Virginia IT Guide
Home / Guides

How to Choose an IT Provider: 20 Questions to Ask

Updated October 22, 2026

Choosing an IT provider is a bit like choosing an accountant: you’re trusting them with systems you don’t fully understand, and switching later is a hassle. These questions help you compare providers on what actually matters, and make sure you keep control of your own business.

Before you talk to anyone

Write down:

  • How many people and computers you have, and how many locations
  • The software your business can’t run without
  • Any compliance requirements (HIPAA, FTC Safeguards Rule, PCI, cyber insurance conditions)
  • What’s frustrating about your current setup
  • What you’d like to spend, roughly

This keeps the conversation on your needs instead of their sales deck.

Questions about service

  1. What are your response times, and are they in the contract? “We’re very responsive” isn’t a commitment.
  2. How do we get help? Phone, email, portal? Do we reach a technician or a ticket queue?
  3. Who will actually work on our account? Will we have a consistent technician or account manager?
  4. What’s included onsite, and how far away are your technicians? For a Central Virginia office, ask how long it takes to get someone to your door.
  5. What happens after hours and on weekends?
  6. Can you give us references from businesses like ours, similar size and industry, ideally ones that have been clients for a few years?

Questions about security

  1. What security tools are included? Look for endpoint detection and response (EDR), email filtering, MFA enforcement, and patching.
  2. Who watches security alerts, and when? A tool nobody monitors at 2 a.m. doesn’t help at 2 a.m.
  3. How do you secure your own access to our systems? IT providers are a favorite target because one breach reaches many clients. Ask about MFA on their tools and how they limit technician access.
  4. How are our backups set up, and how often do you test restores? See our backup guide.
  5. Can you help with our compliance requirements? If you need HIPAA risk assessments or a written information security plan, ask whether they’ve done them and whether it costs extra.
  6. Do you carry cyber liability and errors-and-omissions insurance?

Questions about cost and contract

  1. What exactly is included, and what’s billed extra? Get it in writing. See how managed IT is priced.
  2. What’s your hourly rate for out-of-scope work and projects?
  3. How long is the contract, and how do we cancel? Watch for long auto-renewals and steep early-termination fees.
  4. Is there an onboarding fee, and what does it cover?

Questions about ownership and exit

These are the questions people forget, and the ones that matter most when a relationship ends badly.

  1. Who owns our Microsoft 365 (or Google) tenant, domain name, and software licenses? The answer should be: you do. Your domain should be registered in your business’s name.
  2. Will we have our own admin credentials? You should hold a break-glass admin account, stored securely, that doesn’t depend on the provider.
  3. What documentation will you keep, and will we get a copy? Network diagrams, passwords, license lists, and vendor contacts.
  4. What happens to our data and access when we leave? Look for a written offboarding commitment.

Red flags

  • They won’t put response times or what’s included in writing.
  • They register your domain or Microsoft tenant under their own company name.
  • They push you to replace everything before they’ve assessed anything.
  • Security is an optional add-on rather than part of the base service.
  • Long contracts with auto-renewal and large termination fees.
  • No references from clients similar to you.

Switching providers without drama

  1. Secure your own admin access first. Before you announce the change, make sure you hold a global admin login for Microsoft 365 or Google, your domain registrar, and your firewall.
  2. Request documentation in writing, citing your contract’s offboarding terms if it has them.
  3. Overlap if you can. A few weeks where the new provider can learn the environment while the old one is still responsive avoids surprises.
  4. Change passwords and remove the old provider’s access once the handover is done. This includes their remote-management software on every computer.

Questions about this guide, or something we got wrong? Email [email protected].

Related

How Much Do Managed IT Services Cost in Virginia? Common pricing models for managed IT, what's typically included, typical ranges for small businesses, and how to compare quotes fairly. Backup and Disaster Recovery for Small Businesses What a real backup looks like, the 3-2-1 rule, how fast you could recover, and a practical setup for a small Virginia office. Cybersecurity for Virginia Small Businesses: Where to Start The handful of security controls that stop most attacks on small businesses, in priority order, with rough costs and what to do first. Microsoft 365 for Small Business: Which Plan, and How to Set It Up Right Business Basic vs. Standard vs. Premium explained, the settings most small businesses miss, and when Google Workspace is the better fit.