What should you actually expect from your IT provider?

Most businesses only think about their IT provider when something goes wrong. The printer stops, the email goes down or a laptop dies the morning of a big pitch, and suddenly the quality of your support matters a great deal. The rest of the time, IT support is invisible, which makes it hard to judge whether you’re getting a good service or just an acceptable one.

That matters more than it used to. Your IT provider now has access to almost everything: your email, your files, your customer data, your finances and often your phones too. Choosing well is as much a security decision as a service one. Here’s what separates a good provider from the rest, based on what we see when businesses across the North East come to us after a bad experience elsewhere.

Response times you can measure

Every provider says they’re responsive. A good one can prove it. Look for clear service levels written into the contract, covering how quickly they’ll respond and how quickly they’ll aim to fix different types of problem. A total outage should be treated very differently from a request to set up a new starter.

Just as important is how you contact them and track progress. A proper ticketing system gives every request a reference number, so nothing gets lost in someone’s inbox and you can see the full history of what’s been done. If your current provider relies on one engineer’s mobile number, that’s a risk in itself.

They prevent problems rather than just fixing them

The old model of IT support was break and fix: something fails, you call, they come and repair it, you pay. The problem with that model is that the provider earns more when things go wrong. A good managed service provider works the other way round. They monitor your systems around the clock, apply updates before vulnerabilities are exploited, spot failing hardware before it dies and flag issues before your staff notice them.

Ask any prospective provider what they monitor, how often they patch and what they’d typically catch before you knew about it. The answers tell you a lot. Our page on IT service management sets out how we approach this.

Security is built in, not sold as an extra

The National Cyber Security Centre has published specific guidance on choosing a managed service provider, aimed at small and medium businesses. It recommends looking for recognised certifications such as Cyber Essentials Plus or ISO 27001, checking client references and understanding exactly which security responsibilities sit with the provider and which stay with you.

That last point catches a lot of businesses out. Many assume their IT provider is handling backups, multi-factor authentication and staff access controls, only to discover after an incident that none of it was in the contract. A good provider will be clear about the dividing line and will tell you when something important falls on your side of it.

It’s also worth asking how the provider protects its own systems. An IT company with remote access to hundreds of clients is an attractive target, and attackers have used compromised providers to reach their customers many times.

Regulation is catching up with IT providers

The government recognises that risk. The Cyber Security and Resilience Bill, currently going through the House of Lords, will bring managed service providers under direct regulation for the first time, with new duties around security and incident reporting. Royal Assent is expected between late 2026 and spring 2027, with most of the detailed requirements following through secondary legislation after that.

Smaller providers may fall below the size thresholds, but the direction of travel is clear. Customers, insurers and regulators will expect more evidence that IT providers take security seriously. We explored what that means for businesses in why your customers are starting to ask about your IT security.

They understand your business, not just your technology

A solicitor’s practice, a care provider, a manufacturer and a recruitment agency all have very different needs. Legal firms deal with strict confidentiality requirements. Care providers handle sensitive health data and need systems that work at 3am. Manufacturers may have production equipment that can’t simply be rebooted for updates.

A good provider asks about how your business actually works before recommending anything. They should be able to show experience in your sector, whether that’s legal, manufacturing, social care or something else, and give you references from similar clients.

Honest advice, even when it costs them a sale

One of the clearest signs of a good provider is willingness to tell you not to buy something. If your current kit is fine for another two years, they should say so. If a cheaper licence covers what you need, they should point you to it. Microsoft 365 licensing is a good example: prices for several popular plans rose on 1 July 2026, and a provider who reviews your licences before renewal can often save more than the review costs.

The reverse is also true. A good provider will tell you plainly when something is a genuine risk, such as a server approaching the end of its support or a backup that’s never been tested, even if you’d rather not hear it.

Local matters more than you’d think

Most IT support happens remotely now, and it should. But when a network switch fails or a new office needs cabling, you want someone who can be on site the same day. A provider based in the region also understands the local picture, from which broadband providers are reliable in which industrial estates to which firms are hiring. There’s a practical trust element too. You can meet the people who look after your systems rather than a faceless call centre.

Clear contracts and a fair exit

A good contract is easy to understand. You should know what’s included, what costs extra, how prices can change and how long you’re tied in. Be wary of long minimum terms with automatic renewals buried in the small print.

Pay special attention to what happens when you leave. Your provider should hand over admin passwords, documentation and account ownership promptly and without fuss. Some businesses discover too late that their provider registered their domain name or Microsoft tenant in its own name. If you’re thinking about moving, our guide to switching to a new managed service provider walks through the process.

Red flags to watch for

• No written service levels, or service levels that are vague about fix times rather than just response times.
• No ticketing system, so requests depend on one person remembering them.
• Reluctance to share admin credentials or documentation about your own systems.
• Pushing new hardware or software at every meeting without explaining why.
• No mention of security unless you raise it first.
• Unable to tell you when your backups were last tested.
• No recent client references from businesses like yours.

Questions to ask before you sign

• What are your response and fix times, and how do you report against them?
• What do you monitor, and what would you typically catch before we noticed?
• Which security certifications do you hold, and how do you protect your own systems?
• Which security tasks are your responsibility and which are ours?
• How often do you test our backups, and will you show us the results?
• Who will we actually deal with day to day?
• What happens to our data, passwords and accounts if we leave?
• Can we speak to two or three clients similar to us?

Talk to us

One IT Support has worked with businesses across Newcastle, North Tyneside and the wider North East since 2011. If you’re reviewing your current arrangement or looking for a provider for the first time, ask for a quote or book a free, no-obligation conversation. You can also read more about how we help North East businesses with managed IT services.