Seven questions to ask an IT company before it gets the keys to your office

Ask these before you sign anything

Before you hire an IT company, ask seven things: who will actually work on your computers, what the monthly fee includes and excludes, what happens when you call with a problem, how backups work and when they last restored one, what security protects your email and devices, how you leave the agreement, and what they know about offices like yours. Listen less for polished answers and more for specific ones. A provider that names people, lists exclusions in writing and can describe its last restore test is usually telling you the truth about everything else.

I am Anthony Omini, owner of Cross River Tech, and I sit on the other side of this conversation every week. The owners who ask these questions end up with better service from whoever they choose, including us. Here is each question, why it matters, and what a good answer sounds like.

Who will actually be working on our computers?

Whoever you hire will hold administrator access to your email, your files and your network. You should know who those people are and how many of them there are. Ask who answers the phone, who does the hands-on work, and who covers when your main contact is on vacation or out sick.

A good answer has names in it. At Cross River Tech, I am the point of contact, and a small team keeps routine work moving; clients hear from me in advance when I am out. A large provider may route you to a help desk, which can work well if they can tell you how the people answering your call learn your office. Ask how they keep documentation, too. If the only map of your network lives in one technician's head, you do not have a provider, you have a dependency.

While you are on the subject of people, ask what the first month looks like and who does it. Onboarding is where a provider learns your office, and it is the busiest stretch of the relationship. Ours starts with an on-site visit to inventory every computer, server and network device, install the management and security tools, check the backups and fix the obvious problems, followed by a written picture of the setup within the first few weeks. A provider that cannot describe its first month in that kind of detail will be learning your office on your time.

What is in the monthly fee, and what costs extra?

Every provider lists what is included. Fewer will hand you a written list of exclusions, and that is the list you actually need. Common extras are on-site visits, after-hours work, server support, projects, and the time it takes to set up a new employee. Ask for a sample invoice so you can see how extras are billed in practice.

As a reference point, our managed plans include unlimited remote support, on-site visits at no extra charge when remote cannot fix it, updates, endpoint and email security, daily backups with tested restores, network management, printer and phone support, user onboarding and offboarding, vendor coordination and documentation the client owns. Projects and after-hours work are quoted separately. If you want to compare prices once you have the lists side by side, my guide on what managed IT costs a small Dallas office shows how to put two quotes in the same unit.

What happens when we call with a problem?

Ask the provider to walk you through a call. Where does it go, who decides how urgent it is, and what happens at 7 PM on a Friday or on a holiday? A clear story is worth more than a number. A promised fifteen-minute response time with no explanation of how it is met often means an automatic reply with a ticket number.

I will be direct about our own answer, because it is not for everyone. We do not offer a written response-time guarantee. You call or email, and I answer or call back, usually the same business day and often much sooner. Remote support is available around the clock every day of the year at after-hours rates, and on-site visits across Dallas–Fort Worth are by appointment, often the same day. If your office needs a contract with guaranteed minutes and several technicians on shift at once, a larger help desk is the better fit, and I will tell you that.

How do backups work, and when did you last restore one?

This is the question that separates providers fastest. Ask what is backed up, where the offsite copy lives, how often the backup runs, how long data is kept, and when they last performed a test restore for a client. Then ask what Microsoft 365 or Google Workspace data is backed up, because that usually needs a separate backup outside the platform.

An honest provider can describe a restore test in detail: which files, how long it took, what they found. Our tests run on a schedule, from a few files from last week to a full server restore to a spare machine, and each one produces a short note for the client. If a provider answers with the name of the backup software and nothing else, assume the backup has never been tested. I explain why that matters in the backup myths that leave small offices exposed.

What protects our email and computers, and what happens when something gets through?

Ask for the specific controls, not the word security. You want to hear about multi-factor authentication on email, remote access and administrator accounts, email filtering for spam and phishing, endpoint protection that staff cannot switch off, and scheduled patching. Then ask the harder half: what do they do when a phishing email works or ransomware runs anyway?

A good answer is a sequence. Ours is to isolate the affected machines, find and close the entry point, restore from the copy the attacker could not reach, reset credentials, and help you follow your insurer's process if you have a policy. Also listen for limits. We do not run a 24-hour security operations center or sell penetration testing, and we say so. A provider that promises nothing bad will ever happen is selling comfort, not protection.

What does the agreement say about leaving?

Read the term, the automatic renewal clause, the notice period and any early-termination charge. A three-year agreement is a bet that the service will still be good in month thirty. Then ask how a handover works: who holds the administrator passwords, who owns your domain registration, whose name the licenses are in, and whether the documentation comes with you.

The answer should be that everything is in your name and handed over without a fight. Our managed plans are month to month and can be canceled anytime, and the documentation of your setup belongs to you. I would rather keep clients because they want to stay than because leaving is expensive.

It is also worth asking how they take over from the provider you have now. A careful handover collects passwords, licenses and the domain before the old provider's access is removed, confirms the backups are running under the new owner, and avoids switching anything during your busiest week. A provider that plans to rip everything out on the first day is creating risk, not removing it.

What do you know about offices like ours?

Every field has software and habits that shape its IT. A law firm runs on Clio, MyCase or a document system and cannot have patching during a filing deadline. A dental practice depends on Dentrix or Eaglesoft and imaging computers that must be up before the first patient. An insurance agency lives in Applied Epic or AMS360 and carrier portals. An architecture firm moves large AutoCAD and Revit files. Ask the provider what they know about yours.

Do not expect client names; a provider who hands them out freely will hand out yours too. Expect them to name your software, describe your busy hours and ask about the requirements your field carries, such as HIPAA for medical and dental offices. Be wary of anyone who promises to make you compliant on their own. Technology is part of compliance, but your policies, training and staff habits are the rest of it.

Red flags that should end the conversation

One of these on its own is not proof of a bad provider. Two or three together usually are.

• They will not tell you who does the work.
• They will not put exclusions in writing.
• The contract is long, renews automatically and is costly to leave.
• They cannot describe a recent restore test.
• They promise zero downtime or full compliance.
• They want to replace everything on day one without explaining why each item must go.
• They keep administrator passwords to themselves or will not document your setup in your name.

Putting the questions to work

Send the same questions to every provider you are considering, and ask for the answers in writing after the first conversation. Compare the specifics side by side. The cheapest quote with vague answers almost always costs more by the end of the first year, and a quote far below the market usually means something is missing from it.

One last question is worth saving for the end: after you have looked at our office, what would you fix first, and why? The answer shows whether the provider is thinking about your risk or about its invoice. A good one will name something unglamorous, like turning on multi-factor sign-in or testing the backup, before it mentions buying anything.

If you want to put these questions to me, call or use the short form, and I will answer each one for your office, in plain English, usually the same business day. If you are asking them because your current provider keeps letting you down, my guide on what a small firm actually needs when the IT ticket sits for days covers the checks you can run on your own setup first.

Questions people ask me