What to ask before you hire an IT support provider

Before you hire or renew an IT support provider, ask five things: how the pricing is structured, what response times are contracted, what security credentials they hold and what those prove, what happens when something goes wrong, and whether the arrangement can grow with you.

This checklist works whether you are sitting across from a new provider or quietly reassessing the one you have. It assumes nothing about switching. Each group of questions has a note on what a good answer sounds like, and a short section at the end shows how Lanmark answers the same list.

Why ask now, not after signing

Most businesses do not choose their IT arrangement so much as inherit it. Someone set it up years ago, the invoices kept arriving, and nobody has revisited it. So the first hard question usually gets asked on the day something has gone wrong, which is the worst day to learn that the response time you assumed was contractual was only ever a friendly assurance over the phone.

These are questions for a calm day: a renewal, a budget review, or the week a new provider approaches you. Ask them of the provider you already have, and treat the quality of the answer as information in its own right. For a picture of what the service should cover, see our guide to managed IT services in London.

Questions about pricing and what is included

The headline monthly number is the least informative part of any IT proposal. What matters is the shape of the pricing, because that determines what your bill does over the next three years as you hire people and add devices. For market context, see managed IT services pricing in the UK.

• Is pricing per user, per device or per call, and what does that mean as we grow? A good answer explains the model and shows the arithmetic for ten more staff. Charging per call rewards not fixing root causes.
• What is included in the monthly fee, and what is billed separately? Ask for a written inclusion list. Honest answers name the exclusions, usually hardware, third-party licences and project work.
• Are security monitoring and out-of-hours support included, or add-ons? A good answer is unambiguous either way. Beware a low headline price that excludes what matters most at three in the morning.
• Is there a minimum contract term, and what does leaving involve? A confident provider states the notice period and exit process without becoming defensive. The willingness to answer matters more than the term.
• Will the price change during the contract, and when? Look for a stated mechanism, such as an annual review tied to a published index, not a discretionary right to raise prices.

Questions about response times and SLAs

An SLA, or service level agreement, is the contractual promise about how quickly the provider will react and how quickly they will fix things. It is the difference between a courier promising next-day delivery in writing and one saying your parcel will arrive sometime this week. Only one of them owes you anything if it does not happen.

Note the two halves. Response time is how long before a human engages. Resolution time is how long before the problem is solved. A fifteen-minute response with no resolution commitment is a fast hello. Our guide to the IT support service level agreement goes into more detail.

• What are the contracted response and resolution times, in writing? A good answer is a document or clause reference, produced without hesitation. Numbers that exist only in conversation do not exist.
• Do response times change for critical and minor issues, and how is “critical” defined? Tiered targets are normal. Check who decides the tier: if the provider classifies severity alone, the top tier becomes hard to reach.
• Is support available out of hours, and at what cost? A good answer covers who is on duty overnight and at weekends, and whether it is a full service or an answering line.
• Who actually picks up the phone: an in-house team, an offshore desk or a subcontractor? There is no single right answer, only a right behaviour: telling you straightforwardly.
• Can we see real performance data against the SLA, not just the target? A good answer is a report of achieved times over the last quarter, including the months that went badly.

Questions about security credentials

Two pieces of jargon come up constantly. MDR stands for managed detection and response: a service that watches your systems for signs of attack and acts on what it finds. A SOC, or security operations centre, is the team doing that watching. Think of a night guard who raises the alarm while the intruder is still climbing through the window, rather than an alarm you hear about next morning when you find the door forced.

• What security monitoring is in place, and is it continuous (24x7x365) or business hours only? Attacks are launched outside working hours precisely because nobody is watching. A good answer states the coverage hours and what happens at two in the morning.
• What accreditations do you hold, and what did you have to prove to get them? The second half is the useful half. Certifications differ enormously in how much evidence they demand.
• Are you a Microsoft-accredited partner, and at what level? Partner status comes in tiers, some bought and some audited. Ask which levels or specialisms they hold, and whether they buy Microsoft licences directly or through an intermediary.
• How do you handle patching and updates across our systems? Look for a centrally managed process with reporting, so someone can say which machines are current. Automatic updates on laptops is a setting, not a process.
• Can you demonstrate compliance relevant to our sector? If you operate under a regulator, ask for the evidence pack they would send. Providers used to regulated clients have one ready.

Questions about what happens if things go wrong

Every provider looks capable when nothing is broken. This group is about failure modes: what they do in a genuine incident, and whether your data would come back to you intact if you asked for it.

• What happens in the first hour of a suspected cyber incident? A good answer is a sequence, not a sentiment: who is contacted, who can isolate a machine or disable an account, and when you are told. Vagueness here is the clearest warning sign on the checklist. See also our guide to the first hour of a data breach.
• Do you have a documented disaster recovery and business continuity plan, and have you tested it? Listen for the word “tested”. Ask when the last restore was performed and what it proved. A backup nobody has restored from is a theory.
• Who owns our data and documentation, and can we get it in a usable format? Ownership should sit with you, with network documentation, passwords and licence records available on request.
• What is your record on major outages, and how did you communicate during them? Nobody has a clean sheet, so you are testing candour. A provider who describes a bad week honestly, and what changed after it, is the safer bet.
• Is there a single point of failure, one person or one system? Ask what happens when the engineer who knows your setup is on holiday. Good providers answer with documentation, not a reassuring name.

Questions about scalability

The arrangement that suits you at forty users can become the thing holding you back at ninety. These questions test whether the provider is built to move with you.

• How do you handle new starters and leavers? Look for a defined process with a stated turnaround, particularly how fast a leaver’s access is revoked. Slow offboarding is a security exposure, not just an irritation.
• Can the arrangement flex up and down as headcount changes without renegotiating? A good answer explains how user numbers are counted and adjusted, and confirms that dips count as well as increases.
• How do you support a new office, a merger or a move to hybrid working? Ask what this looks like commercially as well as technically: whether a second site is a separate quotation or already covered.
• Do you offer strategic input, such as a technology roadmap, or purely reactive support? A good answer names the person you would meet periodically and what those conversations produce, such as a budgeted plan rather than a list of products.
• What is your capacity to take on a business twice our size, and have you done it before? A candid provider names their comfortable ceiling.

How Lanmark answers these questions

The list above is deliberately neutral, so it is only fair to run it over ourselves.

Pricing. Lanmark Total is priced per user, at £55 to £65 per user per month ex VAT (about £55 per user at 25 users), with unlimited support Monday to Friday, 8am to 6pm. We count users or devices, whichever is fewer, so a second laptop for one person does not add a charge. 24x7 support is available on request. See IT support packs for Total, Core and Flex.

Security. MDR, ITDR and a 24x7x365 SOC are part of Total rather than a separately priced add-on. See managed detection and response.

Credentials. We are a Microsoft Direct CSP, so we hold the Microsoft licensing relationship directly rather than reselling through an intermediary. We also hold Cyber Essentials, the UK government-backed certification covering the basic technical controls.

Performance data. From our own service desk system: 87% of calls answered in 15 seconds, an 11 minute average response, a 26 minute average resolution, 74% fixed at first contact and 99% customer satisfaction.

Continuity. Total includes Microsoft 365 backup, a named senior technician and an annual IT plan and budget.

What to do with your answers

Run this checklist on whoever is in front of you, including the provider you already have, and write the answers down. The value is in comparing them side by side. If the exercise reassures you, it has cost an hour. If it does not, SmoothSwitch explains how a handover works.

You are welcome to put the same questions to us. Contact Lanmark or call 020 7123 4910.