Small business IT support: what to ask before you choose a provider
What to ask before choosing an IT support company: response times, security, contracts, pricing models and who owns your accounts.
Choosing an IT support company is one of the more important decisions a small business makes. Your provider will hold the keys to your email, your files, your devices and your security. A good one quietly keeps everything working and protected. A poor one leaves you waiting on hold, paying for repeat fixes and exposed to risks you do not know about.
This guide gives you the questions to ask, what good answers sound like and the warning signs to watch for.
Key takeaways
- Decide what you actually need first: day-to-day help, proactive management, security, or all three.
- Ask for response and fix times in writing, not just "we respond quickly".
- Make sure security is built in as standard: multi-factor authentication, endpoint protection and tested backups.
- Understand the pricing model, and what is and is not included.
- Insist that you own your accounts and administrator credentials, and that you can leave cleanly.
- Ask for references from businesses of a similar size.
What kind of IT support do you need?
There are three broad models.
- Break-fix. You call when something breaks and pay for the time. It can look cheaper, but problems tend to happen at the worst moment, and nobody is watching for trouble in between.
- Managed IT support. You pay a regular fee per user or per device and the provider looks after your systems proactively, with a helpdesk, monitoring, updates and security. Costs are predictable and problems are often fixed before you notice.
- Co-managed. If you have an in-house person, a provider supports them with tools, out-of-hours cover and specialist skills.
For most businesses with more than a handful of staff, managed support is the best fit. See our managed IT support service.
Questions to ask about service levels
- How quickly will you respond, and how quickly will you fix? Response and resolution are different things. Ask for targets by priority, for example a server down versus a password reset.
- How do I contact you, and who answers? Phone, email and a ticket portal should all work, and you should know who will be looking after you.
- What are your support hours, and what happens out of hours? If your business works early, late or at weekends, check cover.
- Do you offer on-site support? Many fixes can be done remotely, but you may need someone in person for hardware, networks and moves.
- How do you report to me? Look for a regular summary of tickets, device health and security.
Questions to ask about security
Security is where small businesses most often get caught out. Ask:
- Is multi-factor authentication set up on email and admin accounts?
- What protects our devices? Look for managed antivirus with detection and response, not just a free tool.
- How are updates and patches handled, and how quickly? Critical updates should be applied within days, not months. Schemes such as Cyber Essentials expect critical updates within 14 days.
- What backups do you run, and when did you last test a restore? A backup you have never restored is a hope, not a plan.
- Do you help with Cyber Essentials? Many customers and insurers now ask for it. See our Cyber Essentials service.
- What is your plan if we are hit by ransomware? See our guide on what to do in the first 24 hours.
Questions to ask about pricing and contracts
- How is the price calculated? Per user, per device, a flat monthly fee or hourly. Ask what a typical month would cost for your setup.
- What is included, and what costs extra? Check projects, hardware, software licences, out-of-hours work and on-site visits.
- How long is the contract, and what is the notice period? Be wary of long lock-ins with no performance commitments.
- What happens if the service is poor? Look for clear service commitments and a way out.
- Are there set-up or onboarding costs? A proper onboarding includes an audit and documentation.
Questions to ask about ownership and leaving
This is the one most people forget.
- Who owns our accounts and licences? You should be the owner of your Microsoft 365 tenant, domain names and admin accounts, not the provider.
- Do we have copies of the administrator passwords and documentation? You should be able to get them without a fight.
- What happens when we leave? A good provider hands over cleanly. A poor one makes leaving difficult.
What about people and culture?
- Will you assign me a named person who knows my business?
- Do you speak in plain English? Good providers explain things without jargon.
- Do you plan ahead with me? Look for a regular review of devices nearing end of life, licences, risks and budget, not just reactive support.
- Can I speak to a customer like me? Ask for references from businesses of a similar size and sector.
Red flags
- Vague promises about speed with nothing in writing
- No mention of security, backups or multi-factor authentication
- The provider keeps the admin passwords or owns your accounts
- A long contract with no way out and no service commitments
- Pushing expensive packages before they have looked at your setup
- No clear process for starters and leavers
A simple way to compare providers
Ask each provider the same questions and score the answers.
| Question | Provider A | Provider B | Provider C |
|---|---|---|---|
| Response and fix times in writing | |||
| Security included as standard | |||
| Backups tested and reported | |||
| Pricing clear and predictable | |||
| You own your accounts | |||
| Clean exit terms | |||
| Relevant references |
How PurpleBox can help
PurpleBox is a London managed IT support company for small and medium businesses. You get one accountable team, security as standard, clear pricing, and you own your accounts. Ask us any of the questions above.
Managed IT support · What are IT and digital services? · Request a callback
Frequently asked questions
What does IT support for a small business usually cover?
Typically a helpdesk for staff, device and software support, updates, security, backups, email and Microsoft 365 management, and help with starters and leavers. Managed services add proactive monitoring.
How much should small business IT support cost?
It depends on the number of users and devices and the level of service. Providers usually charge per user or per device per month. Ask for a written quote for your setup and compare what is included.
Is it better to hire an in-house IT person or use a provider?
For most small businesses a provider is more cost-effective, because you get a team with several skills, cover for holidays and sickness and security tools you could not justify alone. Some businesses use both.
What is a service level agreement (SLA)?
It is a written commitment on how quickly the provider will respond and resolve issues, often set by priority. It is what holds the provider to its promises.
Should I own my Microsoft 365 account and domain names?
Yes. You should be the owner of your Microsoft 365 tenant, domains and administrator accounts, with your provider acting on your behalf. That makes it easy to change provider if you need to.
How long does it take to switch IT provider?
A well-planned handover often takes a few weeks, including an audit, access transfer and documentation. A good new provider will manage the move so staff notice little change.