20th October 2025 | Assurix

For a small or medium-sized business, choosing the right IT provider is one of the most important decisions you’ll make. The wrong choice can mean downtime, spiralling costs, failed audits, or even closure. The frustrating part? Every IT company promises the same things “secure,” “proactive,” “24/7.”

The only way to cut through the noise is to focus on proof. Not claims, not badges evidence. Ask these five questions, insist on evidence that covers all their clients (not just hand-picked examples), and you’ll quickly spot the difference between marketing and maturity.

1) How will you keep every client resilient day to day, not just on paper?

What to look for (proof):

Patching reports for the last 30-90 days showing updates applied on time across all clients and devices.
Backup restore test results for every client, including dates and outcomes.
Response-and-resolution reports for the last quarter covering all clients, not just an SLA promise.

Why it matters: Most IT disasters aren’t exotic cyberattacks. They’re basics done inconsistently: patches skipped, backups untested, tickets left unresolved. Resilience is a habit across all clients, not a one-off success story.

Cautionary example: One SME only discovered their backups hadn’t worked for three months after ransomware hit. With no clean restore point, they lost months of invoices and customer data, costing more than the ransom itself. This happens when no one verifies that backups actually restore.

Independent proof shortcut: Some providers carry live-evidence trustmarks, such as Assurix, which verify patching, backup, and response standards across their entire client base. If something slips and isn’t fixed quickly, the badge is paused. That way, you see proof that’s always current.

2) How will you reduce incidents over time?

What to look for (proof):

Quarterly review packs that show recurring issues and the steps taken to prevent them.
An example of a root-cause fix where a repeating issue was solved and the trend went down across multiple clients.

Why it matters: Paying for the same problems again and again is wasted money. A good provider should demonstrate how they reduce issues, not just close tickets.

Cautionary example: A retailer kept losing Wi-Fi in their busiest store. Their IT provider “fixed” it each time but never investigated the cause. Customers walked out, sales dipped, and eventually the owner had to pay a new firm to sort it properly. That’s the cost of working with a provider who only patches symptoms.

3) How do you protect access to our systems and data?

What to look for (proof):

Multi-factor authentication (MFA) enabled for every user and admin.
A short summary of how privileged accounts are controlled and approved.
A simple report showing how many devices are encrypted and protected.

Why it matters: Most breaches start with stolen passwords or a misplaced laptop. Without strong access and device controls, one mistake can compromise the whole business.

4) What happens when things go wrong?

What to look for (proof):

A clear one-page incident process that shows who triages, who you call, and how priorities are handled.
A recent post-incident review, with lessons learned and actions completed.

Why it matters: The middle of a crisis is the worst time to find out your IT provider is improvising their response. You want to see that they’ve handled incidents before and improved because of them.

Cautionary example: An SME failed a compliance audit after their IT provider told them “don’t worry, we’re secure” but couldn’t provide evidence. The result was costly remediation work, delayed contracts, and awkward conversations with a major client. Assumptions and promises don’t pass audits, evidence does.

5) Who outside your company checks that you do all this?

What to look for (proof):

Independent verification that’s based on live data, not just certificates from last year.
If they don’t have a trustmark, ask how often they’re independently audited and how they keep evidence up to date.

Why it matters: Point-in-time certificates age quickly. Your risk doesn’t. Independent, ongoing verification is the fastest way to separate proof from promises.

Example: Assurix is a neutral trustmark that uses live data from an MSP’s systems to confirm they’re actually meeting standards day to day. If they miss something critical and don’t fix it fast, the badge is paused. That’s a simple, visible signal that they stay accountable long after the contract is signed.

Green flags vs red flags

Green flags:

Shows live dashboards or recent exports without hesitation.
Talks about reducing incidents, not just answering tickets.
Names the people who will manage your account and how to escalate.
Offers independent, continuous verification (e.g. Assurix).

Red flags:

Can’t produce basic reports: MFA coverage, patching, restore tests.
“Unlimited support” with no performance measures.
Same problems recur with no root cause analysis.
Evidence months out of date or hard to get hold of.

A 30-day plan to choose the right provider

Week 1 - Shortlist: Write your top three outcomes (fewer incidents, audit-ready, faster onboarding). Get referrals and shortlist three providers who can show independent proof.

Week 2 - Evidence: Ask each for patching reports, backup restore test results, MFA coverage, response-time reports, and a recent incident review.

Week 3 - Meet the team: Speak directly to the service lead and security lead who’ll run your account. Review a sample quarterly review pack and their 90-day onboarding plan.

Week 4 - Decide: Score each provider on proof, people, and plan. If two providers are close, choose the one with continuous independent verification.

Copy-paste email to send providers

Hi, we’re reviewing IT providers. Please send:

1. Patching compliance (last 90 days, across all clients)

2. Backup restore test results with dates and outcomes

3. MFA and privileged access summary

4. Response and resolution times (last quarter)

5. One recent post-incident review with actions

If you hold an independent, live-evidence trustmark such as Assurix, please include that too.

Final thoughts

Choosing an IT provider is really choosing a risk partner. The right one will prove across their entire client base that they keep businesses resilient and reduce incidents over time. Don’t settle for claims or outdated certificates. Ask for proof, and prefer providers who can show it live, every day.

Find out more about Assurix at http://www.assurix.com/