Compare IT support models
| Model | Potential fit | Check |
|---|---|---|
| Pay-as-you-go support | Occasional help for a simple setup | Availability, minimum charges and emergency rates |
| Managed IT service | Ongoing support and routine administration | Included users, devices, servers and applications |
| Co-managed IT | An internal team needing specialist capacity | Ownership of changes, monitoring and escalation |
| Specialist cyber service | Specific security monitoring or response needs | Coverage, response authority and handover to IT support |
Define the assets and support hours
Create an inventory of devices, cloud accounts, software, locations and critical workflows. Include shared accounts and equipment used by remote staff.
Tell providers which failures stop trading and when support is needed. Ask them to distinguish an initial response from restoration and a permanent fix.
Make cyber security responsibilities explicit
The National Cyber Security Centre’s small-organisations guidance covers practical protections including backups, access and keeping systems secure. Use the official guidance to build a responsibility checklist with the provider.
Name the owner of patching, privileged access, account recovery, email security and employee offboarding. Ask how exceptions are recorded and how you learn about a control that is failing.
Test recovery, not only backup completion
Specify the data and applications that must be recoverable, how much recent work could be lost and how long recovery may take. Ask for a demonstrated restore of representative data.
Keep emergency access and account ownership arrangements available to the business. A provider change or staff departure should not leave you unable to administer essential services.
- What is monitored and during which hours?
- Who can approve emergency changes?
- Are incident response and forensic work included?
- Who pays for recovery outside the standard scope?
Compare the complete bill and exit terms
Include onboarding, licences, projects, site visits and out-of-hours work in the comparison. Check whether charges are per user, device, location or a combination.
Agree ownership of documentation, configurations and cloud subscriptions. Specify export and handover assistance, notice periods and any exit charge before the relationship begins.
Frequently asked questions
Is cyber insurance a substitute for IT security?
No. It covers specified insured losses and may require particular controls.
Set up the operational protections and compare any insurance wording separately.