5 questions to ask your IT partner (and the answers you want to hear)

Almost every SME with around fifteen employees has an IT partner today. But ask what exactly has been agreed, and the room often goes quiet. 'They come when something breaks' is the most common answer. That is not an agreement, it is a habit. It becomes a problem on the day your email goes down, a back-up is missing or the only person who knows your systems is on holiday. Below are five questions for your current or future IT partner, each with the answer you want to hear.

1. How fast do you respond, and how fast do you fix it?

These are two different things, and that is exactly where it often goes wrong. Response time is how quickly someone picks up your request and confirms they are on it. Resolution time is how quickly the problem is actually gone. Replying within fifteen minutes and needing three days for the fix can perfectly well go together. These agreements belong in an SLA, a Service Level Agreement. In plain language: what 'urgent' means, what 'can wait' means, and how fast work starts in each case.

• The answer you want to hear: a clear distinction between priorities. The whole company is down, one person cannot work, or something is annoying but not blocking.
• For each priority a response time and a target resolution time, in writing.
• Red flag: 'we are always there for you' without numbers. That is an intention, not an agreement.

2. What do you monitor proactively, and what do I notice of it?

A good IT partner does not wait for you to call, but sees problems coming. That happens with monitoring software that keeps an eye on your servers, laptops and your Microsoft 365 environment. The question is not whether they monitor, but what exactly.

• Back-ups: do they run every night, and is it tested now and then whether you can actually restore them?
• Updates: are security updates installed on all devices, including the laptop of the colleague who mostly works from home?
• Suspicious sign-ins: a login to your mailbox from another country at three in the morning, does anyone notice?
• Disk space and hardware: a full server or a dying disk usually announces itself weeks in advance.

The answer you want to hear: a concrete list, and what happens when an alarm goes off. Who looks at it, and do you hear about it? If the answer is 'we will look when something comes up', they are not monitoring.

3. What do I get to see every month?

This is where partners who manage separate themselves from partners who only repair. You do not need a thirty-page technical report. You want one overview you can read in five minutes that tells you whether your environment is healthy.

• Open and closed tickets: what was reported, what was solved, what is dragging on and why.
• Patch status: which share of the devices is up to date, and which are not.
• Back-up status: succeeded, failed, most recently tested restore.
• Security incidents: blocked phishing emails, suspicious sign-ins, and what was done about them.

The answer you want to hear: 'yes, and we go through it together a few times a year'. A report you never receive is usually one nobody produces.

4. What happens with an incident outside office hours?

Ransomware does not wait until Monday morning. Serious incidents start remarkably often in the evening, at the weekend or during holidays. That is precisely when you want to know who to call and what it costs.

• Availability: is there a number outside office hours, and who answers? A person or a voicemail?
• Who decides: may the partner shut down systems on their own to prevent worse, or do they have to reach you first? Agree on that in advance.
• Costs: is an after-hours intervention included in your contract, or is it a separate rate? Both are defensible, as long as you know beforehand.

The answer you want to hear: a clear scenario, no improvisation. What you really do not want: discovering during the incident that nobody can be reached.

5. What happens if we part ways?

An awkward question for someone you are just starting with. Ask it anyway. How a partner reacts to it says a lot about how they work.

• Documentation: is there an up-to-date overview of your network, your licences, your devices and your suppliers? And do you get to see it too?
• Admin rights and passwords: they belong to you, not to the partner. You have your own admin account on your Microsoft 365, your domain name is registered in your name and the passwords sit in a vault you can access.
• Handover: what has been agreed about the notice period and the handover to a next partner? A good partner simply cooperates.

The answer you want to hear: 'everything is in your name, you get the documentation and we help with the handover'. That is not distrust, that is good housekeeping.

Red flags you should take seriously

• Everything goes through one person. When they are ill, gone or overloaded, you stand still.
• There is no documentation, or it lives 'in the head' of the technician.
• The admin passwords are known only to the partner, and you do not get them just like that.
• Your domain name or your licences are registered in the partner's name.

Recognise several points? Then you do not have to leave right away, but you should start the conversation. A good partner finds these questions normal.

How we handle this ourselves

Briefly and without a sales pitch. At Secundra, priorities and response times are on paper before we start. Monitoring of back-ups, updates and sign-ins is a standard part of the service, and you receive a monthly overview that we go through together a few times a year. Admin rights, domain names and licences are always in your name. Want an idea of the budget first, or still weighing an in-house IT employee against an external partner? Then read what an IT partner costs for an SME and in-house IT specialist or IT partner.