How to choose an IT support company: 8 questions you can check

1. If nothing works on Monday at 9, how fast do you help?

Email is down for the whole company, invoices won't print, a laptop won't start. This is the part of IT everyone feels, so start here. Ask: "What hours can I call you? What do you do if the whole company is stuck? Do I talk to someone different every time? And what if the person who knows us is on holiday?"

A good answer gives exact hours and says clearly which problems go first. Check the website too: some say "24/7" while the phone line keeps office hours. Ask for the resolution time in the contract, not just promised on the phone. And find out how many people work there: an IT company can really be just one person.

Our answer: IT support runs Monday to Friday, 09:30–18:00, by phone and email. Problems that stop work go first, and our average resolution time for priority IT incidents is under one hour. Support is closed on Saturdays and Sundays, but security alerts are watched then too (see question 2). You're answered by the colleagues who look after your network and computers every day, so you don't have to explain everything from scratch. We are a team of 17, based in Bucharest. Network, server and account configurations are written down, so nothing depends on one colleague's memory. Most support happens remotely, and we come on site when the situation calls for it.

2. Who sees an attack at night or at the weekend?

An employee clicks a fake email on Friday evening, and someone gets into their account. If the alert is only read on Monday morning, the attacker has had the whole weekend.

Ask: "Who watches the alerts at night and at weekends: your team, a partner company, or nobody?" All three exist. A partner company is fine, but you need to know which one: if your company falls under NIS2 or works for large clients, you'll be asked for the list of companies with access to your data.

Our answer: for security monitoring we work with specialist analysts who watch alerts around the clock, including nights, weekends and public holidays. We name that partner in the security questionnaires you fill in for your clients. To you, we answer for everything.

3. When an attack happens, how fast do you stop it?

Many companies say "we respond in 15 minutes". Ask: "15 minutes until what?" Until an automatic email, until someone looks at the alert, or until the attack is stopped? Those are three very different things.

A good answer says where the clock starts and stops. And a serious company won't promise you'll never be attacked.

Our answer: 8 minutes on average, from the alert to the attack being stopped. Cleaning the machine and getting it running again come after and aren't part of the 8 minutes. We don't promise you'll never be attacked.

4. If I lose my data, can I really get it back?

Almost every IT company says "we do backups", meaning a copy of your data. The problem shows up on the day you need that copy: it's old, it's incomplete, or it won't open.

Ask: "When did you last restore something from a backup, as a test? Can you show me the proof?" A good answer comes with a date and a result.

Our answer: backups run automatically: continuously for Microsoft 365, daily for servers, and employees' computers are included. We check them daily, and if a backup didn't run, the support team gets an alert. We run regular restore tests, automatic and manual, with the evidence attached: we actually restore data from the backup, so we know it works. Microsoft 365 backups are kept separately from Microsoft, in a data center in the European Union.

5. What do I pay each month, and what costs extra?

A cheap subscription can turn out expensive if a lot is billed separately. Ask: "What's included in the subscription? What costs extra, and how do I find out beforehand?" Get the answer in writing and ask about security directly: some companies include it, others charge extra.

Ask, too, what you get besides fixes: does someone regularly tell you how your IT is doing and what should come next?

Our answer: a monthly subscription, with the cost fixed in your contract. It includes IT support for your employees, management of your computers, servers and Microsoft 365, the five layers of security and backups. Security training and full event logging are optional extensions. We regularly go through the state of your IT, and you get recommendations, reports and a plan for the next steps. Anything outside the subscription, such as a new project, is estimated up front and only starts once you approve.

6. How do I know my company's data is in good hands?

Your IT company sees everything: emails, contracts, payroll. Ask: "Do you have a security certification? Can you give me the number so I can check it?"

The certification that matters here is ISO/IEC 27001. It shows the company has written rules for how it handles data and that an external auditor checks them. A logo on a website proves nothing. You can look up the certificate number yourself in a public database, such as IAF CertSearch. Ask how often the auditor comes, too.

Our answer: we are ISO/IEC 27001:2022 certified, certificate RO231109006, verifiable in IAF CertSearch, and externally audited every year.1

7. What does the first month look like?

Moving from one IT company to another is the most delicate moment: someone hands over the passwords, someone else takes them, and it's easy for something to get lost along the way. Ask: "What do you start with? Who talks to our current provider, me or you?"

A good answer has a clear order and doesn't leave you to be the go-between for the two companies.

Our answer: we start with what's critical, work mostly remotely and coordinate the handover with your current provider ourselves. Your company comes to us with its data and its own Microsoft 365 licenses. We agree the timing together at the assessment, because it depends on your infrastructure, number of users and equipment.

8. If I want to leave, what do I get?

Ask before you sign, not when you leave: "How long does the contract tie me in? How much notice do I give? What do I get when I leave?"

Whatever happens, a few things must belong to your company, not the provider: the main Microsoft 365 admin account, your website domain, the licenses, and the admin passwords for your servers and network.

If you already have an IT company, ask yourself today: do I know where the password for our main Microsoft 365 account is, and who has it? Our guide to the accounts of an employee who leaves shows what gets lost when only one person knows everything.

Our answer: the contract has no fixed term. It stays in force until either side decides to end it, with 30 working days' written notice. Network, server and account configurations are written down and handed over to you.

The questions, to take to the meeting

• "How fast do you help if nothing works?"Exact hours, in the contract, and how many of you there are.
• "Who sees an attack at night?"Their own team or a partner company, named.
• "How fast do you stop an attack?"From which moment to which moment.
• "When did you last restore data from a backup?"With the proof.
• "What do I pay on top of the subscription?"In writing, with security stated explicitly.
• "What's your ISO/IEC 27001 certificate number?"Checked by you.
• "What do you start with in the first month?"And who talks to your current provider.
• "What do I get if I leave?"Notice period, passwords, documentation.

Frequently asked questions about choosing an IT support company

What certification should an IT support company have?

The most relevant one is ISO/IEC 27001, the standard for information security. It shows the company has written rules for how it handles data and that an external auditor checks them. Ask for the certificate number and look it up yourself in a public database, such as IAF CertSearch.

Is it normal for an IT support company to work with partners?

Yes, especially for watching security alerts around the clock. What matters is that you know who they are, so you can list them in the security questionnaires your clients send you, and who answers to you.

How long does an IT support contract last?

It depends on the provider. Ask about the minimum term and notice period before signing. With us, the contract has no fixed term and can be ended with 30 working days' written notice.