Top 5 Questions to Ask Before Hiring an IT Support Company

Hiring an IT support company is one of those decisions that looks simple on the surface and turns out to be anything but. You get three proposals, compare the monthly numbers, pick the cheapest one, and move on. Six months later, you're dealing with a ransomware incident and discovering that "managed IT" meant someone remoting into your computer once a month to run Windows Update.

I've been on the receiving end of those phone calls for over 20 years — the ones from business owners who hired the wrong provider and are now in a genuine crisis. After enough of those conversations, you start to notice patterns. The same five questions, if asked upfront, would have filtered out the bad fits before a contract was ever signed.

Here they are.

1. What Is Included in Your Flat Monthly Rate — and What Costs Extra?

This is the single most important question, and it's the one most business owners don't ask with enough specificity. The answer separates a true Managed Service Provider from a break-fix shop wearing an MSP label.

Why This Question Matters

Many IT companies advertise an attractively low per-user or per-device price. When you dig into the contract, you discover that the low rate covers basic remote monitoring only. Everything else — cybersecurity tools, data backups, on-site visits, after-hours emergencies — is billed separately at premium hourly rates.

This is called à la carte pricing, and it's designed to look affordable on a proposal while generating unpredictable invoices in practice.

What a Good Answer Sounds Like

A reputable MSP should be able to hand you a single-page summary of what your flat monthly fee covers. At minimum, that list should include:

• 24/7 proactive monitoring of servers, workstations, and network equipment
• Automated patch management for operating systems and third-party applications
• Enterprise-grade endpoint protection (EDR, not basic antivirus)
• Daily data backups with verified restore testing
• Remote helpdesk support during business hours at no additional cost
• Vendor management — they call your internet provider, your printer company, and your software vendors so you don't have to

If a provider can't clearly articulate what's included versus what costs extra, that's a red flag. You'll end up surprised by invoices, which defeats the entire purpose of paying a flat rate.

---

2. What Happens When Something Breaks at 2 AM on a Saturday?

A business's IT infrastructure doesn't care about business hours. Servers crash at midnight. Ransomware encrypts files during holidays. A critical firewall update fails on a Sunday morning.

Why This Question Matters

The majority of small IT companies operate on a Monday-through-Friday, 9-to-5 schedule. If you have an emergency outside those hours, you're either waiting until Monday or paying a steep emergency surcharge to whoever answers the phone — which is often a different company entirely.

This is the coverage gap that causes the most damage. A ransomware attack that sits undetected from Friday evening to Monday morning has 60+ hours to spread across your network, encrypt your backups, and exfiltrate your data.

What a Good Answer Sounds Like

Look for a provider that offers documented response time SLAs (Service Level Agreements) that cover after-hours emergencies. The answer should include:

• A specific response time commitment (e.g., "critical issues are acknowledged within 1 hour, 24/7/365")
• A clear definition of what qualifies as "critical" versus "normal"
• An explanation of how after-hours coverage is staffed — is it their own team, or a third-party answering service?
• Whether after-hours response is included in your flat rate or billed as an add-on

If the response is vague — "we'll get back to you as soon as possible" — that means there is no SLA, and "as soon as possible" on a Saturday night could mean Monday morning.

---

3. How Do You Handle Cybersecurity — and What Specific Tools Do You Use?

This question is non-negotiable in 2026. Cybersecurity is no longer a premium add-on; it's a foundational requirement for any business that stores customer data, processes payments, or handles sensitive information.

Why This Question Matters

There is a massive gap between what different IT providers mean when they say "we handle security." Some providers install a consumer-grade antivirus and call it a day. Others deploy enterprise-grade Endpoint Detection and Response (EDR), enforce multi-factor authentication (MFA), run employee phishing simulations, and maintain immutable off-site backups that even a ransomware attack can't touch.

The difference between those two approaches is frequently the difference between "incident avoided" and "business-ending breach."

What a Good Answer Sounds Like

A competent MSP should name the specific tools and frameworks they deploy. Ask for specifics:

• Endpoint protection: Are they using modern EDR (at eSmith IT, we include SentinelOne in our managed plans), or basic antivirus? EDR uses behavioral AI to catch threats that signature-based antivirus misses entirely — including zero-day exploits and fileless malware. For basic protection, we also offer professional-grade antivirus at a discounted rate.
• Backup strategy: Do they follow the 3-2-1 backup rule (three copies, two media types, one off-site)? Are backups immutable — meaning ransomware cannot encrypt or delete them?
• Email security: Do they provide advanced phishing protection and employee security awareness training?
• Access management: Do they enforce MFA on all accounts, and do they have a documented offboarding process to revoke access when an employee leaves?

If a provider responds with generalities like "we take security very seriously," ask them to name their EDR vendor. If they can't, that tells you everything you need to know about the depth of their security stack.

---

4. Can You Provide Local, On-Site Support When We Need It?

Remote support is efficient and solves the majority of day-to-day IT issues. But there are situations — cabling a new office, replacing a failed server, setting up hardware for a new hire, or recovering from a physical disaster — where someone needs to physically be in your building.

Why This Question Matters

Many IT companies, particularly large national providers, operate entirely remotely. They handle everything through remote desktop sessions and phone calls. That works fine until it doesn't — and when it doesn't, you discover that the nearest technician is in another state and will arrive "within 3-5 business days."

For a business in the Charlotte metro area, having a provider headquartered locally means the difference between a technician arriving within an hour and waiting until mid-next-week.

What a Good Answer Sounds Like

Ask specifically:

• Where is your team physically located?
• What is your average on-site response time for our area?
• Is on-site support included in our plan, or billed hourly?
• How many technicians do you employ locally?

A provider with a local presence will typically commit to same-day or next-business-day on-site response. Remote-only providers cannot make that commitment, regardless of what their marketing materials claim.

---

5. What Happens to Our Data and Access If We Leave?

This is the question nobody thinks to ask during the honeymoon phase of evaluating providers — but it's arguably the most important one for long-term business protection.

Why This Question Matters

Some IT providers configure your systems, domain accounts, cloud tenants, and backup repositories under their own master accounts. If the relationship ends badly, you may find yourself locked out of your own infrastructure, scrambling to regain administrative access to your email, your files, and your backups.

This is not a theoretical risk. It happens with disturbing regularity in the small-business IT industry, and it often results in costly legal disputes and extended operational disruptions.

What a Good Answer Sounds Like

A trustworthy MSP will answer this question without hesitation, because they've designed their operations to ensure you always own your data and credentials:

• Your Microsoft 365 tenant, domain registrations, and cloud accounts should be registered under your business name — not the MSP's.
• Administrative credentials should be documented and accessible to you at all times, typically through a shared password vault.
• Backups of your data should be stored in an account you control or can transfer ownership of, not locked inside the provider's proprietary system.
• A clear exit process should be documented in your contract, including timelines for handing over access and removing their management tools from your devices.

If a provider hesitates on this question, or says something like "we'll work it out if we ever get to that point," walk away. A provider that holds your data hostage — even implicitly — is not a partner. They're a liability.

---

Making the Right Decision

Hiring an IT company shouldn't feel like a gamble. These five questions don't require any technical expertise to ask, but the answers will reveal exactly how a provider operates, how transparent they are, and whether they're structured to protect your interests or their own.

The pattern you'll notice is consistent: the best providers welcome hard questions because they've already built their entire service model around the answers. Companies that deflect, generalize, or get defensive when pressed on specifics are telling you exactly how they'll behave when your server goes down at midnight.

At eSmith IT, we've structured our service around these exact principles since 2001 — flat-rate pricing with no hidden fees, documented 24/7 SLAs, enterprise EDR and immutable backups included in every plan, local technicians in the Charlotte metro area, and full client ownership of all data and credentials. We welcome these questions because we built our business to answer them well.

Schedule a free IT assessment or call us at (704) 334-1252 to see exactly what a managed plan looks like for your business.