Choosing an IT Provider: 8 Mistakes UK Small Businesses Make

An IT provider ends up with the keys to almost everything: your email, your files, your client data and the admin accounts that control them. Choosing well matters more than most buying decisions a small business makes, and it’s easy to get wrong.

Around half of UK businesses (48%) now use an external cyber security provider, according to the government’s Cyber Security Breaches Survey 2025/2026. Yet only 15% formally review the cyber security risks posed by their immediate suppliers. In November 2025 the NCSC published a guide to choosing a managed service provider aimed squarely at small and medium-sized businesses. These eight mistakes draw on it.

1. Choosing on price per user alone

Two quotes with the same monthly figure can cover very different things. Before you compare prices, compare what’s included:

• day-to-day support, and whether there’s a cap on hours
• security tools such as anti-malware, monitoring and email protection
• backups, including Microsoft 365, and restore testing
• whether Microsoft 365 licences are included or billed separately
• onboarding fees, project work and out-of-hours charges

The NCSC also points out that some security features “may incur additional charges”, so check the contract, not just the proposal. The cheapest quote that leaves out backups or security isn’t cheaper.

2. Not checking the provider’s own security

Your provider’s access to your systems is a route in for attackers. The NCSC advises using providers with recognised certifications “such as Cyber Essentials Plus”, and notes that ISO 27001 or SOC 2 also show a provider takes information security seriously. You can check a Cyber Essentials certificate on the IASME certificate search.

Ask how they protect their own access to your systems: two-step verification on their accounts, least-privilege access and secured remote connections.

3. Leaving service levels vague

“We’ll get to it quickly” isn’t a service level. Get response and resolution times in writing, for urgent and routine issues. The NCSC’s guidance on choosing a managed service provider gives benchmarks to compare quotes against, and notes that faster response times usually cost more.

Ask how you actually get help, too: by phone, email or a portal, during which hours, and what happens outside them.

4. Not asking how backups are tested

Almost every provider will say they do backups. Fewer can tell you when they last restored one. Ask:

• what’s backed up, including Microsoft 365, and how often
• where the copies are kept, and who can delete them
• how often restores are tested, and whether you’ll see the results
• how they’d recover your data, and their own service, after a ransomware attack

The NCSC’s checklist asks for “automated, off-site data backups and regular testing of restore processes”. Our guide to building a backup strategy explains what good looks like.

5. Not owning your own keys

This is the mistake that hurts when you want to leave. Make sure your business, not the provider, owns:

• the Microsoft 365 global administrator account (the provider can have its own admin access as well)
• your domain name registration and DNS login
• logins for backup services, the firewall and Wi-Fi
• up-to-date documentation of how everything is set up

A good provider will be happy to write this into the contract.

6. Ignoring the contract terms and exit clauses

Read the contract before you sign, not when you want to leave. The NCSC suggests checking that it sets out roles and responsibilities, how security incidents are reported to you (including incidents at the provider), liability, regular reviews and reports, who tracks systems approaching end of life, and how renewals and terminations work.

Pay particular attention to the minimum term, the notice period and what the provider will hand over when you go.

7. Not checking references or sector experience

Ask for references or case studies from businesses like yours. The NCSC recommends testimonials or references “particularly SMEs”, because a provider’s track record says a lot about how they’ll work with you.

Sector knowledge matters too. Solicitors need a provider who understands client confidentiality and SRA expectations. Accountants need one who knows that January is no time for slow fixes. Ask what other businesses in your sector they look after.

8. Treating IT as a fix-it service, not a plan

A provider who only reacts when something breaks will keep fixing the same problems. Look for one who reviews your IT regularly, tells you what’s coming (such as end-of-support dates and licence changes), and helps you plan and budget for it. Our post on creating an IT roadmap explains what that planning looks like.

The same goes for your people. New tools only help if staff know how to use them, so ask what training and guidance the provider offers.

Making the switch

If you’ve realised your current set-up has some of these gaps, changing provider is less painful than most people expect, as long as you plan it. Our switching to us page lists what you’ll need from your old provider and what onboarding costs, and our managed IT support page explains how we work.

There’s more on the basics in our post What is an MSP (and how to choose the right one).