How to Evaluate Your Current IT Provider: 15 Questions To Ask Today
Updated: Sep 21
Most businesses don't switch IT providers because something dramatic went wrong. They switch because a hundred small answers, added up over time, stopped feeling good enough. This is a real evaluation tool — 15 questions across five categories, with what a solid answer sounds like next to what a red flag sounds like.
How to use this: Actually ask your provider these questions — in a call or email, not hypothetically. Check the box next to any question where the answer felt vague, defensive, or just "trust us." Then use the scoring guide at the end.
1
Responsiveness & Support
If they can't answer these clearly, you'll find out during an outage — the worst possible time.
1. What's your guaranteed response time — and is it in writing?
Good Answer: Specific, written SLA with separate response and resolution targets by priority level (e.g., 15-min response / 4-hr resolution for critical issues).
Red Flag: "We're usually pretty fast" or a verbal promise with nothing in the contract.
2. What happens if you miss that SLA?
Good Answer: A defined credit or penalty clause tied to missed targets — something with real accountability.
Red Flag: No consequence at all, or "that hasn't really come up."
3. Can I see our actual ticket history and response-time data?
Good Answer: Immediate access to a dashboard or report showing real ticket and response history.
Red Flag: Hesitation, delay, or "we don't really track it that way."
2
Security & Compliance
This is where "we handle security" needs to become specific.
4. Do you hold a recognized security certification, like SOC 2 or ISO 27001?
Good Answer: Yes, with documentation available — or a clear explanation of equivalent internal standards for a smaller provider.
Red Flag: Confusion about what the question means, or no certification and no explanation.
5. When did you last run a phishing simulation or security awareness test with our team?
Good Answer: A specific recent date and a routine cadence going forward.
Red Flag: "We haven't gotten to that yet" or no plan to start.
6. Is multi-factor authentication required across our accounts, or optional?
Good Answer: Enforced by policy on all accounts with access to sensitive systems — not left to individual choice.
Red Flag: "It's available if people want to turn it on."
This is worth treating as a real interview, not a formality — take notes on the actual answers.
3
Backup & Disaster Recovery
"We have backups" is not an answer. This is the category where vague answers cost the most.
7. How often are our backups actually tested, not just scheduled?
Good Answer: A specific, regular testing cadence with documented results — daily monitoring, periodic restore tests.
Red Flag: "They're set up to run automatically" with no mention of verification.
8. What's our documented recovery time objective (RTO) and recovery point objective (RPO)?
Good Answer: Specific numbers, agreed on with you, documented in writing.
Red Flag: Unfamiliarity with the terms, or "we'll get you back up as fast as we can."
9. Is at least one backup copy immutable and stored offsite?
Good Answer: Yes — a copy that can't be altered or deleted, physically or logically separate from the primary network.
Red Flag: All backups live on the same network as the systems they're protecting.
4
Cost & Contracts
Vague pricing and vague contracts tend to travel together.
10. Can I see a sample invoice with every fee itemized?
Good Answer: A one-page breakdown of every fee that's ever hit a client's bill, offered readily.
Red Flag: Reluctance to share pricing detail, even redacted.
11. What does it take to exit this contract, and do we get our documentation back?
Good Answer: A clear, written exit process with full documentation and credential handoff guaranteed.
Red Flag: Vague terms, long lock-in periods, or no clear answer about data ownership on exit.
12. Are there hidden charges for after-hours support or emergency work?
Good Answer: Clearly stated up front, included or itemized — no surprises on the invoice.
Red Flag: "It depends" with no further explanation.
5
Strategy & Proactive Planning
This is the difference between a vendor and a partner.
13. When was the last time you proactively recommended a change before something broke?
Good Answer: A specific, recent example of a preventive recommendation.
Red Flag: Can't think of one, or every interaction has been reactive.
14. Do you have a documented technology roadmap for our business, or just a ticket queue?
Good Answer: A written plan reviewed on a regular schedule, tied to your business goals.
Red Flag: No document exists, or planning only happens when you ask for it.
15. Can you provide references from businesses in our industry or of our size?
Good Answer: Willing and able to connect you with a comparable client.
Red Flag: Reluctance, or references that don't match your industry or size at all.
Fifteen questions, five categories — tally the red flags before deciding anything.
How Many Boxes Did You Check?
0–3
You're likely in good hands. No provider is flawless, but this range suggests a genuinely solid relationship.
4–7
Worth a second opinion. Enough gaps here that a candid conversation — or a comparison quote — is a reasonable next step.
8+
It's probably time to start looking. This many red flags usually means the relationship has been reactive and unaccountable for a while.
Not sure how your answers stack up? IT Outlet offers a free, no-pressure assessment where we'll help you interpret the results and show you exactly where your current setup stands. Explore Managed IT Services →
Get the Full CEO Playbook for Evaluating Your IT Provider
Want the complete version of this evaluation with additional scoring detail and negotiation guidance? Reach out and we'll walk you through it.
Comments