Five questions worth asking your IT provider this week.

26 August 20266 minute readLANTEK Computers

None of these are trick questions. A provider running a real managed service answers all five without checking, because the answers are things they already track. A provider running a repair shop with a monthly invoice attached will need to come back to you, and that delay is itself the answer.

1. What is your current accreditation list, and what tier is each one?

Accreditation is not decoration. Each one represents assessments passed, engineers certified and kept current, and a direct line into vendor engineering when something goes wrong at your premises at eleven at night.

The length of the answer matters less than how quickly it arrives. A provider who has to go and look does not have a live relationship with those vendors. Ask for the tier as well as the name, because there is a real difference between a registered partner and a gold one, and both are accurate descriptions that mean very different things.

2. When did somebody last restore from our backup?

Not when did it last run. When did somebody last restore from it, to a usable state, and open a file afterwards.

A backup job can report success every night for a year while quietly writing files that cannot be read back. Nobody discovers this on an ordinary Tuesday. They discover it on the worst day of the year. A restore should be rehearsed at least quarterly and the result recorded, because the only evidence a backup works is a file somebody has opened after restoring it.

Ask the follow-up too: is one copy immutable? Modern ransomware looks for backups and destroys them before encrypting anything, so a backup an administrator account can delete is a backup an attacker can delete.

3. Who is looking at our systems at eleven on a Saturday night?

Nobody gets breached at two in the afternoon on a Tuesday. Attacks land on a Friday evening, over a long weekend, on Christmas Eve, and not by coincidence. That is when nobody is looking.

A working week is 168 hours. A business open nine to six, Monday to Friday, is watched for 45 of them. The other 123 are the window. Ask what happens in that window, and specifically whether an alert is acted on or queued for Monday. Those are different services at similar prices.

4. Are we charged per device or per user, and what is inside the pool?

Charging per device penalises a business for giving somebody a laptop and a phone. Charging per user reflects what is actually being supported, which is a person.

The more useful half of the question is what the fee covers. Proactive work, meaning monitoring, patching and automated remediation, should never be billed against a reactive pool, because the moment it is, the provider's incentive is to attend problems rather than prevent them. Ask where the line sits and get it in writing.

5. If a regulator asked tomorrow, what would you hand them?

Section 19 of POPIA requires appropriate technical and organisational measures to secure personal information, and the maximum administrative fine is R10 million. The question a regulator asks after an incident is not whether you meant well. It is what was in place beforehand, and what evidence exists that it was.

That evidence is a set of documents: security and acceptable use policies, an asset register, a risk register with review dates, data processing agreements with every vendor that touches your data, and an incident response plan somebody has actually tested. If your provider cannot say where those live, they do not exist.

What the answers tell you

A provider who answers all five immediately is running a managed service. One who answers two and promises to check on the others is running support with a subscription attached. Both are legitimate businesses. Only one of them is what most people think they are buying.

If you would rather see the answers for your own environment than ask for them, the free health check starts with a dark web scan and thirty minutes of plain language. You keep the report either way.