Your IT provider may hold the keys to Microsoft 365, your devices and your backups. Use this NCSC-informed checklist to compare providers on security, responsibilities and exit terms, not just the monthly fee.
For most UK SMEs, an IT support provider is more than a helpdesk. They may manage Microsoft 365, laptops, networks, cloud systems, backups and security controls, which usually means they hold powerful admin access to systems full of customer, staff and commercial information.
The NCSC now publishes guidance specifically for SMEs on choosing and working with a managed service provider (MSP). Its core message is practical: check security before you appoint a provider, then make responsibilities and expectations explicit in the contract.
Yes, we're an IT support provider, so read this with that in mind. But we'd genuinely rather you asked every provider, including us, these questions. The right provider reduces risk and downtime. The wrong arrangement leaves gaps between "included" and "assumed" that only show up when something goes wrong.
Before comparing providers, write down what your business needs to keep operating:
This lets you compare like with like, and stops a low monthly price hiding important exclusions such as backup testing, device management or out-of-hours incident support.
Ask shortlisted providers how they protect their own business as well as yours. Useful evidence includes recognised certifications, relevant policies and references from organisations like yours. The NCSC points to Cyber Essentials Plus and ISO 27001, while warning that a certificate doesn't automatically make every service configuration safe.
Ask references about more than technical skill. How did the provider communicate during a difficult incident? Were reports clear? Did response times match what was promised?
A credible provider should be open about:
A proposal or sales deck isn't enough. Your agreement should set out what the provider does, what your team does, and what happens if either side misses something.
Patching and updates. Agree who monitors operating systems, applications, firmware and cloud settings. The NCSC recommends critical and high-risk vulnerabilities are patched within 14 days unless there's a documented reason and a compensating control.
Backups and recovery. Don't settle for "we provide backup". Ask what's backed up, how often, where copies are kept, who can delete them and how often a restore is tested. We've written about why testing your backups matters more than having them.
Access and authentication. Your provider should use multi-factor authentication for every remote and admin route, apply least privilege and avoid standing access that isn't needed.
Logging and monitoring. Agree what's logged, how long logs are kept, who reviews alerts and how you get the information during an investigation.
Incident notification. Define what counts as an incident, who contacts whom, how quickly, and what you'll be told, including when the provider or one of its own suppliers is affected.
Service levels. Set out response times, escalation routes, service hours and what "resolved" means. A fast response isn't the same as a permanent fix, so record both where it matters.
If your provider processes personal data for you, the contract needs UK GDPR processor terms. ICO guidance says these should cover documented instructions, confidentiality, security measures, sub-processors, help with data rights and breaches, end-of-contract arrangements, and audits.
Don't just accept a generic data-processing addendum. Check it describes your actual systems, the information involved and any suppliers the provider uses, and how data will be returned or deleted if you part ways.
A good relationship shouldn't make you dependent on one person's memory or one provider's portal. Your contract should cover renewal, termination, handover charges, notice periods and access to documentation.
Before you sign, confirm you can get:
The NCSC also recommends agreeing who tracks end-of-life systems and what happens before support ends. That job shouldn't fall into the gap between your IT provider, a software supplier and your own team.
Appointing a provider is the start, not the end. Hold regular service reviews and ask for short, clear evidence: patch status, backup results and restore tests, open risks, security alerts, ticket trends and upcoming end-of-life dates.
Use those reviews to check the service still fits. A growing business may need stronger device management or a tested incident plan. A smaller one may need help cutting unused licences and simplifying.
At Managed IT Support we try to make all of this visible: what's covered, what's yours, and what happens next. Our pricing is published, our plans spell out what's included, and we're happy to answer every question above in writing.
If you're reviewing your current provider or comparing quotes, book a free IT review or email hello@managedtech.uk. Compare the answers, not just the monthly fee.
Book a free IT review and we'll show you exactly where your current setup is costing you money, leaving you exposed, or slowing your team down. No obligation, no hard sell.
