How to choose · Managed IT providers
How to choose a managed IT provider
Last updated 25 October 2026 · 3 sources listed · Reading time about 3 minutes
Short answer
Choose a managed IT provider by testing how they run service, not how they describe it. Look for a documented onboarding process, clear scope and exclusions, security practices applied to their own systems, named responsibilities for patching and backups, and references from clients similar to you. Contract terms on exit, data ownership and administrative access matter as much as response times.
Who this is for: An owner or operations manager at a growing organisation with no full IT team, comparing outsourced IT support providers and unsure how to tell a capable one from one that merely sounds capable.
What to evaluate
Scope clarity
Disputes usually arise over what is included. Vague wording on projects, after-hours support and third-party software invites argument.
How to check: Request a written responsibility matrix naming who handles patching, backups, user changes, hardware, licences and security incidents.
Provider's own security
An outsourced provider holds privileged access to your systems, so a weakness in their tooling becomes yours.
How to check: Ask how they protect their remote management tools, separate client credentials, and require strong authentication for their staff.
Onboarding discipline
A methodical start produces documentation and an asset inventory; a casual start leaves undocumented systems and risk.
How to check: Ask for a sample onboarding plan and what you will receive at the end of it.
Service desk quality and escalation
Day-to-day experience is shaped by how fast issues are acknowledged, how well they are diagnosed and how escalations work.
How to check: Speak to current clients about real examples and ask to see the escalation path in writing.
Reporting and transparency
You need visibility into patch status, backup success and ticket trends to govern the arrangement.
How to check: Ask to see an anonymised sample report and how often meetings review it.
Exit and ownership terms
Lock-in occurs when the provider controls administrator accounts, documentation or licences.
How to check: Confirm in the contract that you own all credentials, documentation and licences, with a defined handover process.
Comparison
| Model | Good when | Watch out for |
|---|---|---|
| Break-fix support | Few systems and occasional problems | No proactive maintenance; incidents arrive unplanned |
| Fully managed service | No in-house IT and a wish for predictable support | Dependence on the provider and scope limits on projects |
| Co-managed service | You have a small internal team needing extra depth or cover | Blurred responsibilities unless the split is written down |
| Project-based consulting | A defined upgrade or migration | Ongoing operation falls back to you afterwards |
| Virtual chief information officer add-on | Need for planning and budgeting guidance | Advice may favour the provider's own services |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Scope clarity | |||
| Provider's own security | |||
| Onboarding discipline | |||
| Service desk quality and escalation | |||
| Reporting and transparency | |||
| Exit and ownership terms | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- Who will be our named contacts and what happens when they are unavailable?
- Which systems and applications are explicitly outside the agreement?
- How do you secure the remote access tools used to reach our devices?
- Do we hold global administrator credentials, and can we revoke yours at any time?
- How are backups verified, and when did you last perform a restore for a client?
- What is the process and cost when we want to leave?
- How do you handle a security incident affecting our systems, including notification timing?
- Which subcontractors or offshore teams touch our data?
Typical trade-offs
Generalist local provider versus larger specialist provider
- Upside
- A smaller local firm often offers closer relationships and flexibility.
- Downside
- Depth and cover can be thin when one key engineer is away.
All-inclusive agreement versus itemised services
- Upside
- All-inclusive gives budget predictability and fewer billing arguments.
- Downside
- You may pay for services you rarely use, and exclusions can still catch you.
Single provider for everything versus separate security specialist
- Upside
- One relationship and consistent accountability.
- Downside
- The provider that runs your systems also grades its own security, which weakens independent assurance.
Common mistakes
- Selecting on the headline rate alone. Compare scope and exclusions, because out-of-scope work gets billed separately.
- Letting the provider hold the only administrator credentials. Keep your own protected emergency access.
- Skipping reference checks with similar-sized clients. Ask about incidents, not only everyday support.
- Accepting an agreement with no exit assistance clause, then discovering handover is difficult and slow.
- Never reviewing the service. Hold regular reviews against agreed measures and adjust or escalate when they slip.
Related questions
How do I know a provider is technically competent?
Ask them to walk through how they would handle specific scenarios: a laptop reported stolen, a suspected phishing compromise, a failed backup. Listen for concrete steps, named tools and responsibilities rather than slogans. Check for relevant certifications as a signal of process, not a guarantee. Speak to clients about incidents and how they were handled. If possible, involve a trusted independent technical person in the evaluation conversation to ask follow-up questions you might not think of.
Should the provider manage our security as well?
Providers can deliver security operations, but be explicit about it. Patching and endpoint management are routine; monitoring, incident response and policy are distinct services needing clear scope and authority. Consider whether independent assurance, such as a periodic review by a different party, is wise so the same firm is not marking its own work. Align responsibilities with any cyber insurance conditions and make sure incident roles are written down.
What should be in the contract besides price?
Scope and exclusions, service hours, response and resolution targets, reporting duties, data protection terms, security obligations on the provider, incident notification timing, ownership of credentials and documentation, subcontractor disclosure, liability limits, change process and exit assistance. Pay particular attention to auto-renewal and termination notice. Have the agreement reviewed by someone qualified in your jurisdiction, since contractual protections and data protection duties vary.
How long does onboarding with a provider usually take?
It depends on estate size and the quality of existing documentation, but expect a structured discovery period, followed by tooling deployment and a stabilisation phase. Treat a rushed start with suspicion because it often means undocumented assumptions. A good onboarding yields an asset inventory, network and account documentation, a baseline of risks and a prioritised improvement list. Agree milestones and deliverables in advance so you can judge progress.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Supply chain security guidance — National Cyber Security Centre (UK), retrieved 27 October 2026
- Cybersecurity Best Practices — Cybersecurity and Infrastructure Security Agency, retrieved 27 October 2026
- Small Business Guide — National Cyber Security Centre (UK), retrieved 27 October 2026
Related guides
Comparison · Managed IT providers
Managed IT vs in-house IT vs co-managed IT
In-house IT gives deep knowledge of your business and immediate presence but is limited by individual skills and cover. Managed IT offers breadth, process and cover at the price of dependence on a provider. Co-managed splits duties between an internal team and an external one. The right model follows from your size, specialist needs, risk and ability to hire and retain people.
Cost factors · Managed IT providers
How managed IT pricing models work and what to compare
Managed IT providers usually price per user, per device, as a tiered bundle or as a flat monthly fee, with projects and hardware often charged separately. Cost differences come from scope, service hours, security inclusions and how changes in headcount are handled. Compare by listing included services against your requirements and reviewing how out-of-scope work, onboarding and exit are charged.
Problems & fixes · Managed IT providers
When a managed IT provider is not working: diagnosing problems and exiting safely
First determine whether the problem is scope, communication, capacity or competence, using tickets and reports as evidence. Raise concerns formally against the agreement and give a chance to correct. If you leave, secure administrator credentials, documentation, licences and backups before announcing, and plan a staged handover so there is no service gap or unmonitored period.
How to choose · Security services and compliance
How to choose a penetration testing provider
Choose a provider by confirming the testers' demonstrated experience with your technology, a clearly defined scope and rules of engagement, a methodology aligned with recognised standards, and a report that gives reproducible findings with practical fixes. Be wary of vendors who sell an automated scan as a test, and agree retesting, confidentiality and data handling before work begins.
Requirements · B2B software
SaaS contract terms to review and negotiate
Beyond price, the clauses that most affect outcomes are renewal and termination mechanics, data ownership and return, service levels and remedies, liability caps, security and breach commitments, and rules on price changes. Contract law varies by jurisdiction, so treat this as a checklist for conversation with counsel, not legal advice. Negotiate before signature, because leverage drops once data is in the system.
How to choose · Business operations
How to choose a payment processor for a small business
Start with how you sell: in person, online, by phone or through invoices. Then compare pricing structure, settlement speed, reserve and hold policies, dispute handling, contract exit terms and how well the gateway connects to your accounting and ordering systems. Pricing is rarely the only difference; a cheap headline structure can hide holds, minimums and early termination clauses. This page covers how to evaluate, not which provider to pick.
How to choose · Business operations
How to choose a supplier and run due diligence
Select suppliers using weighted criteria agreed before looking at quotes: capability, quality, financial stability, security and compliance, delivery reliability, and total cost of ownership. Verify claims with references, site visits or audits and check legal standing and sanctions screening. Document the decision so it can be explained and repeated. Avoid choosing on unit price alone.