How to choose a managed IT provider: the questions that matter
How do I choose a managed IT provider?
Compare four things rather than price alone: what is genuinely in scope, what the provider can evidence about its own security posture, how it reports and escalates, and how you would leave. Most providers present similarly on capability. They differ sharply on those four, and the differences only surface when you ask directly.
Before you speak to anyone
Write down three things:
What is actually wrong now. Slow response, repeat faults, no security work, no reporting, a single point of failure. Be specific.
What has to be true in twelve months. A certification, a client audit passed, an office opened, an acquisition integrated.
What you can own internally. This determines whether you want co-managed or fully outsourced support. See the difference.
Providers respond to briefs. A vague brief produces a generic proposal.
Scope
What is in the monthly fee, and what is billed separately?
Is project work included, capped, or extra?
Are onsite visits included, and how many?
How is third-party vendor liaison handled?
What happens with legacy systems you cannot yet replace?
The gap between quotes usually lives here rather than in the per-user rate. See what UK businesses pay per user.
Security - theirs, not just yours
Your provider will hold administrative access to everything you own. Their security posture becomes yours.
Are they certified themselves, and to what standard?
Can you verify that certification independently?
What is the certified scope? A certificate covering a single office is not the same as one covering service delivery.
How do they secure their own privileged access to your systems?
What is their incident notification commitment if they are breached?
Ask for the certificate number and check it. NVOY holds ISO/IEC 27001:2022 certification for the provision of IT managed services, professional services and supply of IT equipment - certificate 21497ISMS001, issued by Alcumus ISOQAR under UKAS accreditation, verifiable on the UKAS register.
Reporting and escalation
What does the monthly report contain, and can you see a real example with a client’s details removed?
Do they track repeat incidents and root cause, or only volume?
Who is the named escalation contact, and what triggers escalation?
How often do you meet someone senior, and is that person in the pitch or only in the pitch?
That last point matters. Ask who will actually run your account and insist on meeting them before signing.
Proof
Two references from clients of similar size and sector, contacted directly.
A case study with numbers in it.
How long their average client has been with them.
Staff turnover on the service desk, which is a reliable proxy for consistency.
Our case studies include a twelve-workstream healthcare transformation delivered two weeks early, and over 600 approved devices secured in under a week during a market-wide shortage.
Transition and exit
What does onboarding look like in weeks one to eight?
What do they need from the incumbent, and who manages that relationship?
What is the notice period?
Who owns documentation and configuration if you leave?
A provider that cannot describe a clean exit has not thought about the relationship maturely.
Warning signs
A proposal that arrives before anyone has looked at your environment.
Response times quoted without priority definitions.
Reluctance to name the certification body or certificate number.
Security presented as an upsell rather than a baseline.
A long contract term with no break clause and no service credits.
A workable process
Shortlist three. Give each the same written brief. Require a discovery conversation before any proposal. Score against scope, security, reporting and exit rather than on presentation quality. Take references yourself.
It takes about four weeks and prevents the far more expensive exercise of doing it again in eighteen months.
BLOGS
