How to choose an IT support provider.

Every provider's website says the same six things. This is a list of questions that actually distinguish them, written by one of them. Ask us the same ones.

On what you are buying

Is support charged per user or per device, and what counts as either?

Usually both, and the split is the thing to get straight. Support charged per device means shared desks, shift patterns and part-time staff are not billed as full seats. Protection charged per person follows the person rather than the hardware. Network equipment and the site itself are their own lines again. Any of those models is fine; not being able to get a straight answer about which you are on is not. Ours is written down.

What exactly is included in the monthly fee, and what is extra?

Get this in writing. On-site visits, endpoint protection, backup, out-of-hours and third-party liaison are the five that most often turn out to be extra.

Is there a fair-use clause on unlimited support?

Ask what triggers it and what happens then. "Unlimited" with an undefined cap is not unlimited.

How are price increases handled?

Ask for the review mechanism: timing, basis, cap and notice period. A provider who has written this down is telling you something about how the next few years will go.

Do you make a margin on hardware and licensing, and will you say so?

We do, and ours is in the quote: you pay what is on it. Most providers take a margin somewhere — it is how the model works rather than something to catch anyone out over — so what you are really testing is whether they will say so and whether the quoted figure holds. Microsoft licensing is worth asking about specifically, because it has a published list price you can check an answer against.

On what happens when something breaks

What are your response and resolution targets, by priority, in writing?

"We aim to respond quickly" is not a target. A target has a number and a definition of what counts as a response.

Do those hours mean working hours, and what happens outside them?

Ask specifically whether the clock pauses overnight, and what a critical fault at 4:30pm actually means in practice.

What happens when I call and nobody picks up?

The most revealing question on this list. Voicemail, an unanswered ring, a queue, or a service that raises the ticket anyway — the answers are very different, and most providers have not thought about it.

Does paying more buy a faster response?

If yes, ask what the standard customers are getting. If no, that should be stated plainly rather than implied either way.

What stops the clock on a ticket?

Exclusions are reasonable. Undisclosed exclusions are not.

On whether they are credible

What certifications do you hold, and what are the certificate numbers?

A badge on a website is a claim. A number you can check on a registry is evidence. Ask for the number, then check it.

Do those certifications cover your systems or ours?

They cover theirs. Any answer that blurs this is worth noting, because it will be the same answer your customer gets when they ask about your supply chain.

Can you evidence patch compliance and restore testing?

Not whether they do it. Whether they can produce the evidence when your insurer asks.

On leaving, before you join

What is the notice period, and does the contract auto-renew?

Ask for both, and ask when the renewal date falls.

What do we get back, in what format, and what does it cost?

Documentation, credentials, tenant ownership, backup exports and domains. If any of those carries a charge, find out now rather than in three years.

Who will own our domains and Microsoft tenant?

It should be you. A provider holding your domain registration in their own name is the single most effective piece of lock-in there is.

Is any of this published, or am I the first person to ask?

You will learn something from how readily the answers arrive.

A note on our own answers

We have published ours, which is the reason this page exists. Our service levels, charging structure, certificate numbers and exit process are all on this site. Hold any provider to the same standard, us included.

Questions people ask

How much should IT support cost?

There is no useful single figure, because it depends on how many machines you run, whether you have servers, and what compliance obligations you carry. Be suspicious of any provider who quotes a per-user price before asking what you have.

Should we choose the cheapest quote?

Compare what is included before comparing the number. A cheaper monthly fee that excludes on-site visits, endpoint protection and backup is usually not cheaper once you have added them back.

How do we check a provider is any good?

Ask for their certifications with certificate numbers and verify them. Ask for their response targets in writing. Ask to be put in touch with one of their customers — a provider worth having will ask someone whose situation looks like yours and come back to you. And ask how you would leave. Those four answers separate providers faster than any amount of conversation.

Does it matter if they are local?

Less than it used to for day-to-day support, which is mostly remote. It matters when you need someone in the building, so ask what their realistic attendance time is to your address rather than whether they cover your area.

Before you get in touch

• How we charge What is charged per user, per device and per site, and what moves the number.
• Service levels Response and resolution targets, and the hours they run within.
• Certifications ISO 27001, ISO 9001 and Cyber Essentials, with the numbers to check them.