Personal service
SmallerHigh
Mid-SizedHigh
LargerVariable
Buyer's Guide
Compare Business IT Support: Questions to Ask IT Companies
Don't compare IT providers by what they promise. Compare what they can prove.
Most proposals sound similar. The differences often appear in what happens after an alert, who actually answers the phone, what security is included, how risks are reported, how much your organisation matters to the provider and what happens when something goes wrong.
Every IT proposal seems to promise responsive support, proactive monitoring, cybersecurity, strategic advice, dedicated account management, 24x7 capability and expert engineers. The same words can describe very different services.
The difference between IT providers is often hidden in what happens after the promise.
This guide helps you compare business IT support providers across the areas that materially affect employee experience, risk, security, business continuity, cost, governance and future capability. It is designed for organisations comparing several providers, reviewing current service quality, replacing an MSP or preparing an IT support tender.
Start with the right brief
Start with the service model you actually need.
Before you compare managed IT support providers, agree the operational responsibility you want them to take. You cannot compare proposals fairly until every provider is pricing the same responsibility.
Fully Managed
Provider takes agreed operational ownership.
Co-Managed
External specialists strengthen an internal IT team.
Multi-Supplier
Several providers require clear coordination and ownership.
You cannot compare proposals fairly until every provider is pricing the same responsibility.
Fully managed and co-managed delivery describe how work is divided with your team. Your wider sourcing model determines how technology suppliers are coordinated and who owns dependencies between them. Read more about choosing an IT outsourcing model or how co-managed IT supports internal teams before asking providers to price the same brief.
Organisational fit
Does the size of your IT provider matter?
The right provider is not necessarily the biggest or the cheapest. Provider size affects personal attention, skills, process maturity and adaptability. For organisations with approximately 50 to 500 users, the right-sized MSP can be almost as important as the services themselves.
You need enough scale for resilience and specialist skills, but not so much scale that your organisation becomes just another account.
Small, mid-sized and larger MSPs can all be excellent in the right circumstances. These ranges are indicative rather than industry-standard definitions. Use the profiles to understand practical trade-offs, not as a ranking.
Around 30 to 100 staff
Mid-Sized MSP
Can combine personal service with resilient teams, broader skills and mature processes. Often a strong fit for organisations with 50 to 500 users.
Typical strengths
- Broader engineering resource pools and specialist teams
- Mature core processes and stronger operational systems
- Potential for 24x7 capability while retaining senior access
- Flexibility, personal attention and capacity for complex projects
Potential trade-offs
- Some specialist areas may still require trusted partners
- Process maturity and innovation vary between providers
- A provider can resell standard products without meaningful integration
- Growth can expose inconsistency if processes are not genuinely repeatable
Best suited to
- Organisations with roughly 50 to 500 users
- Teams needing managed services, security and specialist capability
- Businesses that still value senior accessibility and flexibility
Questions to ask
- How much access would we have to senior technical and company leadership?
- What have you built, automated or improved yourselves rather than simply reselling?
- Can you demonstrate that processes remain consistent as the business grows?
Typical characteristics, not guarantees. Individual providers vary considerably.
Resource resilience
SmallerLower
Mid-SizedStrong
LargerVery strong
Specialist breadth
SmallerLimited
Mid-SizedStrong
LargerVery broad
Flexibility
SmallerHigh
Mid-SizedHigh
LargerLower
Process maturity
SmallerVariable
Mid-SizedStrong
LargerVery strong
Senior access
SmallerHigh
Mid-SizedHigh
LargerLower
Ability to support complexity
SmallerVariable
Mid-SizedStrong
LargerVery strong
Standardisation requirement
SmallerLower
Mid-SizedModerate
LargerHigher
Operational investment
SmallerVariable
Mid-SizedStrong
LargerVery strong
Client significance
SmallerHigh
Mid-SizedHigh
LargerLower
Relationship test
How Important Would You Be to Your MSP?
A provider may have impressive capabilities, but those capabilities only matter if your organisation receives meaningful access to them.
How many managed-service customers do you have?
Where would we sit by size?
Who would own our relationship?
Who would know our environment?
Would we have access to senior technical specialists?
How frequently would our roadmap be reviewed?
The question is not simply how big the provider is. It is how much of that organisation will genuinely be available to you.
Evidence framework
15 Things to Compare Before Choosing an IT Provider
Every provider can make a promise. Use this framework to ask what happens in practice, request evidence and identify answers that still need investigation.
01Access to engineers
What to compare
Who actually begins troubleshooting, the technical capability at first contact and the routes available to employees.
Ask this
When an employee calls or starts a chat, do they reach an engineer who can begin helping, or someone who simply logs and passes on the request?
Good evidence might include
- Direct engineer access through phone, chat and portal channels
- Clear escalation paths and technical ownership at first contact
- A worked example of a complex issue being handled
Be cautious if
The provider discusses response times but cannot explain who begins technical troubleshooting.
02Out-of-hours support
What to compare
Who answers outside office hours, what they can resolve and which users and events are covered by the agreed fee.
Ask this
At 10pm, who answers, what can they resolve, and which users and incidents are included in our fee?
Good evidence might include
- Real 24x7 engineer capability where required
- Clear entitlement, escalation and chargeable-response rules
- A definition of what is monitored and what triggers immediate action
Be cautious if
The phrase 24x7 is used without explaining whether it is staffed support, monitoring or an on-call arrangement.
03Proactive prevention
What to compare
Whether device health, events and trends become owned corrective work before users report disruption.
Ask this
Show us a recent issue you identified and corrected before a user reported it. What triggered the intervention?
Good evidence might include
- Device-health analysis and event monitoring
- Root-cause investigation with an assigned engineer
- Remediation verification and evidence of fewer repeated issues
Be cautious if
The provider says it monitors everything 24x7 but cannot show how monitoring becomes action.
04Infrastructure and network management
What to compare
Asset ownership, dependencies, support status, firmware, capacity and action on meaningful infrastructure alerts.
Ask this
If a backup internet connection fails while employees can still work, who notices, who acts and how do you verify resilience has been restored?
Good evidence might include
- An accurate asset inventory and dependency mapping
- Ownership of firmware, warranties, capacity and configuration changes
- A trace from alert through remediation to verification
Be cautious if
The provider can list monitoring tools but cannot identify ownership of the underlying estate.
05Joiners, movers and leavers
What to compare
The workflow linking approvals, device readiness, provisioning, access removal, exceptions and proof of completion.
Ask this
Show us how you would prepare a new starter and prove that a leaver's access has been removed across the agreed systems.
Good evidence might include
- Defined workflow, HR approvals and exception handling
- Device readiness and access-provisioning evidence
- Access removal, session revocation and completion records
Be cautious if
The process relies on email requests with no reliable record of whether every action was completed.
06Security scope
What to compare
Which protections and remediation activities are included, what needs deployment and what enhanced services cost extra.
Ask this
Which security protections and remediation activities are included as standard, what needs deployment, and what costs extra?
Good evidence might include
- Endpoint protection, patching and vulnerability management
- Identity protection and critical vulnerability response
- A clear distinction between security licences and managed processes
Be cautious if
Security is described through product names alone, without an accountable operational process.
07The provider's own security
What to compare
Privileged access, customer separation, management systems, controlled integrations and the practical blast radius of an incident.
Ask this
If one of the systems you use to manage us were compromised, what would prevent the attacker reaching our users or servers?
Good evidence might include
- Least privilege and segmented management systems
- Independent monitoring, strong identities and controlled integrations
- A documented incident process with limited customer blast radius
Be cautious if
The provider can discuss customer security but has no clear answer about security of its own privileged tooling.
08Accreditations
What to compare
Current certification, the scope it covers and how controls translate into the service your organisation will receive.
Ask this
Can we inspect your current certifications and their scope, and understand how those controls apply to our service?
Good evidence might include
- Current ISO 27001 and Cyber Essentials Plus certificates where relevant
- Relevant Microsoft credentials and demonstrable operational application
- A clear explanation of scope, limitations and evidence
Be cautious if
A logo is presented as proof without current certificates, scope or operational context.
09Transparency and service quality
What to compare
Whether service views make risks, recurring problems, security, actions and commercial responsibilities visible.
Ask this
Show us the service view we would receive. How would we identify unresolved risks, recurring problems and overdue actions?
Good evidence might include
- Live dashboards and clear measurement periods
- Visible service, security, asset, patching and vulnerability data
- Actions, ownership and commercial visibility
Be cautious if
Reporting consists only of ticket counts or selectively chosen percentages without context.
10Governance and ownership
What to compare
Named relationship ownership, regular governance, escalation, risk registers, roadmaps and coordination across suppliers.
Ask this
When an issue involves several suppliers, who coordinates resolution and keeps us informed?
Good evidence might include
- A named relationship owner and regular governance cadence
- Risk register, roadmap and action ownership
- Supplier coordination and practical escalation examples
Be cautious if
Responsibility falls between suppliers, with no one accountable for keeping the business informed.
11Projects and change
What to compare
What turns support work into a project, how scope is discovered and what can change an agreed fixed price.
Ask this
What turns a service request into a chargeable project, and what could change an agreed fixed price?
Good evidence might include
- Defined boundaries, discovery and written assumptions
- Pricing, testing, documentation and handover
- User communication and support readiness after go-live
Be cautious if
The provider offers a fixed price without explaining scope, dependencies or change-control assumptions.
12Strategy and future capability
What to compare
Who develops the technology roadmap, how business priorities shape recommendations and access to relevant specialist skills.
Ask this
Who develops our technology roadmap, and can you demonstrate how a client's business priorities changed your recommendations?
Good evidence might include
- Named consultant, roadmap and budget planning
- Technology lifecycle, security priorities and AI readiness
- Examples that connect business objectives to action and review dates
Be cautious if
Strategy is limited to an annual sales review or generic product presentation.
13Recovery and continuity
What to compare
Restore testing, recovery objectives, supplier dependencies, communication arrangements and actual learning after a test.
Ask this
Show us a recent recovery test. What worked, what failed and what changed afterwards?
Good evidence might include
- Restore tests and recovery objectives matched to the business
- Supplier dependencies, alternative channels and communication planning
- Documented improvements after lessons learned
Be cautious if
A successful backup job is treated as evidence that the business can recover.
14Total cost
What to compare
The realistic annual cost, including recurring fees, onboarding, starter devices, visits, projects, licences, renewals and exit.
Ask this
Price a realistic year against our requirements. Which events could still generate additional invoices?
Good evidence might include
- A common annual scenario priced consistently
- Clear treatment of onboarding, projects, renewals and exit charges
- Written scope statements, exclusions and commercial assumptions
Be cautious if
The lowest monthly rate is compared without checking the costs that sit outside it.
15Transition, exit and evidence
What to compare
Takeover discovery, documentation, readiness, supplier coordination, administrative account transfer, data ownership and comparable references.
Ask this
What must be verified before takeover, and what happens to our accounts, configurations, documentation and data if the relationship ends?
Good evidence might include
- Discovery and readiness checklists with named owners
- Documentation, supplier coordination and account-transfer process
- Comparable client references and a transparent exit process
Be cautious if
Onboarding is described as a project plan but the provider cannot explain transition readiness or exit arrangements.
Pattern interrupt
Three Awkward Questions Every MSP Should Be Able to Answer
These questions do not reward polished claims. They reveal evidence, ownership and the operating model beneath the proposal.
Show me something you fixed before one of your users reported it.
This reveals whether proactive means more than monitoring dashboards.
Show me our current technology and security risks.
If important risks exist, they should be visible, owned and tracked.
If one of your management platforms were compromised tonight, what prevents the attacker reaching us?
This reveals how seriously the MSP treats privileged access and supply-chain risk.
Quote comparison
Two IT Quotes Can Look Almost Identical
Support, monitoring, security, backup and strategy can appear in almost every proposal. The important difference is what each service actually does.
Provider A might mean
Endpoint antivirus licence, Microsoft defaults and basic patching.
Provider B might include
Managed endpoint protection, SOC, vulnerability management, identity monitoring, incident response and critical remediation process.
Comparing feature names is easy. Comparing what the service actually does is harder and much more important.
For a closer view of prevention in practice, read what happens to your IT while nobody is watching and the warning signs your IT provider can see.
Interactive decision aid
Compare Your IT Providers
Score up to three providers against the same evidence standard. The names and scores stay only in this browser while you are viewing this page. This is a decision aid, not an independent certification.
No personal data is required. Provider names are editable locally and are not sent to analytics. For organisational fit, ask whether the provider has enough depth and specialist capability for your needs while remaining accessible and flexible enough for your organisation to matter.
01Support
Evidence scoreCurrent Provider
Provider 2
Provider 3
02Proactive prevention
Evidence scoreCurrent Provider
Provider 2
Provider 3
03Infrastructure management
Evidence scoreCurrent Provider
Provider 2
Provider 3
04Security
Evidence scoreCurrent Provider
Provider 2
Provider 3
05Provider security
Evidence scoreCurrent Provider
Provider 2
Provider 3
06Governance
Evidence scoreCurrent Provider
Provider 2
Provider 3
07Transparency
Evidence scoreCurrent Provider
Provider 2
Provider 3
08Projects and change
Evidence scoreCurrent Provider
Provider 2
Provider 3
09Resilience
Evidence scoreCurrent Provider
Provider 2
Provider 3
10Strategy
Evidence scoreCurrent Provider
Provider 2
Provider 3
11Organisational fit
Evidence scoreCurrent Provider
Provider 2
Provider 3
Current Provider
0 / 330 of 11 categories scored
Strongest areas
No areas demonstrated with evidence yet.
Biggest uncertainties
Support, Proactive prevention, Infrastructure management, Security and 7 more
Provider 2
0 / 330 of 11 categories scored
Strongest areas
No areas demonstrated with evidence yet.
Biggest uncertainties
Support, Proactive prevention, Infrastructure management, Security and 7 more
Provider 3
0 / 330 of 11 categories scored
Strongest areas
No areas demonstrated with evidence yet.
Biggest uncertainties
Support, Proactive prevention, Infrastructure management, Security and 7 more
Make uncertainty useful
If You Don't Know, Ask for Evidence
Uncertainty is useful. It tells you what to investigate before signing.
Don't know whether vulnerabilities are managed?
Show us our current critical vulnerabilities and their remediation status.
Don't know whether backups are tested?
When was the last successful restore test and what was actually restored?
Don't know whether devices are patched?
Show us current patch compliance and any exceptions.
Don't know whether the provider is proactive?
Show us examples of issues corrected before users reported them.
Don't know whether the provider has enough depth?
Who covers our key technical areas when the usual engineer is unavailable?
Decision summary
What Good Managed IT Should Look Like
Responsive when something breaks
People can get effective help quickly.
Proactive before it does
The provider identifies deterioration and risk before users experience the consequences.
Secure by default
Core controls are embedded, vulnerabilities are managed and security incidents have defined response processes.
Transparent enough to prove it
Customers can see service quality, risks, actions and performance.
Strategic enough to improve it
The provider helps the organisation evolve rather than simply maintaining the status quo.
Go deeper
Keep your comparison evidence-led.
Use these related resources at the point they are useful, rather than treating a provider comparison as a one-off exercise.
Create an IT Tender
Turn the questions in this guide into clear requirements, evidence and evaluation criteria.
Choose an IT Outsourcing Model
Decide which responsibilities should stay in-house and which should be owned externally.
Assess Provider Security
Examine privileged access, operational tooling and the security controls behind a managed service.
Review Service Quality
See the evidence that makes service performance, action and customer experience visible.
Test Recovery Readiness
Move from backup completion to credible recovery and continuity evidence.
Explore Co-Managed IT
Understand how an external partner can extend an internal IT team's capability.
Make the decision defensible
Use the Answers to Make a Defensible Decision
Before evaluating proposals, agree the essential requirements, desirable capabilities, evidence required and commercial assumptions. For each provider, classify answers as demonstrated, documented, verbal only or unclear.
Retain the evidence, proposal clarifications, pricing assumptions, scope statements and exclusions. An impressive demonstration still needs to match the service description and commercial terms you eventually sign.
If you are running a formal tender, use our guide to creating an IT tender document to turn these questions into requirements, responsibilities and an evaluation framework.
Put Wavex Through the Same Test
Ask us the same difficult questions in this guide.
We will show you how our support, security, governance, transparency, proactive management and technical consultancy work in practice. At around 60 people, Wavex is large enough to provide specialist teams, operational resilience and 24x7 capability, while remaining small enough for clients to have meaningful access to senior technical and company leadership.
Frequently asked questions