Small business security
What to ask before choosing a managed IT provider
A managed IT provider can take a huge load off a small business. They also end up holding the keys to everything: admin accounts, remote access to every computer, backups and email. That makes the choice a security decision as much as a service one. These are the questions we’d want answered if we were choosing.
The short version
The questions that matter most
- How do you secure your own access to our systems?
- What exactly is included, and what costs extra?
- How fast do you respond, and who answers?
- If we leave, what do we get back?
Security of their access
Attackers target IT providers because one breach can reach many customers. The ASD has warned about attacks exploiting remote monitoring and management tools. Ask:
- Do all your staff use MFA, ideally phishing-resistant, for your tools and our systems?
- Which remote access and management tools do you use, and how are they secured and updated?
- Does each technician have their own login, so actions can be traced?
- Do you use separate admin accounts for our environment, rather than everyday accounts?
- How do you remove access when a technician leaves your business?
- Have you had a security incident, and how did you handle it?
What’s included
- Which devices, users and systems are covered?
- Is security monitoring included, or just helpdesk support?
- Are backups included, and who tests that they can be restored?
- Is patching included for computers, servers, network gear and line-of-business apps?
- What’s excluded, and how are extra projects quoted?
- Are prices per user, per device or fixed?
Responsiveness
| Ask | Why |
|---|---|
| What are your response times for urgent, normal and low-priority issues? | So you know what to expect when something breaks |
| Who answers out of hours, and what’s covered? | Incidents don’t keep business hours |
| Will we have a named contact who knows our business? | Continuity matters |
| How do you report what you’ve done? | You should see regular, plain-English reporting |
Ownership and documentation
- Will our accounts, licences and domains be registered in our business’s name?
- Will you document our systems, passwords and configurations, and will we have access to that documentation?
- Do we keep at least one emergency admin account of our own?
Leaving
The best time to ask about leaving is before you sign.
- What’s the notice period?
- What will you hand over: documentation, admin access, backups, licences?
- Will you help transition to a new provider, and at what cost?
A good provider welcomes these questions
Clear, specific answers in writing are a good sign. Vague answers about security, or reluctance to put accounts in your name, are warning signs.
Watch for
- Shared logins between technicians.
- Your domain, Microsoft 365 tenant or software licences registered to the provider.
- No MFA on their own tools.
- No written agreement, or one without response times.
- Promises that sound too good, like “100% secure” or “guaranteed no downtime”.
Common questions
Should we still have someone in the business who understands our IT?
Yes. Not a technical expert, but someone who knows what you have, who the provider is and where the documentation lives.
Is a bigger provider safer?
Not automatically. Ask the same questions regardless of size.
Can we check their security ourselves?
Ask how they align with frameworks such as the Essential Eight, and what independent assessments they’ve had. Then judge whether the answers are specific.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.