Choosing outsourced IT support is one of those decisions that's easy to get wrong and slow to unpick. Every provider says the same things. Responsive. Proactive. Friendly. Secure. The words are free.
What separates a reliable IT support provider from a disappointing one is whether they can show you the evidence behind those words. So before you sign anything, here are nine things worth checking, what a good answer sounds like, and the warning signs that tell you to keep looking.
The nine checks, in short:
How they measure response times, and what happens when they miss one
Who you'll actually be speaking to
What they do when nothing is broken
Whether they hold the security certifications they recommend to you
Their plan for when something goes badly wrong
Whether they'll work alongside your existing IT person
What's in the price, and more importantly what isn't
How long you're tied in, and how you'd leave
Whether you can speak to a client who looks like your business
1. Ask how they measure response times, and what happens when they miss
Almost every provider quotes a response time. Far fewer will tell you how it's measured or what happens when they don't hit it.
Ask two follow-up questions. First, does the clock stop when a ticket is acknowledged, or when someone actually starts working on it? There's a big difference between an automated email in four minutes and an engineer picking up the phone in forty. Second, ask what they'll report back to you. A provider who's confident in their service will happily send you monthly figures on response and resolution times.
Warning sign: a response time in the sales deck that doesn't appear anywhere in the contract.
2. Ask who you'll actually be speaking to
For most UK SMEs, this matters more than any technical detail. If your team dreads calling IT, they'll stop calling, and small problems quietly become big ones.
Find out how many people are in the support team and whether you'll deal with the same faces. Ask whether you get a named account manager, and how often they'll actually meet you. Ask whether support is delivered by their own employees or subcontracted out. None of these have a single correct answer, but a good provider will answer them plainly rather than talking around them.
Warning sign: vagueness about team size, or a demo led by someone you'll never speak to again.
3. Ask what they do when nothing's broken
This is the clearest dividing line in business IT support. A reactive provider waits for the phone to ring. A genuine partner is doing work you never see: patching, monitoring, checking backups actually restore, spotting the laptop that's about to fail.
Ask them to describe a normal month on your account when nothing goes wrong. If the honest answer is "not much", you're buying a repair service, not IT support. You should also expect a regular conversation about where the business is heading and what technology should do about it. Not a sales meeting. A planning one.
Warning sign: an answer built entirely around fixing tickets faster.
4. Check they hold the certifications they'd recommend to you
Plenty of providers will encourage you towards Cyber Essentials. Ask whether they hold it themselves, and at what level. Cyber Essentials Plus involves an independent technical audit rather than a self-assessment, so it's a meaningfully higher bar.
This matters more than it used to. Your IT provider has administrative access to nearly everything you own, which makes them part of your risk, not just your defence. The government's Cyber Security Breaches Survey 2025/2026 found that only around 15% of businesses assess cyber risk in their supply chain. Your IT provider is the single most important supplier to check.
Warning sign: selling you security certifications they haven't bothered to achieve themselves.
5. Ask what happens when something goes badly wrong
Breaches are common enough that this is a practical question rather than a scary one. The same government survey found 43% of UK businesses identified a breach or attack in the last 12 months, rising to 65% of medium-sized businesses. Yet only a quarter have a written incident response plan.
So ask directly. Who do you call at 7pm on a Friday? Who talks to your staff, your clients and, if it comes to it, the ICO? How quickly could you be working again, and how do they know? A provider who's done this before will answer specifically, and will have tested restores from your backups rather than just monitoring that they ran. If you want to go deeper, our business continuity work starts with exactly these questions.
Warning sign: confusing "we take backups" with "we've tested that we can get you back".
6. Ask whether they'll work alongside your existing IT person
If you already have someone internal, this is the question that decides whether the relationship works. Some providers only want full control, which usually means your IT manager gets sidelined and quietly starts looking elsewhere.
The better arrangement is co-managed IT support, where your internal person keeps ownership and decides what gets handed over. Typically that's the routine work, the overnight monitoring, the holiday cover and the specialist projects nobody has time for. Your IT lead gets to do the work they were actually hired for. Ask any provider how they'd split responsibilities on day one.
Warning sign: treating your internal IT team as an obstacle rather than a colleague.
7. How much should outsourced IT support cost, and what's not included?
Most UK providers price per user per month, which makes budgeting straightforward and scales as you hire. Our own agreements typically fall between £50 and £150 per user per month, and where you sit in that range depends on what you need: how much security and compliance work is included, whether you want on-site time, and how much of the day to day you're handing over.
The number itself matters less than what sits outside it. Ask specifically about out-of-hours work, on-site visits, project work, hardware, third-party licences and onboarding new starters. Ask what a typical month of extras looks like for a business your size. A clear answer here tells you more about how a provider operates than the headline price does.
Warning sign: a low monthly figure with a long list of chargeable extras you only discover later.
8. Check the contract length and how you'd leave
Long lock-ins usually protect the provider rather than you. Ask about the initial term, the notice period, and what happens at the end.
Then ask the question most people forget: if we left, what would we take with us? You should own your documentation, your licences and your data, and be able to get all of it in a usable form. A confident provider has no problem with this, because they expect to keep you on service quality rather than paperwork.
Warning sign: a five-year term with no existing relationship, or hesitation about who owns your documentation.
9. Ask to speak to a client who looks like you
Reviews and case studies are useful, but a fifteen-minute phone call with a real client is worth more than both. Ask for one in your sector, or at least one of a similar size, and ask them the awkward question: what's gone wrong, and how did the provider handle it?
Every provider has had a bad week. What you're listening for is how they behaved during it.
Frequently asked questions
What's the difference between outsourced and co-managed IT support? Fully outsourced IT support means the provider takes on everything, which suits businesses with no internal IT. Co-managed IT support means the provider works alongside your existing IT person or team, covering agreed areas while your internal lead keeps control of decisions.
How long should an IT support contract be? Twelve months is common, and shorter rolling terms are increasingly available. Be cautious about anything longer than 24 months, especially early in a relationship.
What certifications should a UK IT support provider have? Cyber Essentials as a minimum, ideally Cyber Essentials Plus, which is independently audited. Relevant vendor accreditations matter too, particularly Microsoft partner status if you run Microsoft 365. ISO 27001 is a strong signal for regulated sectors.
Can we switch providers without disrupting the business? Yes, with planning. A good incoming provider will run a structured handover covering documentation, admin access, licences and monitoring, usually over four to six weeks. Most disruption during a switch comes from rushing it, not from the switch itself.
Get a second opinion on your IT support
If you're weighing up providers, or you've got a nagging feeling your current one has gone quiet, a conversation costs nothing.
We offer a free 30-minute discovery call. We'll look at where you are, tell you honestly what we'd change, and if your current provider is doing a good job we'll tell you that too.