Here are the red flags SMB leaders should watch for when evaluating a managed IT provider, grouped into security, support, and accountability. Use it as a checklist for new providers and as an annual check on your current one.
If multi-factor authentication, endpoint protection, and email security cost extra, many clients skip them. Basic protection should be standard.
"We back everything up" is not enough. Ask when they last restored data for a client and how often they test.
If they cannot show you which devices are up to date, you cannot know whether they are.
Attackers target MSPs to reach many clients at once. A provider should be able to explain how they protect their own tools and accounts.
Ask what happens in the first hour of a suspected breach. A good provider has a documented answer. See What to Do in the First 24 Hours After a Cyberattack.
Without written response targets by priority level, you have no way to hold the provider accountable.
Remote support solves most issues, but some problems need hands on equipment. Ask how quickly someone can be on-site.
If you speak to someone new every time and have to explain your setup again, knowledge is not being documented or shared.
For most SMBs, Microsoft 365 is the center of daily work. Your provider should manage licensing, security settings, and backups for it, not just reset passwords.
If you cannot tell what is included, you cannot budget. Ask for a written list of inclusions and exclusions.
Long auto-renewals, steep termination fees, and no transition commitments make it hard to leave a bad fit.
You should own your domain, Microsoft 365 tenant, and admin access. Your provider should not be the only one with the keys.
You should have access to documentation of your network, systems, and vendors. Without it, switching providers is painful.
Regular reports and roadmap meetings show what the provider is doing and what is coming next. Silence is not a sign that everything is fine.
| Question | Good answer | Red flag |
|---|---|---|
| Is security included? | Yes, in the base plan | Only as add-ons |
| When was your last restore test? | A specific recent date | "We back everything up" |
| What are your response times? | Written, by priority level | "As soon as possible" |
| Who owns our accounts and data? | You do | Unclear |
| What happens if we leave? | Documented transition plan | Fees and no handover |
Red flags rarely look serious on their own. Together, they predict how a provider will act when something goes wrong. If you spot several, keep looking.
For a structured process, read Questions to Ask Before Hiring Managed IT. And to see what transparent pricing looks like, try Cloud Cover's instant pricing calculator.
Not being able to prove backups can be restored. Data loss is one of the hardest problems to recover from.
Not by itself. Look at the exit terms. A fair contract explains how to leave and commits to a clean handover.
They need access to do their job. The concern is if you do not also have admin access and ownership of your accounts.
At least once a year, ideally before renewal.
Tell us a little about your business and a Cloud Cover team member will follow up with answers, not a sales pitch.