January is the month when owner-managed businesses in Sussex and Kent tend to look back at the previous year and decide whether their IT support is still doing the job. That makes it a useful moment to test your current provider — or a critical moment if you are interviewing new ones.

The right questions cut through vendor marketing and reveal how a provider actually runs a 10–25 person business. The following questions draw from things we hear in Security Triage Calls and what the National Cyber Security Centre recommends for defensible SME operations.

What Security Controls Do You Apply by Default?

Cybersecurity is no longer optional for SMEs. The NCSC treats every small business as a target: the government's Cyber Security Breaches Survey consistently shows that a substantial proportion of small businesses experience at least one cyber incident each year.

A provider you can trust should answer this clearly. They should be able to describe the controls applied to every device and every user account without your having to piece together a list from sales decks:

• Endpoint protection. Does the provider deploy endpoint detection and response (EDR) on every Windows or Mac device, or do they install standard antivirus and call it sufficient?

• Patch management. How often are operating systems and key applications patched? Is it automated, and what happens when a patch breaks something?

• Multi-factor authentication. Is MFA enforced for email, remote access, and admin accounts? Can the provider explain which accounts are protected and how?

• Email security. What filtering, safe-link scanning, and phishing defence do they apply to your Microsoft 365 environment?

If the answer is "we install antivirus and that covers you," you have a red flag. Modern threats like ransomware do not require a traditional antivirus bypass — they propagate through stolen credentials and unpatched systems. A provider's security posture should reflect that reality.

At Infinite Cloud IT, the IT Security Baseline includes SentinelOne EDR with 24/7 SOC monitoring, automated patch management, enforced multi-factor authentication, and Microsoft 365 email security. These are not upsells — they are the starting point for every client. That is the difference between standardisation and guesswork.

How Do You Handle Microsoft 365 Security?

Most SMEs of our size run on Microsoft 365. The platform is capable and widely understood. But default Microsoft 365 settings do not constitute a security plan.

Ask your provider whether they actively configure Microsoft 365 security settings or leave them at Microsoft's defaults. Key areas include:

• Shared mailbox and guest access controls. Who can invite external users? What access do shared mailboxes have?

• Device compliance policies. What happens when an employee brings a personal device to work, or a laptop goes missing?

• Retention and deletion policies. How long are deleted emails recoverable? Can former employees re-access data?

• Administrator account management. How many people have global admin access? Is it protected by MFA and break-glass procedures?

These are not advanced topics. They are baseline configuration decisions that determine whether your Microsoft 365 environment is secure or merely installed.

What Is Your Backup Strategy — and Where Is the Data Stored?

Backups are where many IT support arrangements reveal their weakest link. A provider may manage your IT brilliantly and still leave your data exposed through a poor backup approach.

Ask:

• What do you back up? Only servers, or also Microsoft 365 data, line-of-business applications, and endpoints?

• Where are backups stored? Storing backup data inside the same Microsoft 365 tenant is not true independence — a ransomware event that compromises your credentials can affect everything within that tenant. A genuinely independent backup sits outside your organisation's tenant, protected by separate credentials.

• How often do you test restores? A backup that has never been restored is a hope, not a guarantee. At minimum, ask whether test restores happen quarterly and whether results are documented.

• What are your RTO and RPO targets? Recovery Time Objective (how quickly can you be operational) and Recovery Point Objective (how much data can you afford to lose) should be defined in writing, not recalled from memory during an incident.

The NCSC emphasises that backups must be stored separately from the primary environment and tested regularly. Any provider that cannot answer these questions concretely is worth reconsidering.

What Response Times Do You Guarantee — and Where Are They Written?

Service Level Agreements sound dry until you are on the phone at 9 AM on a Monday when your booking system is down. At that point, the SLA is the only thing protecting you.

Ask your provider to show you their SLA in writing. It should define:

• Critical outages (core systems down, revenue-impacting). Typical response: 15–30 minutes.

• High-priority issues (email down, key application broken). Typical response: within 1–2 hours.

• Normal requests (user setup, password resets, printer issues). Typical response: same business day.

Be wary of providers who describe response times in general terms ("we aim to respond quickly") without measurable commitments. A written SLA with defined tiers is a signal that the provider takes response time seriously.

Also ask: What happens if you miss your SLA? Good providers have service credits or other remedies built in. If they cannot describe one, that is a commercial vulnerability waiting to surface.

What Is Your Onboarding Process?

Onboarding is where a provider's operating model becomes visible. Two providers can deliver identical tools and produce very different experiences. The difference lies in how systematically they transition a new client.

A structured onboarding process should include:

1. Discovery. Understanding your current environment, who uses what, and what is broken.

2. Baseline assessment. Measuring your current setup against an agreed security standard — covering identity, devices, patching, protection, and backup.

3. Standardisation. Bringing every device and account into your agreed baseline. No exceptions.

4. Stabilisation. Resolving inherited issues before introducing new automation.

5. Automation. Enrolling devices, configuring policies, setting up monitoring and reporting.

6. Handover. Confirming with you that everything is working as expected.

Some providers skip straight to step 5. They install tools on a messy environment, blame subsequent issues on "legacy problems," and keep you paying for remediation that should have been part of onboarding.

If a provider offers a flat monthly fee but tells you that onboarding will cost extra, ask why. A provider confident in their process should build the standard onboarding into the transition period.

How Do You Report to the Business Owner?

You did not hire an IT provider so that you would need to understand ticket numbers and patch compliance rates. You hired them so that your team works reliably and securely. But you still need visibility into whether that is happening.

Ask how your provider communicates with you:

• Reporting cadence. How often do you receive a report covering incidents, security events, patch status, and backup results? Monthly is typical.

• Annual review. Do they perform a yearly assessment of your environment, flagging lifecycle issues, security gaps, and budget planning?

• Escalation path. If a critical issue is not being resolved, who do you escalate to? Can you reach a decision-maker directly?

• Strategic guidance. Do they offer brief roadmap conversations about upcoming technology changes, licence renewals, or hardware refreshes?

A provider that only contacts you when something is broken is running a break-fix operation in managed clothing. You want a provider that contacts you proactively with useful information.

Can You Show Me How Your Operating Model Differs from Typical MSPs?

This is the question most providers cannot answer honestly because many of them do not have a differentiated operating model — they have a tool inventory.

The real difference between a managed IT provider and a vendor selling software packages is whether the provider has an opinion about how your environment should be configured.

An opinionated operating model means:

• Standardised stack. Every client gets the same core tools — device management, endpoint security, monitoring, backup, and monitoring — configured to the same baseline. No bespoke patchwork.

• Enforced standards. Devices that do not meet the security baseline are brought into compliance or removed from scope. There is no permanent "partly managed" state.

• All-inclusive pricing. Security, backup, and monitoring are built into the monthly fee, not sold as separate line items.

• Predictable operations. You know what you are paying for and what to expect when something goes wrong.

If you can ask this question and get a clear answer that does not involve comparing feature lists, you are talking to a provider with an actual operating philosophy.

What Does Your Pricing Include — and What Is Not?

Pricing transparency is a practical question that reveals whether a provider's commercial model aligns with yours. A flat monthly per-user fee should cover:

• Unlimited business-hours support

• All security tools (EDR, email security, firewalls)

• Backup and restore testing

• Device monitoring and management

• Joiner/leaver automation

• Standard ticket resolution

What should not be included in that fee — or should be flagged as optional:

• Significant project work (office moves, major migrations)

• Specialist line-of-business applications that require vendor-level support

• After-hours emergency support (unless explicitly agreed)

Be cautious of providers who present backup or MFA as "add-ons" on top of a base fee. These are now standard expectations for any reasonable IT operation, not premium extras.

Why Is This Topic Relevant Right Now?

January is traditionally when owner-managed businesses reflect on the previous year and consider whether their IT arrangements still serve them. New contracts are signed, annual reviews happen, and there is a natural window to test whether your provider is still the right fit.

Even if you are not planning to switch, asking these questions of your current provider — without leading them to the "correct" answers — will tell you whether you genuinely understand how your IT environment is being managed.

FAQs

Can my IT provider help us achieve Cyber Essentials certification? Cyber Essentials is the UK government's recommended minimum security standard for SMEs. A provider that manages your IT environment to a clearly defined security baseline — covering identity, devices, patching, malware protection, and backup — will naturally align with most Cyber Essentials requirements. The certification itself requires an assessed audit through an approved certifier, which is a separate process. A good provider will prepare your environment so that the assessment is a verification of existing controls rather than a discovery of new gaps.

What is the difference between a Security Triage Call and a full assessment? A Security Triage Call is a high-level (red/amber/green) view of where your environment stands against a defined security standard and whether there is a good fit with our operating model. It is a conversational assessment — free and verbal — designed to give you clarity on your current baseline. A full Security Baseline Review is a deeper, paid engagement that produces a written, prioritised roadmap of findings. The fee for the paid review is credited when you onboard with us.

Do you support businesses that are not yet using Microsoft 365? Our primary focus is businesses that use Microsoft 365 as their core platform — including those migrating from Google Workspace. We support Google Workspace environments but do not position Google Workspace as a primary identity or collaboration platform. Our standardisation approach is optimised for M365-native estates.

How quickly can you onboard a new client? Typical onboarding takes 4–6 weeks from agreement to full operation, depending on the complexity of the existing environment. This includes discovery, baseline assessment, standardisation, stabilisation, and automation. A Security Triage Call can give you a clearer picture of the likely timeline for your specific situation.

Starting with a clear picture of your IT environment is the smartest thing you can do before making any IT decision.

Whether you are reviewing your current provider this January or interviewing new ones, these questions will help you separate structured operators from vendors that sell tools and call it a service.

Book a Security Triage Call to get a high-level view of where your environment stands — no commitment required.