Many London small and medium-sized businesses change IT providers after a serious incident, an unexpected invoice or a missed deadline. Choosing a provider on price or a polished proposal alone often produces the same problems a second time. This guide explains how to choose IT support London businesses can rely on, and sets out the questions a director should ask about service model, response, security, cost and exit terms. It also describes what a credible answer looks like.
Table of Contents
- Quick Takeaways
- Clarify the Service Model
- Response Times and Service Levels
- Security, Compliance and Data Protection
- Pricing, Contract Length and Hidden Costs
- Exit Terms, Data Ownership and Reporting
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Confirm the billing model | Ask whether the fee is fixed monthly or charged per incident. Per-incident billing gives the provider a weaker incentive to prevent faults. |
| Request response targets in writing | Ask for response and resolution times by priority level, along with how breaches are recorded and reported. |
| Verify the security baseline | Confirm multi-factor authentication, endpoint protection, email filtering, tested backups and Cyber Essentials status. |
| Keep administrator access in your name | Microsoft 365, Azure and other cloud tenants should be registered to your company, with the provider working under delegated access. |
| Compare quotes on identical scope | Ask each provider to price the same user count, device count and services, including licences, so totals can be compared fairly. |
| Review notice periods and exit clauses | Check the minimum term, automatic renewal dates, termination fees and the timeline for returning documentation and data. |
| Ask to see a sample quarterly review | Plain-English reporting on incidents, risks, licences and budget shows whether the provider manages your environment proactively. |
Clarify the Service Model
The first question concerns how the provider earns its fee. Under a break-fix arrangement, the provider is paid when something fails, so its commercial interest can work against your interest in stability. Managed IT support typically charges a fixed monthly fee for monitoring, patching, helpdesk access and reporting, which aligns the provider’s interest with fewer incidents.
iTO.London operates on the managed model, acting as an outsourced IT department with fixed monthly pricing and senior engineers. The comparison below applies to any provider you assess, whatever its label.
Fixed fee or per-incident billing?
Ask for the pricing structure in writing. A credible answer states which tasks sit within the monthly fee, how hardware and software licences are billed, and which events trigger an additional charge. Where a provider cannot describe its billing in plain terms, the proposal is unlikely to remain transparent after signature.
Pro tip: Request a redacted sample invoice from an existing client to see how line items, licence costs and project charges are presented.
Response Times and Service Levels
A service level agreement (SLA) defines what the provider commits to and how performance is measured. For a London business with staff on site, time to first response usually matters more than general claims about availability. Ask for targets by priority level, and ask how missed targets are recorded and reported to you.
What does the SLA actually measure?
Ask for the average time to answer support calls and the share of tickets closed within target during the previous quarter. Providers that track these figures can share them. A reply that offers only general assurances about responsiveness gives you too little information to compare providers.
Confirm support hours and out-of-hours cover. Staff who travel between offices, work across time zones or support client-facing services in the evening need cover that matches those working patterns.
Security, Compliance and Data Protection
Security questions show whether a provider treats protection as a standard part of the service. Under UK GDPR, the business remains accountable for the personal data it holds, even where a third party manages the systems that process it. Contract terms should reflect that responsibility.
Which controls are included as standard?
Ask whether multi-factor authentication is enforced for every staff account, whether endpoint protection and email filtering are included, and how backups are tested. A backup that has never been restored is an untested assumption. Ask also whether the provider holds Cyber Essentials certification or an equivalent independent assessment.
Who is accountable after an incident?
Request the incident response process in writing. It should name who you contact, how and when you are informed of a suspected breach, and who prepares the evidence needed for reporting. As controller, your business must notify the Information Commissioner’s Office of a notifiable personal data breach within 72 hours of becoming aware of it, so the provider’s timelines must support that obligation.
A security service is only as useful as the process that runs when something goes wrong.
Pricing, Contract Length and Hidden Costs
Price comparisons are meaningful only when the scope is equivalent. Two quotes can differ substantially because one includes Microsoft 365 licensing, backup and security tooling while the other excludes them. Ask every provider to price the same user count, device count and service scope before comparing totals.
| Approach | Cost Behaviour | Best Suited To |
|---|---|---|
| Break-fix support | Paid per incident, so monthly costs vary and are difficult to forecast | Businesses with minimal reliance on technology and low exposure to risk |
| Fixed-fee managed support | Predictable monthly fee covering defined services, monitoring and helpdesk access | SMEs without an in-house IT function that need an outsourced IT department |
| Co-managed support | Provider supplements an internal team, with the fee covering an agreed scope | Businesses with an internal IT lead that require specialist security or cloud skills |
Contract length and notice periods
Confirm the minimum term, the notice period and any termination fee. Some agreements renew automatically unless notice is given within a fixed window. Check whether onboarding charges are refundable if the provider fails to meet its agreed targets during the early months.
Pro tip: Build a comparison table that lists included services, excluded items and third-party licence costs for each quote before comparing the headline figures.
Exit Terms, Data Ownership and Reporting
A provider relationship should be reversible. Ask who holds administrator credentials for Microsoft 365, Azure, AWS or other cloud tenants. Accounts, domains and licences should be registered in your company’s name, with the provider acting under delegated access.
What happens to your data on exit?
Ask how long the provider takes to return documentation, configuration records and data, and in what format. Asset registers, network diagrams and credentials should be available to you on request throughout the contract, not only at exit.
What should quarterly reporting show?
A quarterly review should cover incident trends, open risks, licence changes and spending against budget, in plain English. Ask to see a redacted sample. Reports that focus only on ticket volumes do not show whether technology is supporting business objectives.
Pro tip: Maintain a shared register of administrator accounts, licence holders and renewal dates, and review it with the provider at each quarterly meeting.
Frequently Asked Questions
What is the difference between managed IT support and break-fix support?
Managed IT support charges a fixed monthly fee for monitoring, maintenance, helpdesk access and reporting. Break-fix support charges for each repair after a fault occurs, so costs are less predictable and the provider has less incentive to prevent problems.
How many providers should a London SME compare?
Three or four providers is a practical number for most businesses. Fewer than three limits the basis for comparison, while a longer list increases the time spent on assessment without necessarily improving the decision.
Should response targets be the same for every type of issue?
No. Targets should vary by priority, with the most urgent issues, such as a full loss of email or a suspected breach, receiving the fastest response. Ask for the definition of each priority level, since providers can classify incidents differently.
Is Cyber Essentials certification a legal requirement?
Cyber Essentials is not a legal requirement for most private businesses. It does provide independent evidence that a baseline set of technical controls is in place, so it is a reasonable condition to request from a provider that will hold your data or administer your systems.
Who should hold administrator access to cloud accounts?
Your company should own the accounts, domains and licences, and hold at least one administrator credential that is not dependent on the provider. The provider should work under delegated access, which can be withdrawn if the relationship ends.
We welcome feedback from London directors on which questions proved most useful when selecting their own IT support, so please share your experience in the comments.