When a business cannot take payments, open shared files or reach email, the useful question is who owns the response. Buying managed IT support means agreeing on that responsibility before the next interruption. A list of software products is not enough to explain what happens when an employee needs help or a business-critical system stops working.
A local discussion of the July 2024 technology outage described disruption across central Indiana. It illustrates why continuity questions matter, without proving that any particular service provider could have prevented that event. Use your own operating needs to compare proposals, and avoid treating a sales promise of “complete protection” as a measurable service.
List the work your business cannot pause
Identify the activities that depend on technology: scheduling, payments, production files, customer communications or shipping. Give the prospective provider examples of an interruption and its operational effect. A small retail office and a manufacturer can have similar employee counts but very different support requirements. Ask the provider to explain its proposed priorities using your examples.
Define users, devices and locations
Count employees, shared devices, remote workers and business locations. Include systems that are easy to overlook, such as a front-desk tablet or shared printer. Ask which assets are covered and how additions are charged. Inventory is a starting point for a meaningful quote, rather than paperwork to discover after a monthly fee has already been agreed.
Separate help-desk support from projects
Ask what everyday assistance includes and what becomes a separate project. New-office setup, major migrations and replacing unsupported equipment may have different scopes. Request examples of a covered request and an excluded request. That distinction helps compare a lower subscription with a broader package without assuming that either proposal is intentionally misleading.
Read response commitments carefully
A promise to acknowledge a ticket is different from a promise to restore a system. Ask how priority is assigned, who can escalate a critical issue and what happens outside normal hours. Check whether an on-site visit is included. Indianapolis proximity can be useful, but a local mailing address does not establish immediate technician availability.
Keep business ownership of essential accounts
Identify who owns the domain, cloud subscriptions and administrator records. Ask how authorized business representatives retain access without sharing passwords insecurely. Agree on a documented approval process for sensitive changes. The objective is clear ownership and controlled access, not giving every employee unrestricted privileges or handing an outside provider unrecorded control of all accounts.
Discuss security responsibilities explicitly
CISA encourages managed-service customers and providers to discuss their respective security responsibilities. Ask which party handles account protection, software updates, monitoring and incident notification. Request a plain-language responsibility list. No provider can eliminate every risk, and a security tool appearing on an invoice does not explain who reviews its alerts or acts on them.
Ask for evidence of recovery testing
A backup subscription and a demonstrated recovery are different deliverables. Ask what data is covered, what is excluded and how restoration is tested. Establish who approves a test and where the results are recorded. Discuss an appropriate recovery objective for your workflow rather than assuming that every system can be restored instantly after any failure.
Agree on onboarding before replacing support
Ask how the provider discovers existing equipment, confirms access and coordinates with the outgoing team. Identify any unsupported systems before the transition date. Keep a named business contact available to approve decisions. An organized onboarding plan should reduce uncertainty without requiring employees to disclose passwords through ordinary email or surrender business records without an inventory.
Clarify subcontractors and sensitive information
Find out whether another company or remote team can access your systems. Ask how access is authorized, recorded and removed. Explain any customer confidentiality requirements so the provider can assess whether it can meet them. If specialized regulatory obligations apply, obtain appropriate professional advice rather than assuming a generic managed-services package establishes compliance automatically.
Compare reporting with operational needs
Request an example report with customer information removed. Look for useful records of unresolved issues, recurring interruptions and agreed improvement work. A large chart of technical activity may not explain whether employees received effective help. Agree on a review schedule that allows the business to challenge priorities and verify that important follow-up actions have an owner.
Price changes and exit terms in advance
Ask about minimum commitments, annual changes, additional users, after-hours charges and separately billed projects. Read the exit process and assistance available when changing providers. Make sure you understand how business data and account records are returned. Clarifying departure while relations are good is practical continuity planning, not a prediction that the partnership will fail.
Run the same scenario through each proposal
Describe one realistic outage to every candidate: for example, staff cannot access scheduling at opening time. Ask who receives the call, what happens next and what could generate an extra charge. Compare the answers alongside documented scope and references. A provider that explains limitations clearly may be easier to evaluate than one offering broad, undefined assurances.
Frequently asked questions
1. Is managed IT the same as cybersecurity?
No. Managed IT can include security work, but its exact scope varies. Ask which protections, monitoring and incident services are included and which require another specialist. A support agreement should explain responsibilities rather than rely on a security label.
2. Does a local office guarantee on-site support?
No. Confirm the actual service area, technician availability and on-site response terms. A business may operate locally while providing most support remotely. Ask how travel and attendance are charged, especially if you operate outside the provider’s usual coverage.
3. What does a response-time promise mean?
Ask whether it measures acknowledgment, initial work or service restoration. Also check the priority definition and business-hour limits. A short acknowledgment commitment is useful information, but it is not the same as a guarantee that the problem will be resolved immediately.
4. Should we give the provider every password?
Use an agreed secure access process and retain appropriate business ownership of accounts. Ask how credentials are protected and access is controlled. Do not send a spreadsheet of passwords through ordinary email merely because onboarding has begun.
5. Are backups enough to guarantee recovery?
No guarantee follows from a subscription alone. Confirm what is backed up and request documented restoration tests. Recovery also depends on the affected systems and circumstances. Ask what the business must supply or authorize when a recovery is needed.
6. Can the cheapest monthly quote be compared directly?
Only when the covered users, devices, hours and responsibilities match. Compare exclusions, project charges and onboarding costs as well. Two quotes with identical headline prices can produce different invoices when a migration or after-hours incident occurs.
7. How should we assess references?
Ask about relevant business size, systems and support situations, while respecting confidentiality. Useful reference questions concern communication and follow-through. A favorable recommendation does not replace reviewing your own proposed scope or establish that the provider supports every specialized application.
8. What happens when an employee leaves?
Agree on an authorized process for removing access and preserving required business information. Specify who notifies the provider and who approves changes. The process should be documented before it is needed, especially where former employees used shared devices or remote access.
9. Can an MSP guarantee no outages?
Be cautious about absolute promises. Ask instead about prevention, monitoring, response and tested recovery within a defined scope. External services, hardware and human actions can still introduce interruptions. A realistic explanation of limitations supports a more useful agreement.
10. What should we receive at termination?
Confirm account ownership, documentation, business data and transition assistance before signing. Ask about format, timing and charges. Maintaining a current asset and account inventory can make a future handover more understandable without compromising appropriate access controls during the agreement.
Sources and related reading
- Indianapolis discussion of the July 2024 technology outage.
- CISA: MSP and customer security responsibilities.
- NCSC: choosing a managed service provider.
Browse category provider contacts and confirm the relevant capability directly. Directory inclusion does not establish specialist qualifications.
