Cybersecurity has become an essential consideration when choosing an IT service provider.
Businesses depend on email, cloud platforms, financial software, customer databases and connected devices to complete everyday work.
If these systems are compromised, the consequences can extend beyond a temporary technical inconvenience.
An incident may interrupt operations, expose confidential information, create financial losses or damage customer relationships.
Yet many businesses choose IT support based primarily on cost, response times and general technical assistance.
These factors matter, but they do not provide a complete picture of how well a provider can manage cybersecurity risks.
A company that repairs computers and resolves software problems may not necessarily offer comprehensive security monitoring, incident response or data protection services.
Before signing an agreement, businesses should ask specific questions about the provider's security capabilities.
The objective is to understand what is included, how responsibilities are divided and what happens when something goes wrong.
Why Cybersecurity Should Be Part of IT Provider Selection
IT providers often have access to important business systems.
They may manage user accounts, configure networks, maintain servers and support cloud applications.
This access creates a position of considerable trust.
A provider's security practices can affect the protection of the systems it manages.
Businesses therefore need to assess more than technical competence.
They should understand how the provider protects its own access, manages security responsibilities and responds to threats.
Cybersecurity should be discussed before the service agreement is finalised.
Waiting until an incident occurs can reveal gaps that are difficult and expensive to address.
What Cybersecurity Services Do You Actually Provide?
The first question should establish the scope of the service.
Some IT providers offer basic security support as part of general maintenance.
Others provide dedicated managed security services.
These arrangements are not interchangeable.
Ask which cybersecurity activities are included in the proposed agreement.
Clarify whether the provider handles antivirus management, firewall administration, security monitoring, vulnerability assessments and incident response.
Some services may require separate subscriptions or specialist partners.
The provider should be able to explain the difference between routine IT support and dedicated cybersecurity services.
Avoid relying on broad statements that systems will be kept secure.
The agreement should identify specific responsibilities.
How Do You Assess Our Current Security Risks?
A suitable cybersecurity service should begin with an understanding of the business.
Different organisations face different risks.
A small professional practice may be particularly concerned about confidential client information.
An online retailer may depend heavily on payment systems and website availability.
A manufacturer may need to protect connected production equipment.
Ask how the provider identifies relevant risks.
The assessment may include reviewing devices, software, user access, network configurations and existing security controls.
It should also consider operational requirements.
A provider that recommends the same solution to every business without understanding its systems may overlook important weaknesses.
Will You Conduct an Initial Security Assessment?
Before taking responsibility for an IT environment, a provider should understand its condition.
An initial assessment can help identify outdated software, unsupported devices and configuration problems.
It may also reveal unnecessary administrator privileges or inadequate backup arrangements.
Ask whether an assessment is included in the onboarding process.
Find out what systems will be reviewed.
Clarify whether the business will receive a written report.
The report should distinguish between urgent risks and longer-term improvements.
It should also identify which recommendations are included in the service and which require additional expenditure.
How Do You Protect Business Email Accounts?
Email is a common route for phishing, fraudulent payment requests and account compromise.
Businesses should ask how the provider protects their email environment.
Relevant measures may include multifactor authentication, appropriate account permissions and email security controls.
The provider should also review domain authentication settings where appropriate.
Ask how suspicious sign-in activity is identified.
Find out what happens if an employee's account is compromised.
A strong response should address both technical containment and the possibility that fraudulent messages have been sent to customers or colleagues.
Email security requires ongoing attention rather than a once-off configuration.
Do You Require Multifactor Authentication?
Multifactor authentication adds protection beyond a password.
It can reduce the risk of unauthorised access when credentials are stolen.
Ask whether the provider recommends or requires multifactor authentication for important business systems.
Administrator accounts, remote access and cloud services deserve particular attention.
The provider should explain which authentication methods are supported.
It should also have secure procedures for account recovery.
Businesses should avoid arrangements where critical access depends entirely on one employee's personal device.
Authentication should be practical without weakening security.
How Do You Manage User Access and Permissions?
Employees need access to the systems required for their work.
However, unnecessary permissions can increase security exposure.
Ask how the provider manages user accounts and access levels.
Find out whether administrator privileges are restricted.
The provider should also explain how access is changed when employees move between roles.
Staff departures require particular attention.
Former employees should not retain access to business systems after their authorised relationship ends.
Ask whether access reviews are conducted periodically.
The provider should be able to describe a clear process for granting, changing and removing permissions.
How Do You Secure Administrator Accounts?
Administrator accounts often have extensive control over business systems.
If compromised, they can provide an attacker with access to sensitive information or important configurations.
Ask how the provider protects these accounts.
Relevant controls may include separate administrator identities, strong authentication and restricted permissions.
The provider should also explain how privileged activity is recorded or monitored.
Shared administrator passwords can create accountability problems.
Where emergency access arrangements are necessary, they should be documented and protected.
A provider should not rely on unrestricted administrator access for every routine support task.
How Do You Protect Your Own Remote Access?
IT providers frequently use remote management tools to support customers.
These tools are convenient but can create significant security risks if poorly controlled.
Ask how the provider secures remote access to client systems.
Find out whether access requires multifactor authentication.
Ask how permissions are restricted and whether remote sessions are logged.
The provider should also explain what happens when one of its technicians leaves the company.
Businesses should understand whether the provider uses a central management platform across multiple customers.
Security weaknesses in that platform could affect more than one organisation.
What Endpoint Protection Do You Use?
Endpoints include laptops, desktops and other devices connected to business systems.
These devices can become entry points for malicious software and unauthorised access.
Ask what protection the provider recommends.
Clarify whether the service includes centrally managed antivirus or more advanced endpoint security tools.
The provider should explain how alerts are reviewed.
It should also describe the response when suspicious activity is detected.
Installing security software is not the same as actively monitoring it.
Businesses need to understand whether alerts are investigated and by whom.
How Do You Manage Software Updates and Security Patches?
Outdated software can contain vulnerabilities that attackers may exploit.
Ask how the provider manages operating system and application updates.
Find out whether updates are monitored centrally.
The provider should explain how critical security patches are prioritised.
Some updates may require testing before installation.
Others may need urgent attention because of an actively exploited vulnerability.
The process should balance security with operational stability.
Ask how the provider handles devices that are no longer supported by their manufacturers.
Unsupported systems may require replacement or additional risk controls.
How Do You Secure Our Network and Firewall?
Network security helps control communication between business devices and external systems.
Ask whether the provider manages the organisation's firewall and network configuration.
Find out how firewall rules are reviewed.
The provider should also explain how guest Wi-Fi is separated from internal business systems where appropriate.
Remote access arrangements deserve attention.
Businesses should avoid exposing sensitive services directly to the internet without suitable protection.
Ask how network changes are documented.
A provider should understand the existing environment before making changes that could interrupt essential operations.
Do You Monitor for Suspicious Activity?
Cybersecurity protection is not limited to preventing attacks.
Businesses also need to identify suspicious activity when it occurs.
Ask what monitoring services are included.
These may involve endpoint alerts, unusual sign-in activity, firewall events or other security information.
Clarify whether monitoring takes place only during office hours or outside normal business hours.
Find out who investigates alerts.
The provider should explain how serious events are escalated.
An automated alert is useful only when someone is responsible for reviewing and responding to it.
How Quickly Will You Respond to a Security Incident?
General IT support response times may not be suitable for serious cybersecurity incidents.
A compromised administrator account or suspected ransomware infection can require urgent attention.
Ask whether the provider has separate response arrangements for security emergencies.
Find out what qualifies as a critical incident.
Clarify whether emergency support is available after hours.
The agreement should distinguish between initial acknowledgement, investigation and actual resolution.
No provider can reasonably guarantee that every incident will be resolved within a fixed period.
However, it should be able to explain its response procedures and service commitments.
Do You Have a Documented Incident Response Plan?
A cybersecurity incident requires coordinated decisions.
The provider may need to isolate affected devices, preserve evidence and restore essential systems.
Ask whether it follows a documented incident response process.
The plan should identify responsibilities and escalation procedures.
It should also address communication with the business.
Some incidents may require involvement from legal advisers, insurers or specialist investigators.
The provider should explain how these parties can be coordinated.
A clear process can reduce confusion when decisions need to be made quickly.
What Happens if We Experience Ransomware?
Ransomware can interrupt business operations by encrypting files or disrupting systems.
Some attacks also involve theft of information.
Ask the provider how it would respond to a suspected ransomware incident.
The response should address containment, investigation and recovery.
The provider should explain how backups would be protected from the affected environment.
It should also understand the importance of preserving relevant evidence.
Businesses should be cautious of anyone promising that ransomware incidents can always be resolved quickly.
Recovery depends on the nature of the attack, the affected systems and the available preparations.
How Are Our Backups Managed?
Reliable backups are essential for business continuity.
Ask which systems and information are included in the backup arrangements.
Clarify how frequently backups are created.
Find out where they are stored and how access is protected.
Businesses should understand whether backup copies are isolated or otherwise protected against compromise of the main environment.
Retention periods should also be discussed.
A provider should explain how backup failures are identified.
The existence of a backup service does not automatically mean that every important file is protected.
Do You Test Backup Restorations?
A backup that cannot be restored may provide little practical value.
Ask how often the provider tests recovery procedures.
Find out whether tests include important business applications as well as individual files.
The provider should explain how successful restoration is confirmed.
Businesses should also discuss recovery time expectations.
Restoring a small document may take minutes.
Recovering a complete server or complex application may take considerably longer.
The provider should help the business understand what level of disruption is realistic.
What Are Our Recovery Time and Data Loss Expectations?
Business continuity planning should consider how quickly essential systems need to return after an incident.
A recovery time objective describes the targeted period for restoring a system or service.
A recovery point objective describes the maximum targeted amount of data loss measured in time.
These objectives help guide backup and recovery arrangements.
Ask whether the provider can support the business's requirements.
A company processing frequent transactions may need different recovery arrangements from one that updates records occasionally.
More demanding recovery requirements may involve additional costs.
The important point is to agree on realistic expectations before a failure occurs.
How Do You Protect Cloud Applications?
Many businesses use cloud services for email, file storage, accounting and customer management.
These services may include built-in security features.
However, the customer and its IT provider may still be responsible for account configuration, permissions and other controls.
Ask which cloud platforms the provider manages.
Clarify how administrator access is secured.
Find out whether activity logs and security alerts are reviewed.
The provider should also explain which data protection responsibilities belong to the cloud vendor and which remain with the business.
Cloud hosting does not remove the need for security management.
Can You Help Us Meet POPIA Requirements?
South African businesses handling personal information need to consider the Protection of Personal Information Act.
POPIA places obligations on responsible parties regarding the lawful processing and protection of personal information.
An IT provider can support technical and organisational safeguards.
However, appointing an IT provider does not transfer every legal responsibility away from the business.
Ask how the provider assists with access controls, data protection and incident management.
Clarify whether it acts as an operator when processing personal information on the business's behalf.
Relevant contractual arrangements should be considered.
Legal compliance may also require advice beyond the provider's technical expertise.
How Would You Handle a Personal Data Breach?
A personal data breach can create legal, operational and reputational consequences.
Ask what happens if personal information is accessed, disclosed or lost without authorisation.
The provider should explain how it would investigate the incident and preserve relevant records.
It should also identify who would notify the business.
Under POPIA, certain security compromises require notification to the Information Regulator and affected data subjects, subject to applicable legal requirements.
The provider should understand its role in supporting these obligations.
Businesses should not assume that the IT provider will independently manage every notification or legal decision.
Responsibilities should be agreed in advance.
Do You Provide Employee Security Awareness Training?
Technical controls cannot prevent every security incident.
Employees may encounter phishing messages, fraudulent invoices or suspicious requests for confidential information.
Ask whether the provider offers security awareness training.
Training should reflect the risks employees encounter in their actual work.
For example, finance teams may need guidance on fraudulent banking detail changes.
Customer service employees may need to recognise attempts to obtain account information.
Training should be practical and repeated when appropriate.
The provider should also encourage a reporting culture in which employees can raise concerns promptly.
How Do You Assess Vulnerabilities?
Vulnerability assessments help identify weaknesses in systems and software.
Ask whether the provider performs regular assessments.
Clarify which devices, applications and network services are included.
The provider should explain how findings are prioritised.
Not every identified weakness presents the same level of risk.
The business should receive understandable information about significant findings and recommended actions.
Ask whether remediation is included in the service fee.
Some providers charge separately for assessment work or major corrective projects.
Do You Offer Penetration Testing?
Penetration testing involves authorised attempts to identify and demonstrate security weaknesses.
It differs from routine vulnerability scanning.
Not every business requires the same frequency or scope of testing.
Ask whether the provider offers penetration testing directly or works with a specialist.
The scope should be agreed before testing begins.
Testing must be authorised and planned to reduce operational disruption.
The business should receive a report explaining the findings and their significance.
It should also understand who is responsible for addressing identified weaknesses.
How Do You Secure Mobile Devices?
Employees increasingly access business information through smartphones and tablets.
Some devices belong to the company.
Others may be personally owned.
Ask how the provider manages mobile access.
Relevant controls may include device encryption, screen locks and approved application management.
The provider should explain what happens when a device is lost or stolen.
Businesses should also understand the privacy implications of managing personal devices.
A suitable policy should balance protection of business information with legitimate employee privacy interests.
What Is Your Approach to Remote and Hybrid Work?
Remote work can introduce additional security considerations.
Employees may connect from home networks or use devices outside the office.
Ask how the provider protects remote access.
Find out whether it requires approved devices, secure authentication and appropriate endpoint protection.
The provider should also explain how access is removed when it is no longer required.
Public Wi-Fi use and personal device arrangements may need specific policies.
Remote work security should reflect how employees actually perform their duties.
A policy that is impractical may encourage workarounds.
How Do You Manage Third-Party Security Risks?
Businesses often depend on software vendors, hosting companies and other technology suppliers.
These relationships can create security dependencies.
Ask how the IT provider evaluates services it recommends.
Find out whether it reviews security documentation and relevant contractual terms.
The provider should also explain how it manages access granted to external vendors.
Third-party connections should not remain active indefinitely without a legitimate purpose.
However, no provider can guarantee that every external service is free from risk.
The objective is to identify important dependencies and manage them appropriately.
How Do You Protect Our Data From Your Own Staff?
An IT provider's employees may have access to sensitive client systems.
Businesses should ask how this access is controlled.
Find out whether permissions are assigned according to job responsibilities.
Ask how access is removed when technicians leave the provider.
The provider should explain its authentication, logging and internal security procedures.
Confidentiality agreements may form part of the arrangements.
However, contractual promises should be supported by practical controls.
A trustworthy provider should be comfortable discussing how it manages privileged access.
What Security Qualifications and Experience Does Your Team Have?
Cybersecurity work requires relevant knowledge and experience.
Ask about the qualifications and practical experience of the people who will manage the business's systems.
Some providers employ dedicated security specialists.
Others rely on general IT technicians or external partners.
Neither arrangement should be judged solely by job titles.
The provider should explain which skills are available and when specialist assistance is required.
Relevant certifications can provide useful context, but they do not guarantee service quality.
Experience with businesses of similar size and complexity may also be valuable.
Can You Provide Relevant Client References?
References can help businesses assess a provider's reliability.
Ask whether the provider can share examples of work with organisations that have similar requirements.
The provider may need to protect client confidentiality.
However, it should be able to discuss its general experience and service approach.
Where references are available, ask about communication, reliability and incident handling.
Consider whether the provider delivers the services described in its proposal.
A provider that performs well in routine support should also be assessed for its ability to manage serious security concerns.
What Security Reports Will We Receive?
Cybersecurity services should provide meaningful visibility.
Ask what reports the provider supplies.
These may cover security alerts, patching status, backup performance and outstanding risks.
Reports should be understandable to business decision-makers.
A long technical document is not necessarily useful if it does not explain what requires attention.
The provider should distinguish between resolved issues and outstanding concerns.
It should also identify actions that require business approval or additional funding.
Regular reporting supports accountability and helps management understand the organisation's security position.
How Are Security Recommendations Prioritised?
Businesses rarely have unlimited cybersecurity budgets.
A provider may identify several areas requiring attention.
Ask how it decides which issues should be addressed first.
Prioritisation should consider the likelihood and potential impact of a problem.
The importance of the affected system also matters.
For example, a serious weakness affecting financial records may deserve more urgent attention than a minor issue on an isolated device.
The provider should explain the reasoning behind its recommendations.
This helps businesses make informed spending decisions rather than treating every proposed purchase as equally urgent.
What Is Included in the Monthly Fee?
Cybersecurity service proposals can be difficult to compare.
One provider may include monitoring, endpoint protection and backup management in a monthly package.
Another may charge separately for these services.
Ask for a clear breakdown of what is included.
Clarify whether software licences are part of the price.
Find out how incident response, after-hours assistance and major recovery work are charged.
Businesses should also ask about setup fees and minimum contract periods.
The lowest monthly price may not represent the lowest total cost.
A useful comparison considers both the scope of protection and the financial terms.
What Happens When We End the Contract?
Businesses should understand how their systems and information will be handled if they change providers.
Ask what happens to administrator accounts, remote management tools and security subscriptions.
The provider should explain how access will be transferred or removed.
Clarify whether the business retains ownership and control of its data, domains and relevant service accounts.
The agreement should address the return or deletion of information where appropriate.
A structured handover reduces the risk of losing access to essential systems.
Exit arrangements are easier to agree on before a contract begins than during a dispute.
Will You Help Us Create a Cybersecurity Improvement Plan?
Cybersecurity is an ongoing responsibility.
A once-off installation of security software is not enough to address changing risks.
Ask whether the provider can help develop a practical improvement plan.
The plan should identify important weaknesses, recommended controls and reasonable implementation priorities.
It should reflect the organisation's budget and operational requirements.
Some improvements may be urgent.
Others can be scheduled over time.
A clear plan helps businesses understand what they are paying for and what risks remain unresolved.
Warning Signs When Comparing IT Providers
Certain responses should prompt further questions.
A provider that guarantees complete protection against cyberattacks may be making an unrealistic promise.
Another warning sign is an unwillingness to explain security responsibilities.
Businesses should be cautious when proposals rely on vague descriptions without identifying included services.
Poor documentation and unclear access arrangements can also create problems.
A provider should not dismiss questions about backups, incident response or data protection.
Cybersecurity involves uncertainty, and responsible providers acknowledge limitations.
Clear explanations and realistic commitments are more useful than absolute assurances.
How to Compare Cybersecurity Proposals
Comparing IT providers requires more than reviewing prices.
Start with the business's essential systems and main risks.
Assess whether each proposal addresses those requirements.
Consider the scope of monitoring, backup arrangements, access management and incident response.
Review service availability and reporting commitments.
Ask for clarification where responsibilities are unclear.
It may be useful to request proposals in a consistent format.
This makes differences easier to identify.
The best choice is not necessarily the provider offering the most services.
It is the one offering a suitable, clearly defined service that the business can manage and afford.
Final Thoughts
Choosing an IT provider is an important cybersecurity decision.
The provider may have extensive access to business systems and responsibility for maintaining essential technology.
Businesses should therefore ask detailed questions before entering into an agreement.
Backup management, account security, monitoring and incident response deserve particular attention.
The provider should also explain how it protects its own remote access and manages sensitive customer information.
South African businesses need to consider POPIA obligations alongside technical security requirements.
Clear reporting, realistic service commitments and documented responsibilities can help establish a reliable working relationship.
No IT provider can eliminate every cybersecurity risk.
However, a suitable provider should be able to explain the risks it manages, the controls it uses and the limitations of its service.
Asking the right questions before signing a contract helps businesses make better-informed decisions and establish a stronger foundation for protecting their systems, information and daily operations.
