12 questions to ask an IT support provider before you sign

Short answer. The questions worth asking an IT provider are about people, ownership and terms, not tools. Who answers the phone and do they know your setup? What is in your name and what is in theirs? What happens when you leave? A provider who answers those three plainly is usually fine on everything else. This post gives you twelve questions, what a good answer sounds like, and the answers that should end the meeting.

I sit on the other side of this table, so take the list in that spirit. These are the questions I would want a prospective client to ask me, because the answers are where I differ from a bigger firm.

1. Who will I actually speak to when something breaks?

Good answer: a name, or a very short list of names, and how many clients they cover. Bad answer: “our service desk team”, with no number attached. A desk of eight people covering 300 clients is a ticket queue with a friendly voice.

2. How many clients do you have, and how many staff?

The ratio tells you more than either number. Fifty clients across five engineers is one thing; four hundred across six is another. You want to know how much attention is realistically left for you.

3. What is your response time, in writing?

Ask for the contract clause, not the brochure. Good answer: an acknowledgement inside an hour during business hours, work starting on urgent issues the same day, with those words in the agreement. Bad answer: “ten-second response”, which describes an auto-reply, or “we aim to”, which describes nothing.

4. What happens outside business hours?

Every provider has an answer to this and most of them are honest, if you ask. Some include it, some charge, some do not offer it. What you want is clarity: what counts as an emergency, what it costs, and who answers. I am not a 24-hour helpdesk and I say so; a real emergency still gets me.

5. Will you come onsite, and what does it cost?

Remote-first is normal and sensible. But a network rebuild, an office move, or a new starter day sometimes needs someone in the room. Good answer: a clear policy, a travel radius, and whether visits are included or billed. Bad answer: vagueness, or a provider 150 miles away insisting everything can be done remotely.

6. What exactly is included, and what is extra?

Ask for the list. Support for which devices, which applications, which services. Then ask what is not included. A provider who cannot describe the edges of the service has not scoped it. The cost guide covers the usual inclusions and extras.

7. What will be in our name, and what will be in yours?

This is the one businesses skip and regret. Your domain registration, DNS, the Microsoft 365 tenant and its global admin account, backups and the encryption keys for them, the firewall login. Good answer: all of it in your name, with credentials you hold, from day one. Bad answer: “we take care of all that for you.” That sentence has cost businesses their own domain.

8. How do you document our setup, and can we see it?

You are paying for a record of your own IT. It should exist, it should be current, and you should be able to log in and read it. If the answer is “it’s in our system” and you never see it, you have no leverage the day you want to leave.

9. What is the contract term and the notice period?

Twelve months with 30 days’ notice is reasonable. Thirty-six months with automatic renewal and a fourteen-day notice window is a trap dressed as a discount. Ask about break clauses and about what happens to the price at renewal.

10. What happens when we leave?

Ask it directly, and watch the reaction. Good answer: a documented offboarding, credentials handed over, documentation exported, no charge beyond the notice period. Bad answer: anything involving fees, delay, or “we would need to discuss that”.

11. How do you handle security, specifically?

Not “we take security seriously.” Specifically: is multi-factor authentication enforced on every account, including yours? Are our backups tested by actually restoring? What email protection is in place against invoice fraud? Can you get us through Cyber Essentials? A provider who answers with product names and a plan is fine. One who answers with adjectives is not.

12. What would you not do for us?

My favourite. A good provider knows their limits and tells you: no 24-hour desk, no 500-seat rollouts, no sites in Aberdeen. It is the honest version of a sales conversation. A provider who says yes to everything is going to subcontract or under-deliver something, and you will find out which after you have signed.

How I would answer

Since I have asked you to interrogate providers, here is my side. You speak to me. I keep the client list deliberately small so that is possible. Response is typically under an hour in business hours and I put it in writing. Onsite is included across central Lancashire and quoted elsewhere. Everything is in your name from the first day, documented on a portal you can log into, and if you leave you take all of it with you on 30 days’ notice. What I do not do: 24-hour cover, large-team rollouts, or pretend to be a team. Web and app builds I do take on, for clients where they sit naturally alongside the IT.

If those answers suit you, how engagements work has the rest, and a 30-minute call is where you get to ask the other eleven.