The NCSC suggests asking for testimonials or references from other customers, particularly small and medium-sized ones. A provider that mostly looks after 500-seat enterprises may run things very differently from one built for a team of 15.

7. Who will I actually deal with?

Find out whether you get a named person who knows your business, or a ticket queue. Neither is automatically wrong, but you should know which you are buying — and what happens when your contact is on holiday.

8. How are backups handled, and has a restore ever been tested?

A backup that has never been restored is a hope, not a plan. Ask what is backed up (files, email, line-of-business systems), where copies are kept, and when a restore was last tested.

9. What does the contract say, and how do I leave?

Check the term, the notice period and any minimums. Just as important: on exit, will you receive your administrator credentials, documentation and domain details? Your accounts and your data should always belong to you, not to the provider.

10. Will they look beyond fixing things?

Good IT support is also forward-looking: regular reviews in plain English, a view on what to replace or improve next, and honest advice when something you are paying for is not needed.

How Quest360 answers these questions

• Prices are published. Managed IT starts at £49 per user per month (minimum monthly charge applies) — see the pricing page for every plan and what it includes.
• Inclusions are listed. Essential covers remote helpdesk, Microsoft 365 administration, device monitoring and patching, endpoint protection and backup monitoring. Growth adds advanced security, MFA, automated backup monitoring, priority support and quarterly reviews. Complete adds enhanced cybersecurity and compliance, Cyber Essentials support, disaster recovery planning and an annual technology audit.
• You start with a free IT health check — an honest look at your website, devices, security and cloud, with no obligation to act on it.
• You talk to people, not a queue. We read and reply to enquiries ourselves, usually within one business day.

Frequently asked questions

What is a managed service provider (MSP)?

A managed service provider looks after some or all of a business’s IT on an ongoing basis, usually for a monthly fee — support for staff, device and Microsoft 365 management, security and backups — instead of fixing problems only when they happen.

How much does managed IT support cost for a small business?

Managed IT is normally priced per user, per month. Quest360’s published prices start at £49 per user per month, with a minimum monthly charge, and the full plan inclusions are listed on the pricing page so you can compare like with like.

Do I need Cyber Essentials?

Cyber Essentials is a UK government-backed certification showing a baseline of security practices. It is not legally required for most businesses, but some enterprise and public-sector customers ask for it, and working toward it is a practical way to close common security gaps.

What should be in an IT support contract?

The services included, who is responsible for each security task, response times, how incidents are reported to you, the term and notice period, and how access, documentation and accounts are handed back to you if you leave.

If you would like a second opinion on a quote you have already received, book a free IT health check and we will tell you honestly where you stand.