How to choose an IT support company: 20 questions to ask before you sign

Choosing an IT support company is one of the few purchasing decisions where the wrong choice is hard to see for a year and expensive to unwind. This guide takes you through what to prepare, the questions to ask every candidate, how to compare the answers fairly, and the practical differences between choosing a provider in London and in Hertfordshire. Every question is one we would expect to be asked ourselves.

Before you talk to anyone: prepare

Providers can only quote what they can see. An hour of preparation produces better proposals and lets you compare them.

Inventory what you have. Staff count, computers and laptops, servers or NAS, sites, firewalls, printers, phones. Microsoft 365 or another platform. Line-of-business applications and who supports them. How backups work, if you know. What security tools are in place.

List the problems. Ask staff what slows them down. Wi-Fi drops, slow file access, login problems, email issues, VPN instability. Concrete complaints let you ask "how would you fix this?" rather than "are you good?"

Note your obligations. UK GDPR applies to everyone. Add sector requirements in legal, healthcare or finance, cyber insurance conditions and any client questionnaires.

Decide what you need. Remote only, or on-site visits? Business hours, or extended? Fully outsourced, or co-managed alongside an internal person? A budget range, even a rough one. If you have no idea what the range should be, how much IT support costs in the UK gives the market context before anyone quotes.

Think two years ahead. More staff, a second office, a move to the cloud, retiring a server. A provider should be able to support the plan, not just the present.

If you are unsure whether you need a managed contract at all, does my business need IT support? works through the decision.

The 20 questions to ask

Ask every candidate the same questions and write down the answers. The list is grouped so you can use it as an agenda.

Scope and service

1. What exactly is included in the monthly fee, and can you list what is excluded?
2. Is support remote only, or are on-site visits included, capped or billable?
3. What are the support hours, and what happens outside them?
4. Do you use remote monitoring on every computer and server, and what do you do with the alerts?
5. How do you handle patching of Windows, browsers, Office and network equipment, and do we get a report?

Security and backup

6. Does "security" mean managed EDR, email filtering and MFA enforcement, or antivirus only?
7. Do you provide security awareness training and phishing simulation?
8. Can you take us through Cyber Essentials, and do you hold it yourselves?
9. Are backups included, monitored daily, and restore-tested? How often?
10. What is your incident response process if we are compromised?

Responsiveness and accountability

11. What does the SLA commit to for P1 to P4, and is the table in the contract?
12. How do we log tickets, and will we speak to an engineer or a call handler?
13. Will we have a named contact, and how often are account reviews held?
14. What reporting do we receive on tickets, patching and security?
15. Can you give us references from two businesses of our size, ideally in our sector?

Commercial and contractual

16. Is pricing per user or per device, what counts as each, and what changes the price?
17. What is the minimum term, the notice period and the renewal mechanism?
18. Are Microsoft 365 licences passed through at cost?
19. On exit, do we get all admin credentials, documentation and data back, free and within a timescale?
20. Can we see the contract before we decide?

A provider who answers all twenty clearly and in writing is telling you how the relationship will go. So is one who does not.

What good answers look like

For the questions that matter most, this is what you should hear.

• Exclusions: a list, not "other services may be chargeable", with a rate card for out-of-scope work and an approval rule. See what to look for in an IT support contract.
• SLA: a priority table in the contract with response and resolution or update targets, defined hours, reporting and a remedy. An average response time on the website is not an answer. See what an IT support SLA is.
• Security: managed EDR on every device, email filtering, MFA enforced, patching reported, awareness training available. The NCSC's Cyber Essentials overview describes the five controls a provider should be able to walk you through.
• Backups: monitored daily, restore-tested at a stated interval, with a documented recovery procedure. Microsoft 365 data backed up separately, because Microsoft's retention is not a backup.
• Documentation and exit: built during onboarding, shared with you, handed over free on exit along with credentials.
• References: offered without hesitation, from businesses like yours.

Comparing quotes fairly

The commonest mistake is comparing headline prices for different products. To compare properly:

1. Send every provider the same inventory and requirements.
2. Ask for the exclusions list and the SLA table with each quote.
3. Build a simple table: monthly fee, what is included, what is excluded and at what rate, on-site allowance, security tier, backup, term and notice.
4. Estimate a realistic year including likely out-of-scope work: a couple of on-site visits, a hardware refresh, a new starter every quarter.
5. Compare the year, not the month.

Market ranges and what moves them are in how much IT support costs in the UK. For an indicative figure on our per-device rates, use the IT support cost calculator.

Checking references properly

Most businesses ask for references and then do not call them, or call and ask "are they good?" Ten minutes with a real client tells you more than any proposal if you ask the right questions.

• How long did onboarding take, and what did it uncover?
• When you last had a serious outage, how quickly did an engineer start, and how were you kept informed?
• Have you seen a patching report or a backup test result in the last quarter?
• Who do you speak to, and how often does that change?
• Has an invoice ever surprised you?
• What would you change about them?

Ask for a reference of similar size and, if possible, in your sector. A provider whose only references are much larger or much smaller businesses may be a poor fit for yours. Case studies help, but a conversation is better. Ours are published for Mr Plant Hire and the Hertfordshire Golf & Country Club, and clients are usually happy to talk.

Red flags at the consultation

• No exclusions list, or reluctance to produce one.
• SLA on the website, not in the contract.
• "Security" that turns out to mean antivirus.
• No mention of backup testing, or of documentation.
• Vague about who you will actually speak to.
• No references, or references only from very different businesses.
• Pressure to sign a long term before you have seen the contract.
• Blaming previous providers for everything rather than explaining what they would do.

More on this in the signs of bad IT support.

Choosing in London versus Hertfordshire

Most of what a provider does is remote, so location matters less than it once did. It still matters in three ways.

On-site response. Hardware failures, network faults, cabling, office moves and CCTV need someone in the building. A provider within an hour's drive can be there the same day. For businesses in north London, Enfield, Waltham Abbey and Epping, a Hoddesdon base is closer than most central London providers, and the A10 and M25 make Hertford, Ware, Harlow, Bishop's Stortford, Stevenage and St Albans practical for regular visits.

Price. Central London providers carry higher premises and salary costs and tend to charge more for the same scope, particularly where regular on-site presence is included. A Hertfordshire provider can support a London office remotely at Hertfordshire rates.

Understanding of the area. Connectivity options, landlord constraints in multi-tenant buildings, and the practicalities of listed and older premises all vary. The Hertfordshire Golf & Country Club's network, for example, had to be built across a 16th-century Grade II listed mansion with metre-thick walls, which changes every assumption about Wi-Fi. Read the case study.

Our coverage pages for IT support in London and IT support in Hertfordshire set out how each works in practice.

After you choose: the first month

A good provider will run a structured onboarding: audit, credentials, monitoring, security review, backup test, helpdesk briefing, documentation and a findings report. The changeover itself is typically complete within 2 days, with the report following in the first month. Knowing what to expect lets you judge whether it is happening. The process is described in the first 30 days with a new IT provider.

What to do next

Take the 20 questions above into your consultations and ask for written answers. If you would like to put them to us, contact us and an engineer, rather than a salesperson, will answer every one and send you the contract to read before any decision.