How to choose a managed IT provider: 12 questions to ask before you sign
Most managed IT proposals look alike until something goes wrong. These twelve questions bring out the differences while you can still walk away.
Handing over your IT means handing over the keys: administrator access to your email, your files and every device in the business. Price matters, but the larger risks sit in what a proposal leaves out.
Send these questions to each provider you are considering and ask for the answers in writing. A provider that is comfortable with its own service will answer them plainly. One that isn't will tell you that too, just less directly.
Scope and price
-
What exactly is in the monthly fee, and what isn't?
A good answer is two lists: what the fee covers, and what is billed separately, such as hardware, software licences, project work and after-hours calls.
Be wary of “fully managed” with no list attached.
-
How do you count what we pay for?
A good answer defines the unit in writing. If it is per user, does a shared mailbox count? A meeting room account? How often is the count checked against reality?
Be wary of a count that only ever goes up.
-
What does onboarding cost, and what if our systems need fixing first?
A good answer is a fixed onboarding fee, with any clean-up work quoted separately and in writing before it starts.
Be wary of “we'll sort that out as we go”.
Response and support
-
What are your response targets, and are they in the contract?
A good answer gives a target for each severity level, written into the agreement, and says plainly whether it means the time until work starts or the time until the problem is fixed.
Be wary of “we're usually very quick”.
-
Who decides how urgent a ticket is?
A good answer is an objective test agreed in advance: who is affected, whether there is a workaround, and which part of the business has stopped.
Be wary of urgency that depends on how loudly someone asks.
-
What hours are covered, and what does after-hours cost?
A good answer states the covered windows with a time zone, what qualifies for after-hours attention, and the rates.
Be wary of “24/7 support” that turns out to be an answering service.
Security and access
-
Who will have access to our systems, and how is that controlled?
A good answer covers named individual accounts, multi-factor authentication, access limited to what each role needs, logging, and what happens to that access when one of their staff leaves.
Be wary of shared admin passwords.
-
Where are your support staff based?
A good answer is a straight one. Many providers use remote or offshore technicians. That is not a problem in itself. Evasion is.
Be wary of “our team is local” when the after-hours desk clearly isn't.
-
Can we see the access logs for our own environment?
A good answer is yes, on request, with someone to walk you through them.
Be wary of controls you are asked to take on trust.
Your data
-
Which tools will hold our data, and where is it stored?
A good answer is a table: each platform the provider uses, what it holds, and the country or region it is stored in, given to you before you sign.
Be wary of “it's all in the cloud”.
-
Is our Microsoft 365 data backed up separately, and when was a restore last tested?
A good answer names a backup that is separate from Microsoft's own retention, says how far back it goes, and can point to a recent test restore. Our guide on what Microsoft does and doesn't keep explains why this matters.
Be wary of “Microsoft backs that up”.
Contract and exit
-
How do we leave?
A good answer covers the length of the initial term, what happens after it, how much notice you get before a renewal, whether there are exit fees, and what you are handed on the way out: documentation, credentials and licences in your own name.
Be wary of multi-year terms that renew themselves.
Three warning signs
- Nothing in writing. If response targets, prices or exit terms only exist in conversation, they don't exist.
- Vagueness about people and access. You are entitled to know who can reach your systems and from where.
- A hard exit. Long lock-ins, silent renewals and exit fees tell you how the provider expects to keep you.
How Lumetra answers
It would be odd to publish these questions and not answer them. Every answer below is on this website in more detail.
| Question | Our answer |
|---|---|
| 1. What's included | Every plan and every extra rate is on the pricing page. Hardware, licences and project work are billed separately and quoted in advance. |
| 2. How we count | Per user: a person with a company login. Shared mailboxes, meeting room accounts and service accounts don't count. Reconciled with you monthly. |
| 3. Onboarding | One month's plan fee. Any remediation is quoted separately and in writing before anything starts. |
| 4. Response targets | 30 minutes, 1 hour, 4 hours and 1 day, by severity, written into the agreement. Response means acknowledged and work begun, not fixed. |
| 5. Severity | Set by three questions: who is affected, is there a workaround, and which business process is stopped. |
| 6. Hours | 8am to 5pm weekdays, Australian Eastern Time. After-hours windows and rates are published. |
| 7. Access | Named accounts with multi-factor authentication, least privilege and session logging, with a documented offboarding process. |
| 8. Where our staff are | Our service desk engineers are remotely based and work Australian business hours inside an Australian-hosted workspace. Our security posture sets out how. |
| 9. Access logs | Yes, on request, and we'll walk you through them. |
| 10. Data locations | A per-vendor data-locations table, given to you before you sign. |
| 11. Backup | Third-party backup of Microsoft 365 data with unlimited retention on Professional and above, with tested restores. |
| 12. Leaving | An initial term, then month to month. Written notice before any renewal and no exit fees. |
Further reading
- Australian Signals Directorate, How to manage your security when engaging a managed service provider.
This guide is general information for Australian businesses, correct to the best of our knowledge when it was last reviewed. It is not legal, financial or security advice for your specific situation.