15 questions to ask a managed IT provider before you sign

The best managed IT provider is not simply the company with the longest tool list. You need to know who answers, who owns the fix, what is included, how security is handled, what evidence you receive and what happens when the relationship ends.

The 15 questions

1. What exactly is included in the monthly service?

Ask for a written service scope covering help desk, devices, servers, Microsoft 365, networking, security, backups, vendors and projects. “Unlimited support” can still contain important exclusions.

2. Who answers when a user needs help?

Understand whether support is handled by employees, subcontractors or an outsourced help desk, and whether users can reach a person directly.

3. What are your support hours and escalation paths?

Separate business-hours help desk coverage from after-hours emergency response, infrastructure monitoring and security monitoring.

4. How do you handle employee onboarding, role changes and termination?

A strong process should address accounts, MFA, devices, licenses, application access and the return or disablement of company assets.

5. Who administers Microsoft 365 and Entra ID?

Ask who owns user changes, Conditional Access, privileged roles, email security, sharing, audit logging and licensing.

6. How do you verify cybersecurity controls are actually covering users and devices?

A policy can exist while users, devices or accounts remain excluded. Ask how the provider measures coverage and documents exceptions.

7. What endpoint security is included?

Clarify antivirus, EDR, disk encryption, patching, device management and response responsibilities.

8. How are backups tested?

“Backup successful” is not the same as demonstrated recovery. Ask how restoration is tested, how often, and who records the result.

9. How do you manage administrator and privileged access?

Ask whether technicians use named accounts, MFA, least privilege and controlled elevation instead of shared administrator credentials.

10. Can you support cyber-insurance and customer security questionnaires?

Ask whether the provider can produce dated evidence for MFA, EDR, backups, encryption, email controls and other requested safeguards.

11. What reporting will leadership receive?

Useful reporting should show unresolved risks, coverage gaps, exceptions, major incidents and planned improvements—not only ticket counts.

12. Which vendors or subcontractors can access our systems?

Know who has access, what they can reach and who remains accountable when another provider is involved.

13. How is pricing structured?

Ask what is per-user, per-device, project-based or outside the recurring fee. Also ask what causes the price to change.

14. Who owns our documentation, configurations and accounts?

Your organization should understand what it can take with it if the relationship ends, including credentials, documentation and vendor accounts.

15. What happens if we switch providers later?

Ask about notice periods, transition support, credential handoff, documentation and offboarding of the outgoing provider’s access.

What NCB Cyber adds to the usual MSP model

NCB Cyber focuses on the connection between day-to-day IT and verifiable security controls. That means reviewing coverage, documenting exceptions, assigning remediation owners and preserving evidence—not just deploying tools.

See Managed IT Services South Florida, Cybersecurity Control Review, and our guide to cybersecurity service cost drivers in South Florida.