How do you choose a managed IT service provider?

Choose the provider that will show you, in writing, what it covers, how fast it responds and how you would leave. Those three things decide what you actually get, more than the monthly price does.

A managed IT service provider takes responsibility for your firm’s IT for a monthly fee: support for your people, monitoring and maintenance, security, and advice on what to change next. Providers draw the line in very different places, and the contract is where you find out where.

This guide covers what a good provider should include, how to compare proposals, the warning signs, and which certifications are worth asking about.

What should a managed IT service provider cover?

A good contract covers five things. If a proposal leaves one out, ask why.

• Support for your people. A helpdesk for day-to-day problems, with written response times.
• Monitoring and maintenance. Updates, backups and device health checked continuously, not when something breaks.
• Security. Device protection, multi-factor authentication and email filtering included in the plan, not sold as add-ons.
• Microsoft 365 management. Licences, accounts, sharing and retention set up properly and kept tidy.
• Advice. Regular reviews of risk, budget and what to change next.

For a firm of 10 to 50 people with no internal IT, that is a fully managed service. If you already employ an IT person, co-managed IT is usually the better fit.

How do you compare proposals?

Response times. Every provider promises a fast response. Ask for the targets in writing, by priority. What the contract itself should say is covered in what your IT support contract and SLA should promise.

Security. UK GDPR Article 32 requires appropriate technical measures to protect personal data. Updates, multi-factor authentication and encryption belong in every plan. If security is a separate line item, the headline price is not the real price.

Pricing. A fixed monthly fee per user rewards the provider when fewer things break. Per-ticket pricing looks cheaper until a busy month. We set out typical figures in what managed IT costs per user.

People. Ask who will actually work on your account: a named engineer, or a queue. Then ask what happens when that person is on holiday.

What are the warning signs?

• A service level agreement with no numbers. No written response times, or so many exclusions that the targets never apply.
• A base plan plus extras. A low headline price, then charges for security, backups, site visits or adding a new starter.
• Silence between problems. No monthly report, so you only hear from them when something breaks.
• Admin access you don’t hold. Admin accounts and the Microsoft 365 tenant should be in your firm’s name, so you can leave cleanly.
• Hard to leave. Long automatic renewals and exit fees. Negotiate a break clause after the first year.
• No onboarding plan. Moving providers needs a written plan for accounts, documentation and handover, not “we’ll sort it as we go”.
• No references you can call. A good provider will put you in touch with firms like yours.
• Promises that nothing will go wrong. Things do go wrong. Ask what happened the last time, and how they handled it.

Which certifications should you ask about?

Certifications tell you a provider has had its own house checked. Two are worth asking about.

• Cyber Essentials and Cyber Essentials Plus. The government-backed scheme covers five basic technical controls. Plus adds independent testing that the controls work in practice. A certificate lasts 12 months, and current certificates can be checked with the certificate search on the IASME website, so check rather than trust a logo.
• ISO/IEC 27001. This certifies that an organisation runs a management system for information security. Ask to see the certificate and what it covers.

A provider’s certificate is not your firm’s. If clients or insurers ask whether you hold Cyber Essentials, ask the provider whether they will take your firm through it.

Which questions expose the gaps?

1. What is included in the monthly fee, line by line, and what is charged extra?
2. Can we see the full contract and service level agreement before we decide?
3. What security is in the plan, and who responds to an alert at 2am?
4. Who owns our admin accounts, backups and documentation if we leave?
5. Can we speak to two firms in our sector that you look after?

How do you make the final choice?

Write down three or four outcomes first, such as every user on multi-factor authentication or IT spend fixed per user. Ask every provider for the same four documents: what is included and excluded, the service level agreement, two sector references and a sample monthly report. Then score them on the same weights.

Call the references and ask what happened the last time something went badly wrong. The highest score should win, not the lowest quote.

If you want to know where your current set-up stands before you go to market, the IT Risk and Ownership Review looks at who owns your IT risk, including whether your Microsoft 365 data is backed up and when anyone last proved a restore works. You can also see how our managed IT service works, and what still sits with you in what your IT provider is responsible for.

Before you compare providers, it helps to know where you stand today; an IT health check gives you that. If you’re still deciding whether to outsource at all, see managed IT support vs IT outsourcing.

Frequently asked questions

What does a managed IT service provider do?

It takes responsibility for your IT for a monthly fee: support for your staff, monitoring and maintenance, security, and advice on what to change next.

How is managed IT different from break-fix?

Break-fix charges per incident, so the provider earns more when things go wrong. Managed IT is a fixed monthly fee that rewards prevention.

How many providers should we compare?

Three is usually enough to see real differences without turning the choice into a project. Ask each one for the same documents so you compare like with like.