Choosing a managed IT provider is a long-term decision. They will hold administrative access to your systems, support your crews, and be the first call in an emergency. Yet many companies compare proposals on price alone, since the services sound alike on paper.
These ten questions help you see differences that matter, especially for contractors and energy companies with field operations, project software, and growing customer security expectations.
1. What is your experience with companies like ours?
Ask about construction, energy, or industrial clients. Providers who know jobsite realities, project software, seasonal staffing, and remote locations will understand your needs faster. Ask for references from similar businesses and call them.
2. How do you support people in the field?
Office-only support models leave superintendents stranded. Ask about hours of coverage, how crews request help, whether support is available early mornings and weekends, and how problems at remote jobsites are handled. Ask what happens when a trailer loses internet.
3. What is included in the monthly fee, and what costs extra?
Get specifics. Clarify whether the price covers help desk, onsite visits, projects, security tools, backup, software licensing, after-hours work, and vendor management. Ask how new users, new sites, and new devices are priced.
4. What security do you provide by default?
Do not accept vague answers. Ask about:
- Multi-factor authentication and how it is enforced.
- Email security and phishing protection.
- Endpoint protection with monitoring and response.
- Backup design, including offline or immutable copies and restore testing.
- Patch management.
- Security awareness training.
- Incident response support.
Ask who monitors alerts, when, and what happens at 2 a.m.
5. How do you protect your own access to our systems?
A provider holds the keys. Ask how they secure their administrative accounts, whether technicians use individual accounts with MFA, how they track and limit access, and whether their own staff are background checked. Ask how they would notify you if they had a security incident.
6. What are your response and resolution targets?
Ask for written service levels: how fast you get a response for different severities, and how they measure and report performance. Ask what happens when targets are missed.
7. How will we know what you are doing?
Request sample reports. Good providers share regular summaries of tickets, patch status, backup results, security events, and recommendations. Ask for a regular business review where you discuss budgets and roadmap, not just problems.
8. How do you handle onboarding and offboarding?
Smooth account setup and prompt removal of access are essential in industries with rotating crews. Ask to see their process, how long it takes, and how they confirm completion.
9. What does the contract require of us, and how do we exit?
Read term lengths, auto-renewals, cancellation notice, and data and documentation handover. Make sure you own your administrative credentials, documentation, and licenses. Ask how transition would work if you leave. A confident provider will not resist this question.
10. Can you support our compliance needs?
If you pursue defense contracts, support utilities, or answer insurer questionnaires, ask whether the provider has experience with CMMC and NIST SP 800-171, evidence collection, and customer security reviews. Ask for clarity on which responsibilities they take and which remain yours.
How to use these questions
Give every candidate the same list and score answers. Look for specifics, examples, and willingness to admit limits. Be wary of providers who promise to prevent every incident, since no one can. A better answer describes how they detect, contain, and recover.
Signs of a good fit
- They ask about your business before pitching tools.
- They talk about risk, not only technology.
- Their proposal is clear about scope and exclusions.
- References describe responsiveness and honesty.
- They explain things in plain language.
Talk with Ironfield Cyber
Ironfield Cyber is a cybersecurity-first managed IT provider serving construction and energy companies. We are happy to answer these ten questions for your business, and to review proposals you have received from anyone.