IT provider check

"Nothing's broken" isn't a status report.

Apples to apples? Ask your IT provider these 35 questions.

When IT is working, it's invisible. That makes it easy to pay for work that isn't happening and hard to tell the difference. Usually nobody is lying. The work just isn't being done, and nobody asked.

Answer each question Yes, No, Not sure or N/A. Not sure counts against your provider at half the weight of a No, because not knowing means you're relying on an assumption. Under each question is a quick way to check.

Start the check

Your answers stay in your browser. Nothing is sent to us.

The questions

Can you see the work?

  1. 1 Can you log into a portal and see your own tickets?

    Check: Ask for your login. If the only way to see a ticket is to email someone, there is no portal.

  2. 2 Can the owner or office manager see every device's patch and backup status, live?

    Check: Ask them to show you, on screen, which computers missed last month's updates.

  3. 3 Does your provider meet with you at least once a year to understand where your business is going?

    Check: When was the last meeting, and did anything change because of it?

Patching and maintenance

  1. 4 Is there a defined maintenance window?

    Check: Ask when it is. If nobody can tell you, updates happen whenever, or not at all.

  2. 5 When an urgent patch can't wait for the maintenance window, do they tell you?

    Check: Think of the last big security story in the news. Did you hear from your provider?

  3. 6 Are browsers, PDF readers and meeting apps patched too, not just Windows?

    Check: Ask for a patch report. It should list applications, not just Windows updates.

  4. 7 Are critical security patches deployed within 24 hours?

    Check: Ask how long the last emergency patch took to reach every computer.

  5. 8 Is your firewall and network equipment kept on current firmware?

    Check: Ask when the firewall was last updated. "When it was installed" is a No.

Security

  1. 9 Does every computer and server have threat detection and response, not just antivirus?

    Check: Ask what happens when it spots ransomware. "It sends an alert" and "it cuts the machine off the network" are very different answers.

  2. 10 Is multi-factor sign-in required on every account, with no exceptions?

    Check: Ask for the list of accounts without it. The right answer is an empty list, not "just a few."

  3. 11 Are sign-ins blocked from unexpected countries and unknown devices?

    Check: Ask what happens if someone in another country signs in with a stolen password.

  4. 12 Is your email domain protected so nobody can send email pretending to be you?

    Check: Ask whether your domain's email protection is set to enforce or only to monitor. Only "enforce" stops spoofing.

  5. 13 Does your team get security training and practice phishing emails?

    Check: When did your staff last get a fake phishing email, and who clicked it?

  6. 14 Are your laptops encrypted?

    Check: Ask what happens if a laptop is stolen from a car tonight. "Nothing, it's encrypted" is the answer you want.

  7. 15 Do staff work without administrator rights on their computers?

    Check: Try installing a program on your work computer. If it just installs, you have admin rights.

  8. 16 Has your network been penetration tested?

    Check: Ask for the report and its date.

  9. 17 Is a person watching security alerts around the clock, or only software?

    Check: Ask who gets the alert at 2 a.m. on a Sunday, and what they do about it.

Backups

  1. 18 Is every backup checked for integrity, with results you can see without asking?

    Check: Ask for the last result. If you have to wait for someone to find it, you can't see it.

  2. 19 Is there a backup copy that ransomware can't reach?

    Check: Ask: "If ransomware hit our server and our backup server tonight, what would be left?"

  3. 20 Is your Microsoft 365 email and file storage backed up separately?

    Microsoft's own Services Agreement recommends that you regularly back up your content.

    Check: Ask how far back they could restore a deleted mailbox or a SharePoint folder.

When something goes wrong

  1. 21 Does your provider help with your cyber insurance questionnaire, and could you prove the answers?

    An insurer can question a claim when the application didn't match reality.

    Check: Pick three "yes" answers from your last application and ask to see the evidence.

  2. 22 Do they help with compliance documentation such as HIPAA or CMMC?

    Check: Ask what they would hand an auditor tomorrow.

People and process

  1. 23 When someone leaves, is their access removed the moment you tell your provider?

    Check: Ask how long the last offboarding took and which systems it covered.

  2. 24 Is new-hire setup a written checklist, done the same way every time?

    Check: Ask to see it.

  3. 25 Do they review your licenses so you're not paying for seats nobody uses?

    Check: Compare your license count with your headcount.

  4. 26 Do they deal with your other vendors for you?

    Check: When the internet last went down, who called the provider?

  5. 27 Is the person who answers a Washington-based technician, not an offshore call centre or a subcontractor?

    Check: Ask where the support team works and whether any of it is subcontracted.

  6. 28 Do you usually reach a technician who already knows your setup?

    Check: Do you re-explain your office every time you call?

  7. 29 Is on-site help included in their service area?

    Check: Look for trip charges on past invoices.

Pricing

  1. 30 Is your price flat, with no per-ticket fees?

    Check: Do your last three invoices match?

  2. 31 Are after-hours emergencies included, with no surcharge?

    Check: Search your agreement for "after hours."

  3. 32 When vendors raise prices, are increases passed through at cost?

    Check: When Microsoft last raised prices, did your bill rise by more than Microsoft's increase?

  4. 33 Is their pricing published?

    Check: Can you find it on their website?

The exit test

  1. 34 If you left tomorrow, would you get every admin password and your documentation, without a fight?

    Check: Ask, in writing, and read what your agreement says about leaving.

  2. 35 Is your Microsoft 365 account and your domain registered in your company's name?

    Check: A public domain lookup shows who owns your domain. It should be you. The service logins your provider uses, such as DNS and security tools, should be accounts in your company, not one shared login on theirs.

What you're paying for

Our price covers the people and the tools. When a quote comes in much lower, something has usually been left out, and from the outside you can't see what.

  • Every device watched, around the clock

    Problems get caught before you notice them.

  • Updates applied on schedule, and proven

    You can see what was patched and what wasn't.

  • Threats stopped, not just reported

    A compromised computer is cut off before it spreads.

  • Email you can trust

    Phishing is filtered out, and nobody can send email as you.

  • Every sign-in protected

    A stolen password alone isn't enough to get in.

  • Data you can actually get back

    Backups are tested, kept out of ransomware's reach, and include Microsoft 365.

  • A lost laptop isn't a breach

    Devices are encrypted.

  • A team that spots the scam

    Training and practice phishing emails, on a schedule.

  • Weak spots found first

    Penetration testing finds them before an attacker does.

  • People who know you

    Washington-based technicians, after-hours and on-site help included, and someone who deals with your other vendors.

Comparing this with hiring your own IT person? See what each option really costs.

Every one of these is a yes at ROI Technology.

And with your client portal, you don't have to take our word for it.

Book a call