Many owners hire a managed IT provider to stop thinking about IT. That is a reasonable goal, but it can drift into never looking at the work at all. Contracts renew automatically, reports go unread, and the first time anyone asks hard questions is after something breaks.
You do not need to become a technologist to manage your provider well. You need a rhythm of review and a handful of good questions.
Set the Cadence
Hold a business review with your provider every quarter. Keep it to an hour. Include someone from leadership, someone from finance, and an operations representative who understands the field. Ask the provider to bring a written summary in advance.
A relationship that only meets when there is a problem will have a lot of problems.
Agenda for the Quarterly Review
1. Service Performance
Review response and resolution times against the targets in your agreement. Ask about trends, repeated issues, and any tickets that took unusually long. Look at field-related problems separately, since they often have the biggest business impact.
2. Security Posture
Ask for plain-language status on core controls:
- Multifactor authentication coverage, and any accounts without it
- Patch status for servers, workstations, and network gear
- Endpoint protection and monitoring coverage
- Email security events and phishing reports
- Backup success and the date of the last restore test
- Administrator accounts and any changes to them
Ask what the provider is worried about. A good one will have an honest answer.
3. Incidents and Near Misses
Review any incidents since the last meeting: what happened, how it was handled, and what changed afterward. Ask about near misses too. A provider who reports only good news is either lucky or not looking.
4. Projects and Roadmap
Discuss upcoming work: hardware refreshes, software upgrades, new jobs requiring connectivity, compliance deadlines, and contract changes with security requirements. Make sure the provider hears about new projects early enough to plan.
5. Risk Register
Keep a short list of known risks, such as unsupported systems, single points of failure, or users who resist controls. Record who owns each and when it will be addressed. If you decide to accept a risk, document that decision and who made it.
6. Costs and Contract
Review invoices against the agreement. Check for additions, license counts that no longer match headcount, and charges for items that should be included. Ask whether you are paying for licenses that nobody uses.
7. Asset and Account Hygiene
Confirm that the device inventory, user list, and software license records are current. Ask when the last access review happened and what was found.
Questions Worth Asking Every Time
- If we lost our main office tomorrow, how long until we are working again?
- Who has administrative access to our systems, including at your company?
- Has anything changed in how you protect your own tools that touch our data?
- What is the one thing you would fix first if you had no budget limit?
Watch for Warning Signs
- Reports that are vague or full of jargon
- No evidence of backup tests or access reviews
- Repeated excuses for the same problem
- Difficulty reaching a knowledgeable person
- Reluctance to share documentation or admin credentials for your own environment
You should always have your own copy of key documentation and a way to take back control of your systems, including the credentials for critical accounts held securely by you.
Keep Leadership Engaged
Share a short summary of each review with the owner or executive team. Decisions about budget and risk tolerance belong to the business, and providers cannot make them for you.
Know When to Change
If problems persist after clear feedback, consider alternatives. Review your agreement's notice and transition terms before you need them, including what happens to your data and documentation if you leave.
A Healthy Relationship
The best arrangements feel like a partnership: the provider is candid, the business is engaged, and surprises are rare.
Ironfield Cyber welcomes this kind of scrutiny. We deliver quarterly reviews to our clients and are happy to share a sample agenda if you want to start holding them with your current provider.