10 Questions to Ask Your IT Provider
The right technology partner helps an organisation move forward with confidence
Whether you are choosing a new IT provider or reviewing your current one, you are really deciding who holds responsibility for the technology your organisation relies on, and where accountability rests. The right questions show how a provider thinks, how clearly they take ownership and whether their approach will keep pace as you grow.
Nothing may be wrong with your current arrangements. Often, responsibility has simply grown, and what once worked well no longer gives the confidence or structure the organisation needs. These ten questions are a practical place to start, and each comes with a note on what a good answer sounds like.
Questions at a glance
10 Questions
1. How will you take ownership of our technology, and who is accountable when something goes wrong?
Support that fixes issues as they arise is not the same as ownership. Ask who is responsible for the wider environment, how decisions are made and who you speak to when something needs attention.
A good answer names people and responsibilities, and puts them in writing.
2. What will you want to understand about our organisation before recommending anything?
The best advice starts with how your people work, where the risks sit and what the organisation is trying to achieve. Look for a provider who asks before presenting a product list.
A good answer begins with listening, and shows how what they learn shapes what they recommend.
3. How do you plan technology renewals and budget as we grow?
Technology ages and organisations change. A provider should help you see what is coming, what it is likely to cost and when, so changes are planned rather than reactive. Ask about moving platforms or adding people and locations too, and whether any costs sit outside the agreement.
A good answer offers a simple roadmap, clear costs and no surprises beyond what was agreed.
4. What happens when we raise an issue, and how quickly will someone respond?
Response times matter most on an ordinary day when someone cannot work. Ask what is agreed, how it is reported and whether you will reach people who know your organisation.
A good answer gives agreed response times in writing, regular reporting and a clear route to escalate.
5. How do you protect your own access to our systems?
A provider often has wide access to your technology, so how they secure that access matters as much as how they secure yours. Ask about multi-factor authentication on their own accounts, how they verify requests such as password resets and how access is removed when people leave.
A good answer is specific and confident, and describes the same standards they would expect of you. Holding a current Cyber Essentials Plus certification should be expected of a technology partner.
6. How will you help us understand and manage cyber security risk, including Cyber Essentials?
Security works best as an ongoing conversation, not a once-a-year exercise. The government’s latest breaches survey found phishing to be the most common type of attack facing UK businesses and charities, so ask how staff awareness, access controls and day-to-day protection fit together. Cyber Essentials was updated in April 2026, with a sharper focus on multi-factor authentication and cloud services, so it is worth asking how your provider keeps certification in step as things change.
A good answer explains risk in plain language, treats certification, day-to-day practice and awareness training together and reviews them all regularly.
7. How will you build resilience into our technology, and how would you help us if systems or data were lost?
Resilience comes in levels, and the right one depends on what your organisation relies on. Ask what is protected as standard, what sits beyond that and how recovery would work, from restoring a single file to wider systems.
A good answer is clear about what is covered, helps you decide what level fits and explains who does what when recovery is needed.
8. How do you approach AI and new technology on our behalf?
Government research published in April 2026 found that just under a third of UK businesses are using, adopting or considering AI, and only around a quarter of those have measures in place to manage the cyber security risks that come with it. A provider should help you adopt new technology at a pace that suits the organisation, starting with what you are trying to achieve.
A good answer starts with the problem you are trying to solve rather than the tool, includes a risk check before anything is adopted and helps your organisation set clear guidance for your people. Our AI Governance in Practice series explores where to begin, starting with organisational readiness.
9. Who will support us, and how do you look after your own people?
Consistency matters, and it is hard to build when people keep leaving. Ask about named contacts, training and how long people tend to stay, and about how the provider treats its own team, because culture usually shows in the quality of support.
A good answer shows stable teams, investment in training and fair treatment of staff, and is honest about what they are still working on.
10. What will the first 180 days look like, and what happens if it is not working?
Changing provider should build confidence, not create uncertainty. Ask for a documented transition plan with clear milestones, who is responsible for what and how your people will be supported along the way. Ask too what happens if expectations are not met.
At CYAN, every new managed service agreement includes our CYAN Service Assurance Guarantee. It sets out our onboarding and service commitments and gives you the contractual right to leave if we materially fail to meet them and cannot put it right.
A good answer is a written plan, clear ownership from day one and honest terms if it is not working.
What good looks like
The right provider is a strategic partner, not simply a source of support. Good looks like clear ownership, advice that is planned rather than reactive and communication you can trust, whether the day is ordinary or difficult. You know what is covered, what it costs and who to speak to. Security and resilience are built in and reviewed as the organisation changes, and the provider’s capacity grows with yours.
Transparency is part of that. It is easier to trust a provider whose approach can be seen as well as described, and our Trust Centre is one example of what that can look like in practice. It sets out how we protect systems and data, how we govern our use of AI and where our certifications can be checked for yourself.
These questions will help you see how any provider measures up, and the answers will tell you a good deal about the relationship you can expect.
Sources & Citations
Department for Science, Innovation and Technology and Home Office. Cyber Security Breaches Survey 2025/2026. GOV.UK, published 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
IASME Consortium. Upcoming Changes to the Cyber Essentials scheme: April 2026 Update. IASME, published 3 November 2025. https://iasme.co.uk/articles/upcoming-changes-to-the-cyber-essentials-scheme-april-2026-update/
National Cyber Security Centre. Cyber Essentials Requirements for IT Infrastructure v3.3. NCSC. https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf
A practical next step
Start a practical conversation about how technology is managed today and whether it provides the structure, accountability and confidence your organisation now needs. No pitch. No pressure. Just a practical conversation about where things stand.
