January arrives with a natural reset point. Many SMEs look back over the past year and decide it is time to assess whether their IT support is actually delivering what they need — or whether they have simply grown accustomed to the gaps.

Choosing an IT support company is not a technical exercise. It is a commercial decision about who gets access to your systems, your data, and your users' daily experience. The question most SMEs ask is practical: which provider can be trusted to run the technology my business depends on?

The answer does not come from a sales pitch. It comes from asking the right questions and checking whether a provider's standards, certifications, and operating practices match the threats your business actually faces.

This guide is written for owner-managed SMEs with roughly 10 to 25 people, many of whom rely on Microsoft 365 as their core platform. It focuses on the security evaluation lens — the standards, practices, and evidence that separate a provider that simply fixes problems from one that reduces the likelihood of those problems occurring in the first place.

Does the provider hold relevant security certifications?

Certifications are not proof of competence on their own. They are indicators of a provider's baseline investment in security knowledge and operational discipline. When evaluating potential IT support companies, certification should be one of your first questions — not the only one.

Cyber Essentials: what it means for your provider

Cyber Essentials is the UK government-recommended certification scheme developed by the National Cyber Security Centre. As the NCSC states, it is "the minimum standard of cyber security" that every organisation should achieve. The scheme covers five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection.

If an IT support provider themselves is not Cyber Essentials certified, that is worth understanding. It suggests they have not formally validated their own baseline security against a government-backed standard. Ask whether they hold Cyber Essentials, and at what level. Cyber Essentials Plus goes further by including independent technical testing of the controls, rather than relying solely on self-assessment.

According to IASME, the NCSC's official Cyber Essentials Delivery Partner, Cyber Essentials certification starts at £320 plus VAT for the self-led route. This is a modest investment for an organisation that manages technology on behalf of other businesses.

Other relevant certifications

Depending on the scope of services you require, additional certifications may be relevant:

• ISO 27001 — an international standard for information security management systems. It is more rigorous than Cyber Essentials and involves external audit, but it is less common among SME-focused providers due to cost and complexity.

• Microsoft Certified Partner status — indicating the provider has demonstrated competency in Microsoft cloud platforms, particularly Microsoft 365, which is the core platform for most SMEs.

• Cyber Essentials certified supplier status — increasingly important if you work with larger organisations that require their suppliers to hold Cyber Essentials. The NCSC's Supply Chain Playbook explicitly recommends that organisations make Cyber Essentials a minimum-security requirement for their suppliers.

What security standards does the provider operate to?

Certifications tell you about the provider's own security. Security standards tell you about the environment they create and maintain for your business. These are different questions, and both matter.

Does the provider standardise or customise?

A provider that claims to support "whatever you have" may sound accommodating. In practice, it often means they have no defined target state and no consistent way to judge whether your environment is secure or supportable.

Standardisation in IT support does not mean every client looks identical. It means the provider has a defined standard for the parts of an environment that should not be left to chance. Those parts typically include:

• User identity and access management

• Device configuration and patching cadence

• Endpoint protection tools and their settings

• Backup coverage and restore testing

• Security monitoring and alerting

• Joiner, mover, and leaver processes

When a provider can describe exactly what is standardised and what varies by business, it signals that they have operational discipline. When they cannot, the relationship tends to depend on inherited setups, individual engineer memory, and local workarounds. Over time, that pattern creates drift.

How does the provider handle security exceptions?

Every business has edge cases — legacy applications, specialised hardware, or workflows that do not conform to the standard. The question is whether exceptions are managed or simply tolerated.

A provider with strong security standards will document exceptions. They will be identified, assessed for risk, assigned an owner, reviewed against a defined timeline, and paired with a remediation plan. An unsupported device does not remain in service indefinitely because replacing it is inconvenient. A special-case permission does not persist because nobody wants to revisit it.

If a provider cannot explain how exceptions are documented and reviewed, it is usually a sign that inconsistency is absorbed rather than reduced.

How does the provider respond to incidents?

Security standards are one thing. Incident response is another. How a provider reacts when things go wrong reveals more about their capability than how they describe their capabilities on a website.

What support models do providers offer?

IT support providers typically offer one of several support models. Understanding the differences is essential, because model affects both responsiveness and security outcomes.

Break-fix — The provider responds to reported issues but does not proactively monitor systems. There is no agreement on response times, and issues may only be discovered when a user reports them. This model offers no security monitoring and limited accountability.

Remote-only managed services — The provider monitors systems remotely and responds to alerts. This is the most common model among SME-focused providers. It covers the majority of incidents that can be resolved remotely but requires onsite visits for certain hardware or physical network issues.

Hybrid managed services — Remote monitoring combined with scheduled onsite support. This model may include regular onsite reviews, hardware checks, and physical network management. It is relevant where onsite presence matters — for example, where local servers, print infrastructure, or physical security systems are in scope.

Unlimited support — Some providers market "unlimited" support, meaning helpdesk access without predefined hour allocations. The practical question is not whether hours are unlimited, but whether the provider's staffing model can deliver timely responses at scale. A large client base with fixed staffing inevitably creates variability in response times, regardless of how the service is labelled.

What are realistic response-time expectations?

Market conventions vary widely, and no single figure applies across all providers. Rather than quoting industry benchmarks, the more useful approach is to ask a provider to explain their response model in concrete terms.

Specific questions to ask include:

• How are incidents prioritised — and what determines priority?

• What is the expected response time for a critical incident versus a routine request?

• What happens if an issue cannot be resolved remotely — how quickly can onsite support be deployed?

• How are response times tracked and reported to the client?

A provider with a defensible response model will answer these questions clearly. One that cannot likely has no internal framework for prioritisation or tracking.

What evidence and reporting does the provider produce?

One of the most common mistakes SMEs make is confusing reassurance with evidence. A provider that says "everything is fine" may be telling you exactly what they want you to hear. What you need is reporting that proves the environment is being maintained and that security controls are functioning.

What should reporting cover?

At a minimum, reporting from an IT support provider should cover:

• Patch compliance across managed devices

• Backup success and failure rates, plus restore test results

• Security monitoring health — alerts, incidents, and their resolution

• Open risks and outstanding remediation items

• Changes to the environment — new devices, user accounts, configuration changes

Regular reporting also creates a record. If there is a dispute, an incident, or an insurance question, verbal reassurance is less useful than a documented history of what was happening in your environment and how the provider responded.

How often should reporting be reviewed?

Frequency depends on the size and complexity of the environment. For a 10-to-25 seat SME, monthly reporting with quarterly strategic reviews is a common pattern. The reporting rhythm should create a visible record — not a series of disconnected snapshots that make it difficult to see trends over time.

How does the provider govern admin access?

This is one of the most important evaluation points when choosing an IT support company. Your provider will have the ability to administer your Microsoft 365 tenant, your users, your devices, your security controls, and your data. That access must be narrow, deliberate, and reviewable.

In practical terms, this means four things:

1. Privileged access should be limited to what is actually needed for the agreed work.

2. Administrative accounts should be separate from everyday user accounts.

3. Privileged access should be strongly protected — typically with multi-factor authentication.

4. Partner access should be reviewed regularly and removed when it is no longer needed.

Microsoft's current guidance emphasises these principles. The Guest Directory Access Provider (GDAP) model exists specifically to support more granular, time-bound partner access rather than broad standing permissions.

For an SME evaluating a provider, the practical questions are straightforward:

• Who has admin access to our tenant right now?

• Are those privileges proportionate to the work currently being done?

• Are admin accounts separated from normal user accounts?

• Is MFA enforced on all privileged accounts?

• How frequently is partner access reviewed, reduced, and removed?

If a provider cannot answer these questions clearly, they may be doing useful work, but they are not giving you visibility over who has keys to the most sensitive parts of your environment.

How does the provider handle Microsoft 365 security?

Most 10-to-25 seat SMEs use Microsoft 365 as their core platform. How a provider manages security within that environment is a direct indicator of their technical capability.

Identity protection

Identity is now the primary attack surface for most SMEs. Phishing remains the most common initial vector, and multi-factor authentication is the single most effective defence. Microsoft recommends MFA for all user accounts. The NCSC's guidance for small businesses includes the same recommendation.

A provider who takes security seriously will ensure MFA is enabled for every account with access to business data, and will specifically address service accounts and privileged accounts that are often overlooked.

Email security

SPF, DKIM, and DMARC records are not optional extras. They are foundational email authentication controls that prevent attackers from sending messages that appear to come from your domain. Many SMEs have never had these configured, and even those that have often find that the records are incomplete or have lapsed.

A competent provider will verify these records during onboarding and monitor them for changes.

Backup independence

Microsoft 365 retention and recycle-bin features are not a substitute for an independent backup copy. They are platform-level safeguards, not an owned, verifiable recovery point.

The core question is storage independence and ransomware reachability. If your backup data lives inside the same Microsoft 365 tenant, it is reachable by the same credentials and the same threat actor. An independent backup — held outside the tenant — is what makes a backup genuinely resilient.

The NCSC's small-business guidance includes backup and recovery as a fundamental area of attention. The practical question for any SME is whether that backup can actually be used when needed, and whether it exists outside the tenant that ransomware would compromise.

Questions to ask before signing with an IT support provider

You do not need to become a security expert to evaluate a potential provider. The following questions are designed for a non-technical business owner to ask during the selection process:

What security standards do you operate to, and can you show me the evidence?

Look for a specific answer — a defined baseline, documented controls, and a way of tracking whether those controls are maintained. Vague answers about "best practice" are not evidence.

Are you Cyber Essentials certified, and at what level?

This is a baseline question. If they are not, ask why. If they are, ask whether it is the self-assessed level or Plus with independent technical testing.

How do you standardise the core controls across your clients?

A clear answer describes which controls are standard, which vary by business, and how exceptions are handled.

How is privileged access to client environments governed?

The answer should mention separate admin accounts, MFA on privileged access, and regular review of partner access.

What does your reporting look like, and how often do you review it with clients?

If they cannot describe what you would actually receive, they have not thought this through from the client's perspective.

How would you handle a ransomware event in our environment?

You do not need a technical deep dive. You need to know whether they have a documented response process, whether they have dealt with this kind of incident before, and whether they can clearly explain what would happen in the first hours.

What happens if there is a security incident involving our data?

This is not about predicting whether an incident will occur. It is about understanding the provider's incident response framework, their communication process, and what support they offer during an event.

Making the decision

Choosing an IT support company is not about finding the cheapest provider or the one that promises the most features. It is about finding a provider whose security standards, operating practices, and response capability match the size and complexity of your business.

The providers that serve 10-to-25 seat SMEs well share common characteristics. They standardise the controls that matter, they govern admin access tightly, they produce evidence rather than reassurance, and they can clearly explain how they respond when things go wrong.

If your current provider struggles to answer the questions in this guide, or if you are still evaluating options, a structured assessment of your current setup against recognised security standards will clarify both where you stand and what a better arrangement would look like.

Frequently asked questions

Why focus on security standards rather than just support response times?

Response time measures how quickly a provider reacts to a problem. Security standards measure how likely the problem was to occur in the first place. A provider that responds quickly to repeated failures is managing symptoms, not reducing risk. Evaluating both gives you a clearer picture of value.

Is Cyber Essentials enough for an SME's IT support provider?

Cyber Essentials is the government-recommended baseline. It covers the five controls that block the most common internet-based attacks. Whether it is "enough" depends on your sector, your data sensitivity, and any contractual requirements from larger clients or insurers. For many SMEs it is a sufficient baseline, but a provider's own security standards should reflect their commitment beyond the minimum.

Can a small IT support provider be as security-focused as a large one?

Size is not the same as capability. A small provider that operates to a defined security baseline, holds relevant certifications, and has a structured approach to incident response can deliver stronger security outcomes than a large provider with inconsistent practices. The operating model matters more than the headcount.

How often should an SME review their IT support provider's security standards?

At minimum, security standards should be reviewed during your annual service review — the same time you review costs, contract terms, and performance. If there is a significant change in your threat environment, a regulatory requirement, or a security incident, an additional review is warranted.

What is the relationship between Cyber Essentials and insurance requirements?

Many UK insurers now require or incentivise Cyber Essentials certification. Some offer premium reductions for certified businesses. However, certification alone does not guarantee insurance acceptance — underwriters may also assess your broader security posture. The NCSC recommends that SMEs check with their insurer early in the process.