Questions to ask an IT provider before you sign

1. Will we control our accounts and your access?

For a small business in Cranbrook or elsewhere in the East Kootenay, choosing an IT provider means deciding who can make changes to the systems you depend on. Start with ownership and access, not the list of software included.

Ask whether your business will be the registered domain holder and retain control of its Microsoft 365 or Google Workspace tenant, meaning its organisation's cloud account. Request business-controlled billing contacts, recovery methods and a documented emergency administrator recovery process. Ask how recovery works if the provider is unavailable.

Ask for named technician accounts or secure delegated access with limited permissions, multi-factor authentication and access logging, rather than sharing your own administrator password. The Canadian Cyber Centre recommends least-privilege access and asks whether administrator actions can be individually audited.[1] Request an access walkthrough without exposing live credentials.

2. What is included, and when is help available?

Have the provider mark each important service as included, separately billed or your responsibility. Cover computers, email, servers, networks, security monitoring, backups, staff onboarding and departures. Identify exclusions such as unsupported equipment, business software, migrations, travel and on-site visits.

Ask for support hours, the time zone, holiday coverage and the route for urgent requests outside those hours. Does continuous monitoring include a person investigating alerts overnight, or does ordinary help wait until morning?

Separate response from resolution. Ask what starts the clock, whether response means acknowledgement or active technical work, and when the clock pauses. Ask how priority is assigned and what happens when a cloud vendor or internet carrier must fix the fault. Request the service-level agreement and an anonymised ticket timeline showing escalation and customer updates.

3. Who owns recovery, and what has been tested?

Ask which systems and data are backed up, which are excluded, who checks failed jobs and who pays for recovery work. Include cloud email, shared files and business applications in the discussion rather than assuming they are covered.

Set recovery expectations around how much recent work you could afford to lose and how long each business function could stop. Ask how backup copies are separated from everyday systems and protected from unauthorised deletion.

Request a redacted restore-test report showing what was restored, when, how long it took, what failed and what was corrected. A successful backup job is not the same evidence as a successful restore. The Cyber Centre says businesses remain responsible for establishing and testing their disaster recovery plans, even when parts are outsourced.[1]

4. Who does what during a security incident?

Walk through a suspected compromised email account. Who investigates, disables access, preserves logs and contacts your decision-maker? What can the provider isolate immediately, and what requires approval? Ask who coordinates specialist responders, your insurer and legal advisers, and which costs fall outside the agreement.

Request a written responsibility map, emergency contacts and notification expectations, including what happens if the provider itself is compromised. The Cyber Centre recommends coordinating an incident response plan that separates the customer's responsibilities from the provider's.[1] Assign responsibility for assessing notification obligations rather than assuming technical support includes privacy or legal decisions.

5. Who else handles our information, and where?

Request the subcontractors and cloud services involved, their roles, and where production data, backups and logs are stored. Ask where technicians access information from, how subcontractors are assessed and how changes are communicated.

Canadian hosting is not, by itself, proof of privacy compliance. The Office of the Privacy Commissioner explains that PIPEDA does not prohibit cross-border processing, but organisations remain accountable under each outsourcing arrangement; a contract cannot override foreign laws.[2]

That guidance does not cover every provincial privacy rule.[2] For a BC business, confirm which provincial, federal, sector and contractual requirements apply to your information. Ask for contractual safeguards and evidence of their operation. This is purchasing guidance, not legal advice or a compliance guarantee.

6. Can we compare the full cost in writing?

Request the billing basis, onboarding charges, licence costs, project rates, after-hours fees, renewal terms and cancellation charges. Establish who approves extra work and how changes to users, devices, scope or rates are documented before billing.

Hypothetical comparison: Proposal A includes business-hours help and backup monitoring but bills restore labour separately. Proposal B includes restore labour and after-hours incident triage but excludes on-site travel. Neither is automatically better. Ask both providers to price the same recovery scenario and explain the remaining exclusions.

Compare the resulting written scope against your operating needs. An honest exclusion can be easier to plan around than an undefined promise of unlimited support.

7. What happens when the relationship ends?

Agree on an exit before signing. The Cyber Centre recommends discussing data portability at the start to avoid vendor lock-in.[1] Ask for notice periods, transition fees, export formats and delivery timelines.

Specify the handover: domain and tenant control, configuration records, asset inventories, network diagrams, licence details and securely transferred credentials. Ask how provider access will be removed, how backup continuity will be maintained and when retained copies will be deleted, subject to applicable retention requirements.

8. What proof should we request before deciding?

• Control: account ownership records and an administrator recovery walkthrough.
• Service: an inclusion-and-exclusion schedule, support hours and escalation terms.
• Recovery: backup responsibilities and a recent restore-test report.
• Incidents: a responsibility map and emergency contact process.
• Privacy: subcontractor details, data locations and contractual safeguards.
• Cost and exit: written charges, change approvals and handover deliverables.

Accept redacted examples or controlled demonstrations where documents contain sensitive information. Choose the provider whose evidence and written commitments fit your business, not simply the most reassuring presentation.