Quick Answer

The 5 most important questions: What is your contractual SLA? Is on-site included? Are you a Microsoft Partner? Is cyber security included? Can you provide references? Full list below.

— IT Support Procurement Guide · UK Businesses · 2026

20 QUESTIONS TO ASK
AN IT SUPPORT COMPANY
BEFORE YOU SIGN ANYTHING

Choosing the wrong IT support company is an expensive mistake. Use these 20 questions — covering SLAs, pricing, certifications, cyber security, and references — to evaluate any IT support provider before committing.

Response Times & SLAsPricing & ContractsTechnical CapabilityCyber SecurityReferences
⏱

Response Times & SLAs

1.What is your response time SLA for critical IT issues?

The most important question. Any IT company worth hiring should have a contractual SLA — ideally 15 minutes for critical issues. "We try to be quick" is not an acceptable answer.

✓Good answer: "Critical issues: 15-minute response. High priority: 1 hour. Standard: 4 hours — all guaranteed in your contract."
✗Avoid: "We aim to respond as quickly as possible" or vague promises with no contractual commitment.

2.Is this SLA guaranteed in the contract, or just a target?

Many IT companies quote impressive response times in their marketing but don't actually commit to them in writing. If it's not in the contract, it's meaningless.

✓Good answer: Yes — the SLA is written into your service agreement with defined remedies if breached.
✗Avoid: "We aim for..." or "Usually we..." without contractual backing.

3.Do you have 24/7 support, and what does that actually mean?

"24/7 support" can mean anything from a monitored emergency line to a full overnight helpdesk. Understand what's included and what costs extra.

✓Good answer: A clear explanation of what 24/7 covers — is it monitoring only, an emergency line, or a full helpdesk? What's included in your package vs an add-on?
✗Avoid: "Yes" without explaining what 24/7 actually means in practice.
£

Pricing & Contracts

4.Is the pricing all-inclusive, or what's excluded?

Many IT companies quote low per-user fees and then charge separately for on-site visits, after-hours support, major projects, and hardware. Always understand the full cost.

✓Good answer: A clear itemised breakdown of what's included vs what incurs additional charges. On-site visits, project work, after-hours calls — everything clarified upfront.
✗Avoid: "£X per user per month" with no explanation of what triggers additional charges.

5.Do you charge for on-site visits?

On-site visit charges can significantly increase your monthly IT spend. A good managed IT provider includes on-site visits at no additional charge.

✓Good answer: On-site visits across your area are included at no extra charge within your managed IT package.
✗Avoid: "Call-out charges apply" or vague answers about "reasonable travel costs".

6.What is the minimum contract term?

Most IT support contracts are 12 months minimum. Some providers lock customers into 3-year terms. Understand what you're committing to and what the exit terms are.

✓Good answer: A clear explanation of minimum term (typically 12 months), notice period, and what happens if you need to leave early.
✗Avoid: Vague answer or a 36-month minimum term with no reasonable exit clause.
🔧

Technical Capability

7.Are you a Microsoft Partner, and what certifications do you hold?

Microsoft Partner status means the IT company has passed Microsoft's technical assessments and has certified engineers. It also means you get proper support rather than workarounds.

✓Good answer: Yes — Microsoft Solutions Partner (or similar). Can explain the specific solutions designations relevant to your needs.
✗Avoid: "We use Microsoft products" without any partner status or certified engineers.

8.Do you hold Cyber Essentials certification yourselves?

An IT company recommending Cyber Essentials to clients should hold it themselves. If they don't, that's a red flag about their own security posture.

✓Good answer: Yes — we hold Cyber Essentials (or Cyber Essentials Plus) and can show you our certificate.
✗Avoid: "We advise clients on Cyber Essentials" without holding it themselves.

9.How many engineers do you have, and are they UK-based?

Understaffed IT companies can't maintain SLAs. Offshore helpdesks can create communication challenges and may not understand UK compliance contexts.

✓Good answer: A clear answer about team size, UK locations, and how cover is maintained for holidays and sickness.
✗Avoid: Vague answers, very small teams (1–2 people), or primarily offshore operations.
🔒

Cyber Security

10.Is cyber security included, or is it a bolt-on extra?

Some IT companies treat security as an upsell. In 2026, basic security (EDR, email security, MFA) should be standard — not an extra charge.

✓Good answer: Core security (EDR, email filtering, MFA, patching) is included in your managed IT package. Advanced security (SOC, penetration testing) is available as an upgrade.
✗Avoid: "We offer a security add-on for an extra £X/user" for basic security controls.

11.Can you help us achieve Cyber Essentials certification?

Many industries and public sector contracts now require Cyber Essentials. Your IT company should be able to guide you through the process — not just point you to the IASME website.

✓Good answer: Yes — we manage the full process including gap assessment, remediation, and IASME submission. We have a 100% first-time pass rate.
✗Avoid: Vague answer or "we can point you in the right direction".
⭐

References & Track Record

13.Can you provide references from similar businesses?

Any IT company can claim expertise in your sector. References from clients with similar size and industry are the best way to verify the claim.

✓Good answer: Readily provides 2–3 client references in a similar sector or size. Comfortable with you contacting them directly.
✗Avoid: Reluctant to provide references or only offers testimonials on their own website.

14.What is your client retention rate?

High client retention is the best indicator of quality. If businesses keep leaving, there's a reason. A good IT company should have 85%+ annual retention.

✓Good answer: "Our annual client retention is X%. Here's why clients stay and what causes the small percentage that leave."
✗Avoid: Unable or unwilling to answer this question.
— Red Flags

6 red flags to watch for
when choosing an IT company

No contractual SLA
If they won't commit to response times in writing, they can't be held accountable when they're slow.
Unusually low pricing
IT support below £15/user/month typically means offshore helpdesk, no on-site coverage, or hidden charges.
No Microsoft Partner status
For Microsoft 365 management, partner status means certified engineers and proper support channels.
Can't provide client references
Reluctance to provide references is the single biggest warning sign in IT procurement.
No Cyber Essentials themselves
If your IT company doesn't hold Cyber Essentials, they're not practicing what they preach.
3-year minimum contracts
Long lock-in periods favour the supplier, not you. 12 months is standard; 36 months requires very strong justification.
— How Coreitech Answers

How Coreitech answers
the key questions

Contractual SLA15-minute critical remote response — written into every contract. On-site same-day across London.
All-inclusive pricing£25/user/month — on-site visits, unlimited helpdesk, monitoring, patching, M365 management. No hidden charges.
Microsoft Partner statusYes — certified Microsoft Solutions Partner. CSP-direct licensing, certified engineers.
Cyber EssentialsWe hold Cyber Essentials Plus ourselves and deliver 100% first-time pass rate for clients.
Cyber security includedEDR, email security, MFA, patching — all included in managed IT. Not a bolt-on.
Client referencesReadily available. 200+ London and UK clients. 4.9★ Google rating. 90%+ annual retention.

Ready to evaluate
Coreitech?

Ask us any of the questions above. We'll give you a straight answer — and provide client references in your sector.