12 Questions to Ask a Managed IT Provider Before You Sign

What are the right questions to ask a managed IT provider before you sign? Everyone promises proactive support, strong security and fast response. The differences only show up later: in the contract, in the first outage, and on the day you try to leave.

The way to see those differences before you sign is to know the right questions to ask a managed IT provider. This guide gives you 12 of them, explains what a good answer sounds like, and flags the answers that should make you walk away.

If you haven’t built a shortlist yet, start with our guide to the best managed IT providers in Brisbane. Then bring these questions to each conversation.

Key takeaways

• The best questions to ask a managed IT provider cover scope, response times, backups and exit terms.
• Get the scope in writing. “Fully managed” means different things to different providers.
• Ask for response times and resolution times, by priority level, in the contract.
• A provider should be able to tell you when they last tested a client’s backup restore.
• Check the exit terms before you sign: notice period, handover of passwords and documentation, and any fees.
• Use the scorecard at the end to compare providers side by side.

What does a managed service provider actually do?

A managed IT services provider, or managed service provider (MSP), looks after your business’s technology for a fixed monthly fee, usually charged per user.

Instead of calling someone when something breaks, you get proactive monitoring, maintenance, security and support designed to stop problems before they reach your staff and improve efficiency and productivity.

For most small and medium businesses, an MSP replaces one of two setups. The first is break-fix support, where a technician is paid by the hour after something goes wrong. The second is an in-house IT person, who is often stretched across every task and has no backup when they’re on leave.

A typical managed IT agreement covers:

• Helpdesk support for everyday issues, by phone, email or remote access
• 24/7 monitoring of servers, devices, networks and backups
• Patching and updates applied on a schedule, not when someone remembers
• Cybersecurity, including endpoint protection, email security and MFA
• Microsoft 365 management, from licences to security settings
• IT planning, with guidance aligned to business goals so technology decisions match where the business is heading

What’s actually included varies a lot between providers, and comparing a managed service provider (MSP) with other IT service providers helps you assess the right partner before outsourcing IT management.

Start with your business needs

Before you use these questions to ask a managed IT provider, spend 30 minutes writing down your business needs. Providers can only give you an accurate quote and a tailored solution when they know what they’re supporting.

Documenting this first gives you a clear understanding of your current IT environment before speaking with providers, and it also makes their answers much easier to compare.

Note down your company‘s existing resources and IT systems:

• Users and devices. How many staff, laptops, phones and servers do you have?
• Locations. One office, several sites, or staff working from home?
• Critical systems. Which applications would stop the business if they went down? For example, your practice management software, CRM, accounting platform or email.
• Compliance obligations. Do you hold client personal information, trust account data or financial records? Do you need to meet the Privacy Act, ASIC requirements or the Essential Eight?
• Current pain points. What keeps going wrong in your environment, and how much does it cost you when it does?
• Growth plans. Are you hiring, opening a new office or moving systems to the cloud in the next 12–24 months so the right provider can help move the business forward as your organization grows?
• Budget. What do you spend on IT now, including the hidden costs of downtime and staff time spent fixing problems?

Share this list with each provider before your meeting. A good provider will ask follow-up questions about it and how their recommendations fit your IT strategy and business priorities. One who jumps straight to a price without asking is showing you how they’ll work.

1. What exactly is included in the monthly fee, and what isn’t?

This is the most important of the questions to ask a managed IT provider, because “fully managed” has no standard meaning. One provider’s $120 per user may include more than another’s $200. If a provider offers “unlimited support”, ask what that means in the contract.

This is a critical decision, and asking the right questions early helps you compare managed IT service providers on like-for-like terms.

Ask for a written list of what the per-user fee covers. A comprehensive package for an Australian SMB usually includes helpdesk support, 24/7 monitoring, patching, endpoint security, backup monitoring and Microsoft 365 management.

Ask for a detailed flat-fee breakdown as well, so you can see exactly which support services are included and what to expect from the agreement. Also ask whether the pricing structure and contract terms stay flexible as business needs change.

Then ask what’s billed on top and when you may incur additional charges: on-site visits, after-hours work, projects, new staff setups, licences and security tools.

A good answer: a clear inclusions list, plus a short list of what costs extra and at what rate. Transparent pricing should also explain the provider’s business model and define any must-haves included as standard.

Walk away if: the answer is “everything’s covered” with nothing in writing.

For a guide to typical pricing, see what managed IT typically costs for Brisbane businesses.

2. What are your response and resolution times?

Response time is how quickly someone acknowledges your problem. Resolution time is how quickly it’s fixed. Many providers only promise the first. In practice, support requests should be acknowledged, prioritised, and escalated under a clear process.

Ask for both, broken down by priority, and ask to see the provider’s service level agreements that define response and resolution commitments. A full outage should be treated very differently from a printer that won’t connect. Ask what percentage of issues are resolved remotely versus requiring on-site visits.

Ask whether these times apply only during business hours, and for critical incidents, 24/7 responsiveness is non negotiable.

A good answer: published response times by priority level, written into the contract, so you know what to expect from support.

Walk away if: they say “we’re always quick” but won’t put numbers in the agreement.

3. Who will actually answer when we call?

The person who sells you the service is rarely the person who fixes your problems. Ask who will be on the other end of the phone.

Useful follow-ups:

• Is the helpdesk local, or offshore?
• Will we have a dedicated account manager as a single point of contact who knows our setup?
• Do our requests go into a shared queue, or to a team that knows our business?
• How many technicians are on the team?
• What happens when our main contact is on leave?

Regular check-in calls help maintain effective communication and support a successful partnership.

A good answer: a local team, a named contact, and a clear escalation path.

Walk away if: they can’t tell you who will look after you, or one person holds all the knowledge about your systems.

4. How do you handle cybersecurity, and which frameworks do you follow?

Cybersecurity should be built into managed IT, not sold as an optional extra. It should help manage security across your whole it environment, not just sell point tools. With cyber attacks surging 38% year-over-year in 2022 and the average data breach costing nearly $4.9 million globally, these questions matter.

Ask which security tools are included as standard, and how they protect against the cyber threats Australian SMBs face most: phishing, business email compromise and ransomware.

You should also ask how they respond to evolving threats, what they use for threat detection, including active network monitoring for suspicious activity, and what security expertise they bring to handling threats and protecting your environment.

Then ask which framework they work to. The Essential Eight security framework developed by the Australian Cyber Security Centre is the baseline most Australian businesses are measured against.

Some providers also align with international frameworks such as NIST, the CIS Controls, and GDPR where sensitive data handling and compliance regulations apply. Ask what maturity level they can help you reach.

Also ask whether the provider holds a security certification itself. A provider that has been independently assessed, such as XCD IT’s SMB1001 Gold certification, has had its own practices checked, not just its marketing. Other recognised security certifications include ISO 27001 and SOC 2.

In the same discussion, ask about ongoing training for both technology skills and cybersecurity practices. Also ask whether their standard stack includes endpoint detection. Also ask whether they implement zero trust architecture.

Finally, ask what the contract says about responsibility if a security incident happens, including who is accountable for protecting sensitive data, data privacy, and the controls used to ensure compliance, and whether the provider carries its own cyber insurance.

A good answer: security tools included in the fee, a named framework, and evidence of the provider’s own certification.

Walk away if: security is a vague promise, or MFA isn’t enforced by default.

5. How do you back up our data, and when did you last test a restore?

Almost every provider says they “do data backups”. The real question is whether those backups work when you need them. Data loss can significantly impact operations, so the provider should explain backup frequency, storage locations, and restore speed.

Ask where your backups are stored, how often they run, and how long they’re kept. Ask about their backup procedures, not just whether backups exist. Ask whether they follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy kept offsite.

Ask whether Microsoft 365 data (email, OneDrive, SharePoint, Teams) is backed up separately, because Microsoft’s built-in retention is not a full backup. Then ask how the provider handles disaster recovery planning, covered below.

Of all the questions to ask a managed IT provider, this one helps identify a good MSP: when did you last test restoring a client’s data, how long did it take, and what did you improve to prevent recurring issues and make backups more reliable next time?

Disaster recovery and business continuity: what to ask beyond backups

Backups protect your data. A disaster recovery plan is the tested plan for getting your business running again and supporting business continuity, and that’s a different question.

A provider can have perfect backups and still take three days to restore them. Disaster recovery planning should cover people, systems and decision-making, not just stored backups.

Ask for two numbers:

• Recovery time objective (RTO): how quickly your systems will be back up after a major incident. For example, “critical systems restored within 4 hours”.
• Recovery point objective (RPO): how much data you could lose, measured in time. A nightly backup means you could lose up to a day of work. Hourly backups reduce that to an hour.

Then ask:

• How does your provider handle disaster recovery planning for our business, including restore procedures, backup or replication design, regular testing, and active network monitoring for suspicious activity, and when was it last tested?
• If ransomware encrypted our files tomorrow, what happens in the first hour of your incident response, including containment, communication, and recovery steps?
• Are backups kept offline or locked against changes (immutable), so ransomware can’t encrypt them too?
• Who makes decisions during an incident, and how will you keep us updated?
• Does the plan also cover major events like natural disasters and hardware failure?

A provider who can walk you through a real recovery, step by step, has done one before, and that planning helps protect business operations after a major incident.

A good answer: automated backups stored separately from your main systems, Microsoft 365 included, regular restore tests with documented results, agreed recovery times, and a reliable MSP that regularly tests and updates disaster recovery and business continuity plans instead of relying on backups alone. Our guide to cloud backup and disaster recovery explains what a solid setup looks like.

Walk away if: they can’t remember the last restore test, or they assume Microsoft backs up your data for you.

6. Do you provide on-site support in our area, and what does it cost?

Most issues can be fixed remotely, but some can’t: a failed switch, a new office fit-out, or a server that won’t start.

Ask a potential MSP what percentage of support issues it typically resolves remotely before an on-site visit is needed.

Ask whether on-site visits are included or billed separately, what the hourly rate is, and how quickly a technician can reach your office. If you have staff in several locations, ask how they cover each one.

A good answer: clear on-site rates and realistic travel times for your suburbs or regions.

Walk away if: on-site support is “available” but with no timeframe or price.

7. How do you manage Microsoft 365?

For most small businesses, Microsoft 365 is the centre of everything: email, files, Teams, security, and broader cloud services. It’s also where a lot of money is wasted on the wrong licences and features left switched off.

Many businesses also saw cloud costs rise quickly after rushed migrations, so any advice should be tailored and cost-conscious. Regular software updates and patch management also help keep Microsoft 365 secure and stable.

Ask whether they’re a Microsoft Partner, whether they manage licensing for you, and whether they’ll review your current setup. Ask specifically about security settings such as conditional access and email protection, which are often included in your licence but never turned on.

A good answer: an initial configuration review, ongoing licence management, and security settings enforced across all users. See our Microsoft 365 services for what this typically covers.

Walk away if: they treat Microsoft 365 as “just email”.

8. What happens during onboarding?

The first 30 to 60 days set the tone for the whole relationship. A rushed onboarding means your new provider is learning your systems during your first emergency.

Ask what the onboarding process looks like step by step, from discovery and planning to migration, training, and minimising disruption as you move to a new MSP.

A good IT partner will review your current IT infrastructure and audit your devices, accounts and network; document everything; fix urgent security gaps first; and agree a timeline with you.

Some providers also assign a dedicated Technical Account Manager during onboarding to support strategic IT planning and handover. Ask how they’ll handle the handover from your current provider, and whether there’s a fee for onboarding.

A good answer: a documented onboarding plan with a timeline, an initial audit report, and a clear handover process.

Walk away if: onboarding is “we’ll just install our tools and go”.

9. How will we know what you’re doing for us?

With proactive IT, the best work is invisible: problems are fixed before anyone notices. That’s good for your business, but it can make it hard to see what you’re paying for.

Ask what reporting you’ll receive, what the reporting process looks like, and how often. Useful reports show tickets raised and resolved, patches applied, backup results, security alerts, and any risks the provider wants you to know about; they should also surface recurring issues, root causes, and recommendations for continuous improvement.

Ask whether you’ll get regular review meetings, and who attends. They should provide reports on performance, security incidents, and service updates, and regular check-in calls support a strong communication style.

A good answer: a monthly report in plain English, valuable insights from a dedicated account manager, and a regular review meeting, at least quarterly.

Walk away if: the only time you hear from them is when the invoice arrives.

10. Do you have experience in our industry?

Different industries carry different obligations. A real estate agency handles trust account data. A financial adviser must meet ASIC’s cyber resilience expectations.

A medical practice in the healthcare industry holds sensitive health records, and if the provider supports regulated international or comparable compliance contexts, they should be able to explain experience with electronic health records, HIPAA, and similar requirements. Every business that holds personal information has obligations under the Privacy Act.

Ask which clients they support in your industry and what compliance requirements they’ve helped those clients meet. Request client references or examples that demonstrate the MSP’s reliability. Speaking with current or past clients from other businesses can help verify the provider’s track record, especially for companies of a similar size, in the same industry, or with comparable compliance demands.

A good answer: current clients in your industry, specific compliance experience, and references you can call.

Walk away if: they treat every business the same, or won’t provide references.

11. What are the contract terms, and how do we leave?

This is one of the questions to ask a managed IT provider that most businesses forget. You should know how to end the relationship before you start it, because the wrong MSP can lock you into rigid terms that no longer fit.

Ask about:

• Contract length. Is it month-to-month, 12 months, or 36 months, and do flexible contract terms let them scale services up or down as your business grows or contracts?
• Notice period. How much notice do you need to give to leave?
• Support limits. Is there a cap on support hours, and what happens if you go over it?
• Exit fees. Is there a fee to terminate early, or to hand over to a new provider?
• How are services and costs adjusted for new users, removed teams, additional services, or a business unit divestment?
• Handover. Will they hand over all passwords, admin access, documentation and network details?
• Ownership. Who owns the hardware, licences and software accounts? Are any in the provider’s name?

A good answer: reasonable notice, no hidden exit fees, and a written commitment to a full handover of credentials and documentation.

Walk away if: admin accounts or licences are held in the provider’s name, or the contract is silent on handover.

12. How will you help us plan ahead?

A good managed IT provider keeps things running. A great one acts as an it partner that helps you plan around your business objectives: when to replace laptops, when to move a server to the cloud, how to budget for IT next year, and how to adopt tools like AI safely. The right MSP should provide strategic guidance, not just reactive fixes.

Ask whether they provide an IT roadmap, how often they review your technology with you, and whether strategic advice is included in the fee or charged separately.

Ask how they handle growth, including onboarding new users, seamlessly doubling support coverage for increased headcount, integrating new technologies, and advising on hybrid cloud options when appropriate.

Those roadmap reviews should also connect IT planning to your long-term business goals and the wider direction of your organization.

A good answer: an annual IT roadmap and budget, reviewed with you at least once or twice a year.

Walk away if: they only ever talk about fixing things, never about where your business is heading.

This kind of planning is one of the clearest differences between proactive managed IT and the break-fix model, where support only arrives after something has gone wrong, so ask whether they take a proactive approach to reviews and risk reduction.

Red flags to watch for

Some warning signs show up across the questions to ask a managed IT provider. If you notice any of these, slow down before signing:

• No numbers in writing. Response times, inclusions and fees should all be in the contract, not just the sales pitch.
• Pressure to sign quickly. A good provider will give you time to compare and check references.
• Accounts in their name. Your Microsoft 365 tenant, domain and licences should always belong to your business.
• Security as an add-on. Basic protection like MFA, patching and endpoint security should be standard.
• Table stakes are sold as proof. Promises like 99.9% uptime or fast first-response times are only table stakes if the provider lacks a proactive approach and clear accountability.
• Long lock-in with no exit plan. A 36-month contract with heavy exit fees and no handover clause puts all the risk on you.

The 4 Questions to Ask a Managed IT Provider if You Only Have 15 Minutes

If you’re short on time, focus on the four questions to ask a managed IT provider that most often separate a good provider from a costly mistake. These are the same four marked as critical in the scorecard, and they help you make a critical decision faster without skipping essentials. Asking the right questions here also surfaces the key questions that reveal fit early.

If a provider can’t answer all four clearly and in writing, it’s worth continuing your search for the right MSP.

Compare providers with our free scorecard

Score each provider from 1 (poor) to 5 (excellent) as you go through the questions, or download the printable version below. The provider with the highest total isn’t always the right choice, but low scores on questions 1, 2, 5 or 11 are a serious warning sign as you go through the questions to ask a managed IT provider, or download the printable version below.

Frequently asked questions

Ask XCD IT these 12 questions

We’re happy to be put to the test. XCD IT has supported businesses across Brisbane, the Gold Coast, the Sunshine Coast and Sydney since 2005, from our office in Spring Hill. We hold SMB1001 Gold cybersecurity certification and are a Microsoft Partner.

Choosing a managed IT service provider is a long-term decision that can affect your security, reliability and growth. If you’re evaluating a managed security services provider, many of the same questions apply, with extra focus on security operations.

Call us on 07 3085 7447 and ask us any of the questions in this guide so you can compare providers carefully before choosing the right long-term IT partner.

We’ll give you straight answers, in writing. In conclusion, choosing the right provider comes down to fit, services, expertise, pricing, and your long-term business needs. Or learn more about our managed IT services in Brisbane. This article was originally published earlier and has been updated.