Managed IT sales calls cover similar ground, and what separates one provider from another tends to surface only once there is an agreement to read. The way to see it earlier is to ask questions the pitch did not anticipate. These twelve each come with why it matters and the answer that should worry you. They apply whether you are buying fully managed IT or adding a provider around an internal team.
Scope and money
1. What exactly is out of scope, and what does each item cost
Out-of-scope charges are where a headline rate grows unannounced, which makes this the most expensive question on the list. Ask for the schedule as a written appendix covering projects, after-hours work, new-hire setup, procurement markup and vendor coordination. “Everything’s included,” with no schedule behind it, means the boundaries get drawn later, by them, at a moment when you are already dependent.
2. What does a security incident cost under this agreement
Some agreements treat the first stretch of work (working out what happened, shutting the attacker out, and writing the whole thing up) as covered work. Others treat it as a billable emergency at premium rates, which makes your worst day your largest invoice. Ask whether the written report your insurer will want is included. “We have never had to deal with that” is an answer worth pressing on: either they are new to incident work, in which case they should say so plainly, or they are not telling you about it.
3. How many users does each of your engineers support
A good answer is a plain number with context: how many users each engineer carries, and what the provider does when one site goes down. Ask for it directly, and treat a service-level promise offered in place of a number as something other than an answer. The ratio predicts a bad week better than anything in the contract’s response table: one incident consumes an engineer, and everyone else’s tickets queue behind it.
4. What happens at renewal, and does the agreement auto-renew
Auto-renewal with a generous notice window is not by itself a problem. Auto-renewal with a price escalator and a narrow exit window you were not told about is a trap. Read the term clause together, aloud, on the call. If the person selling to you has to look it up, that tells you how often it is read.
5. What does onboarding involve, step by step
Onboarding should be a checklist in a fixed order: an inventory of what you own, taking charge of the passwords and keys, installing the software that watches your laptops and servers, proving a backup restores, writing the environment down, and a first review. “We’ll hit the ground running” cannot be held to; ask for the checklist.
Security and compliance
6. Who reads the security alerts, and what happens when the office is empty
Software that watches continuously is the minimum. The question is what happens when it fires, and precision here predicts honesty everywhere else in the relationship. Ask them to walk one real alert from detection to human action, naming who gets woken and what that person is allowed to do without calling you first. The answer to worry about claims a security operations center (a staffed room of analysts) with nobody off duty, but cannot describe who sits in it on a holiday, or treats “the software is always on” as though it meant “someone is watching.”
7. What does my regulator require of a firm like mine
If you are regulated, your provider is part of the compliance work you are answerable for, whether they accept that or not. A provider serving New York financial firms should know without notes that NYDFS Part 500 requires a written certification signed by the highest-ranking executive and the chief information security officer, and that multi-factor sign-in is required for anyone reaching the firm’s systems, meaning a second step at login beyond the password, with only a narrow exemption for the smallest entities. One serving CPA firms should be able to say what the FTC Safeguards Rule‘s nine elements cover. “We handle compliance,” with no specifics, is the bad answer; these are public documents, and fluency is checkable on the call.
8. What will you hand my insurer, my auditor, or a client questionnaire
Insurance renewals and client security questionnaires ask for evidence: that multi-factor sign-in is switched on, that the software watching laptops and servers is installed on all of them rather than most, that a backup was restored and the result written down, and that a written incident response plan exists. A good answer is a named report, shown to you with the client details blacked out, and a clear statement of whether producing it is in scope. If the report is a screenshot of a monitoring dashboard, worry: a dashboard shows this instant, and evidence is a dated record of a control working over a stretch of time.
9. When was a backup last restored, and who watched it finish
A backup that has never been through a restore is a hypothesis. Federal ransomware guidance tells organizations to keep offline copies and regularly test the availability and integrity of backups in a disaster recovery scenario. A good answer names the last restore, who sat and watched it finish, and where the result is recorded; recovery sits on the Cloud & network side of the work. An answer that describes the backup software, or that turns restore testing into a billable project, is the one to worry about.
Operations and exit
10. Who owns my documentation, credentials, and configurations
A provider that cannot be left is a provider that does not have to stay good, so the correct answer is that you own all three at all times, with the provider acting as custodian. Documentation described as proprietary, or administrator passwords that exist only in their vault, are the two answers worth pressing hardest on.
11. How do you work with an internal IT team
If you have internal IT, you are buying reinforcement. A co-managed arrangement needs written duty splits, both sides able to see the same tickets, and a written route for raising something urgent. Two bad signs: co-managed described as a stepping stone toward taking over the account, and a duty split that exists only as a conversation.
12. Which parts of the service are subcontracted, and what does leaving look like
Help desk overflow, after-hours coverage and security monitoring are commonly handed to another company further down the chain. That can be fine, provided you know who answers the phone and who is accountable in the agreement; supply chain guidance for buyers turns on exactly that, knowing who your suppliers’ suppliers are and what you have required of them. Then ask for the handover process before you onboard: what is given back, in what format, in what order, at what cost. Visible discomfort at the subcontracting question, or exit help priced to discourage it, answers the question for you.
The five answers that belong in the agreement
Ask for these five as written appendices. An answer that lives only in the call is hard to hold anyone to, so ask for it in writing.
| Answer | Form it should take | Why it matters later |
|---|---|---|
| Out-of-scope schedule | A written list with rates and thresholds | Decides the largest share of the spend the headline rate leaves out |
| Incident terms | Which response activities are covered work | Applies on the day you have least leverage |
| Reporting commitment | A named document, produced on a stated schedule | Insurers and auditors ask for dated records |
| Duty split | A table of who does what, if co-managed | Keeps software updates from belonging to nobody |
| Exit terms | Deliverables, format, sequence, fixed cost | Agreed at signature, or negotiated at your weakest moment |
A documented baseline makes every quote easier to check. A scoped IT and security assessment produces one, and the findings are yours whatever you do with them. The breakdown of what managed IT costs in New York covers the pricing side in detail, and the comparison of MSP, MSSP and MDR sorts out which of the three you are buying.