About security
1. What’s your security baseline, and is it the same for every client? You want a specific list, not a philosophy. Identity, endpoints, email, patching, backup with tested recovery, and a defined response path is the shape of a real answer. Watch for a provider whose baseline varies by what each client agreed to buy, because that means there isn’t one.
2. When did you last restore from a backup, for a client, as a test? The most useful question on this list. Backups are close to universal. Tested restores are not. “We monitor backup success” is a different answer from “we restore quarterly and write down the result.”
3. What happens in the first hour of an incident? Who gets called, in what order, and who makes the decision to take something offline. If the answer is improvised in the meeting, it’ll be improvised on the day.
4. What do you do about accounts belonging to people who’ve left? Dormant accounts are the most common serious finding in an assessment and among the easiest things to fix. A provider who owns offboarding as a process will say so immediately.
About how they actually work
5. Who answers when I call, and will they know my environment? Some providers route everything through whoever’s free. Others keep a consistent team. Neither is automatically wrong, but you should know which you’re buying.
6. What happens when a problem is beyond the person who picks up? Ask where it goes, not whether it escalates. Everyone says they escalate. The real question is whether there’s anyone with more depth to escalate to, and how long that takes.
7. What’s your onboarding process, and how long does it take? Good onboarding starts with documenting what you have, because almost no business arrives with current documentation. A provider who wants to start changing things in week one hasn’t understood the environment yet.
8. Do I get the documentation, in a form I could hand to somebody else? The answer should be an uncomplicated yes. Documentation that only lives in a provider’s system is a lock-in mechanism, whether or not it’s meant as one.
About money and planning
9. How does pricing change as we grow or shrink? Per-user and per-device pricing behaves differently during a hiring push or a quiet year. Ask what a 20% change in headcount does to the invoice.
10. What’s the three-year hardware plan, and who builds it? The difference between an IT budget and an IT surprise. A provider who plans replacement cycles turns hardware into a predictable line. One who doesn’t will bring you an emergency quote in the worst week of your year.
11. What happens if we leave? Ask it directly, early, and watch the reaction. You want a clear answer about your data, your documentation, your licenses, and your accounts, without a pause. Every provider says the relationship is a partnership. This question tests it.
Two more worth asking, depending on your situation
If you have internal IT: what does your team do that mine won’t, and who decides? A provider who can’t describe the split is going to run into your IT person rather than alongside them.
If you have compliance obligations: will you answer our insurance questionnaire and client security addenda with us? Some providers treat this as outside scope. That’s a defensible position, but you need to know it before signing rather than three weeks before a renewal.
How to read the answers
Two patterns are worth noticing more than any individual answer.
Specific beats confident. A provider who says “we run quarterly restore tests and the last one for a client your size took four hours” is telling you something. One who says “backups are absolutely handled” is telling you nothing, warmly.
Willing to say no is a good sign. Any provider who can do everything, for everyone, in every industry, at every size, is describing a sales position rather than a business. The ones worth working with will tell you where they’re not the right fit.
Where we come in
We’d rather you asked us these than didn’t. If any answer we give lands badly, that’s useful for both of us, and finding out now is much cheaper than finding out in year two.
