Short answer: Ask what's in place, who's responsible for it, and where it's written down. A good IT provider will welcome the questions. The goal isn't to catch anyone out; it's to make sure the answers exist somewhere you can find them if your provider, or you, are ever unavailable.
Why ask at all?
Many owners assume their IT provider "handles security." Often they handle a lot of it. But there might be gaps between what you think is covered and what's actually in the agreement, and those gaps usually only show up on a bad day.
Seven questions to bring
1. "Which of our accounts ask for a second sign-in step?" A good answer is a list: email, banking, payroll, key apps. Watch for "most of them."
2. "How do updates happen on our computers and phones?" A good answer explains that updates install automatically, and names any device that can't update and why.
3. "When did we last restore something from a backup?" A good answer has a date and what was restored. "Backups run every night" is a start, but it isn't the same as a tested restore.
4. "Who has administrator access to our systems?" A good answer is a short list of names, including people at the provider. Ask how often it's reviewed.
5. "What happens in the first hour if something goes wrong?" A good answer names who you call, who decides, and what they'd do first. Ask for it on one page.
6. "What's covered in our agreement, and what isn't?" A good answer is specific. Some things, like staff reminders or vendor access, might be left to you.
7. "Where is all of this written down?" A good answer is a document you can open today, not "it's in our system."
Turning answers into a picture
As you go, score each item:
Red (known): you know about it, or you have the tool.
Yellow (documented): it's written down, so someone else could follow it.
Green (tracked daily): someone checks it every day, and there's a record.
Red isn't failure. It just shows you where to start.
You're on the same side
Your provider likely wants this written down too. Clear answers protect them as much as you. If it would help to have someone sit alongside both of you, that's the kind of work I do: I don't replace your provider, and I'm not trying to.
A quick first picture
The Confidence Check walks through these same areas in about seven minutes. Your results show on screen right away, and you can bring them to your next provider meeting.
This post is general information, not legal, tax or insurance advice.
