How to Choose (and Keep) the Right IT Provider

Choosing an IT provider is less like buying software and more like hiring a key employee. You'll trust them with your passwords, your data and your worst days. Most bad IT relationships start with a choice made on price alone, and end years later in frustration. Here's how to choose well, and how to tell, once you've chosen, whether it's working.

Before you sign: what to ask

• What exactly is included in the monthly fee, and what's billed separately?
• Who will we actually talk to, and how fast do you respond to an urgent problem? Ask for their published response times.
• How do you handle security: endpoint detection, multi-factor sign-in, email protection, and who watches the alerts?
• When did you last test-restore a client's backup?
• Can you be on site when something physical breaks, and how quickly?
• Can we talk to two clients like us?

We'd rather earn a client by answering these questions well than by having the lowest number on the page. If you're comparing quotes, our guide to the hidden cost of cheap IT covers what thin quotes leave out.

Contract terms that protect you

• A clear term and renewal. Longer agreements often hold the rate steady, which is worth having, as long as the scope is clear.
• You own your documentation, admin accounts and passwords, and get them all if you part ways.
• A defined exit: how the handover works, and how long it takes.
• Pricing that's clear when you add or remove people.

What a good first 90 days looks like

• They document everything: every device, account, vendor and password, in a system you can access.
• They fix the urgent risks first: missing multi-factor sign-in, untested backups, former employees with access.
• They give you a written list of what they found, and a plan for the rest.
• You notice fewer interruptions, not more.

Every quarter: six questions to ask

• What were our most common problems, and what are you doing so they stop?
• Are all our computers patched, and our backups tested? Show us the results.
• What security issues did you see, and what changed because of them?
• What in our setup is aging, and what should we budget for next year?
• Is there anything we're paying for that we don't use?
• What's one thing we should do differently?

Every quarter we sit down with our clients and go through these questions. A good provider welcomes them and has the answers ready. A great one brings them to you before you ask.

The "we'll fix it later" trap

Every business has a list of small IT problems everyone has learned to live with: the slow login, the backup warning, the flaky Wi-Fi in the back. A reactive provider leaves them until they become emergencies, usually at the busiest time of year. A good one works the list down steadily, so peak season is quiet.

Signs it isn't working

• You only hear from them when you call, and you call about the same problems.
• Simple requests take days, and nobody owns follow-up.
• You can't get a straight answer about your backups or your security.
• Invoices surprise you.
• You don't have your own passwords or documentation.

If several of these sound familiar, it's not you. It's time to have a frank conversation, or to start looking.

Outsourced, in-house or both

Small businesses usually do best with a managed IT provider covering everything. Businesses with an IT person on staff often get the most from co-managed IT, where the provider adds tools, security monitoring and backup coverage around that person. Either way, the questions above still apply.