The buyer's guide to managed IT: what to ask before you sign

Almost every provider says backups run. Very few can show you evidence of a successful restore.

Ask:

• what is backed up, how often, and retained for how long
• where backups are stored, and whether a copy is off-site or immutable
• when a full restore was last tested, and what the result was
• what the recovery time and recovery point objectives are, in hours
• whether ransomware protection is included and how it works

A provider that tests restores quarterly and can show you the log is worth significantly more than one that runs nightly jobs nobody verifies.

What security is included, and what costs extra?

Endpoint protection, patching cadence, multi-factor authentication, access reviews and security awareness training are sometimes bundled and sometimes sold separately at multiples of the bundled price.

Ask what is included today, what it would cost to add the rest, and whether the provider will tell you about gaps they find — or only about gaps you ask about.

How do I leave?

This is the question that reveals the most about a provider.

Ask for:

• the notice period and any early-termination charges
• what happens to documentation, credentials and configurations on exit
• whether they will hand over directly to your internal team or a successor provider
• how long a transition period is included

A provider that resists answering this is telling you something important. A good one has an exit process already written down, because confident providers do not expect you to need to use it under duress.

What does reporting look like?

Monthly reporting should tell you something you did not already know. Ask to see a sample.

Useful reporting includes incident volumes and trends, time against target, recurring problems and their root causes, asset and licence status, security posture changes, and recommendations. Reporting that is only a list of tickets closed is an activity log, not a service review.

What is not covered?

Get the exclusions in writing. Common ones include hardware replacement costs, third-party licence fees, physical site visits beyond a monthly allowance, disaster recovery invocation, and major projects.

Exclusions are normal. Undisclosed exclusions discovered during an outage are not.

A practical test before you sign

Ask the provider to walk you through their last significant client incident: what happened, how it was detected, how long resolution took, what the client was told and when, and what changed afterwards.

A provider with real operational maturity can answer this in detail within a minute. One that cannot is either inexperienced or has not been honest about their track record.

Finally: check the incentives

A provider paid a flat monthly fee has an incentive to keep your environment stable and to reduce incidents. A provider paid per incident has an incentive for you to have more of them. Neither model is inherently wrong, but you should know which one you are buying and whether it aligns with what you need.