IT support is an unusual purchase. You cannot easily judge it before buying, the differences between providers are invisible in a proposal and the failure mode is a slow decline in service that nobody quite notices until something serious goes wrong.

Here is what actually distinguishes good from plausible.

Good support makes itself less necessary

The clearest signal of all. A good provider's ticket volume from your business should fall over the first year, because they are fixing causes rather than symptoms.

Ask any prospective provider to show you a ticket trend graph for an existing client over twelve months. A flat or rising line means they are handling incidents. A falling one means they are removing them.

This is also why per-incident charging is the wrong model. It pays the provider more when your systems are unreliable, which is precisely the wrong incentive to introduce into the relationship.

What should be included

A proper managed service covers:

  • Unlimited remote support for covered systems and users, with no per-ticket charge.
  • Proactive monitoring — they know a disk is filling before you do.
  • Patch management for operating systems and applications, on a schedule, reported.
  • Security management — endpoint protection, tenancy configuration, access reviews.
  • Backup monitoring with tested restores. Monitoring alone is not enough, as covered in this article.
  • Licence management — because unused licences are money and stale accounts are risk.
  • An asset inventory you can see. What you own, its age, when it needs replacing.
  • Regular reviews — quarterly, with an actual agenda rather than a chat.

Anything on that list which is charged separately is a signal about how the relationship will work.

Response times that mean something

Most contracts promise a response time. Few define what a response is, and fewer still measure it.

Insist on three things:

Definitions. What counts as critical, high and normal, in plain terms. A definition that says at the provider's reasonable discretion is not a definition.

Two clocks. Time to acknowledge and time to start work. Acknowledgement alone is easily satisfied by an automated email and tells you nothing.

Reporting. Monthly performance against target, including the misses. A provider who reports their own failures is a provider who is measuring.

For a small business, an hour to acknowledge and four hours to start work on anything blocking is a reasonable expectation. Faster is available and costs more.

An unmeasured service level is a sentence in a contract. Ask to see last month's report before you ask about the target.

The questions that separate providers

Ask these and listen to how they are answered rather than what is claimed.

"Who answers when I call?" A named team you get to know, or a queue? For a small business the difference is substantial, because context matters more than headcount.

"When did you last test a restore for a client?" A good answer includes a date and what was found. A vague answer about backups being monitored means nobody has tested one.

"What is not included?" Every contract has exclusions. A provider who answers this openly is one you can trust. A provider who says everything is included has not read their own contract.

"What happens if we leave?" Do you get your documentation, your passwords, your configuration? Are admin accounts in your name or theirs? Ask before signing, because asking afterwards is a much weaker position.

"Can I speak to a client your size in a similar sector?" And then actually call them.

Contract terms worth arguing about

Length and notice. Twelve months is standard. Three years with automatic renewal is a trap. Ninety days' notice is reasonable; six months is not.

Ownership of accounts. Your Microsoft tenancy, your domain, your admin accounts should be in your name, with the provider holding delegated access. Domains registered in a provider's name are one of the more common ways a business finds itself unable to leave.

Exit assistance. Written into the contract: documentation handed over, credentials transferred, reasonable cooperation with a successor. Providers who refuse this are telling you something.

Price review. Fixed for the first year, then a defined mechanism rather than "as notified".

What it costs

£35 to £75 per user per month for fully managed support in the UK in 2026, depending on inclusion and complexity. Anything much below that is excluding something, and you will meet the cost of it later as a separate line.

Cheap support is expensive. The saving is real and small; the cost of a slow response during an incident, or of a backup nobody tested, is neither.

The relationship test

Beyond the contract, one question tells you most of what you need to know: does the provider tell you things you did not ask about?

A good one warns you about a certificate expiring, a licence you no longer need, a machine approaching end of support. A poor one waits to be asked and bills for the answer.

If you would like to know how your current support compares, our technical support team is happy to give you an honest second opinion on your setup without any obligation to move. Get in touch.