Choose IT support by the work your organization needs done: keeping people productive, maintaining systems, responding to incidents and handing over reliable records. A useful agreement names who does each task, when help is available and how success will be checked.
Start with a support brief
Before asking for quotes, list users, locations, working hours, devices, business applications, internet connections and the people who currently administer them. Identify the activities an outage would interrupt: taking orders, scheduling appointments or accessing design files. Include remote staff, shared equipment and seasonal peaks.
Describe the starting condition honestly. Unsupported equipment, missing account access and undocumented applications can make onboarding a separate project. Ask the provider to distinguish discovery work, remediation and continuing support in its proposal.
Choose a delivery model around the skills and coverage you need. An internal team offers close knowledge of the business; an external provider can supply additional capacity and specialist support; a shared arrangement can combine them. For each model, assign a business owner who can approve changes and spending.
Agree who owns each result
On a narrow screen, swipe the table or focus it and use the arrow keys.
| Work | What to agree | Evidence to request |
|---|---|---|
| User support | Contact channels, supported users and devices, service hours and exclusions. | A sample ticket showing triage, updates and closure. |
| Accounts and access | Who approves, grants, reviews and removes permissions. | A joiner/leaver workflow and named organizational account owners. |
| Updates and maintenance | Covered systems, maintenance windows and exception handling. | An example report with failures and follow-up actions. |
| Backup and recovery | Protected data, restore responsibility and agreed recovery objectives. | A documented restore test and unresolved gaps. |
| Security incidents | Who investigates, preserves evidence and contacts the business. | A contact tree, notification terms and a practice scenario. |
| Projects and exit | What counts as a project; export, transition and access-removal obligations. | A sample handover inventory and schedule of extra charges. |
The joint CISA advisory for managed service providers and customers emphasizes clearly assigned security responsibilities, multifactor authentication and backup testing. Use those topics to ask for concrete evidence from both parties. Buying support leaves the organization with decisions to make about access, priorities and acceptable interruption.
Keep essential domain, cloud and licensing accounts under documented organizational ownership. Agree how authorized staff can regain control if the provider is unavailable, while protecting recovery credentials appropriately. Require named access where supported and a process for removing departed technicians.
Read service commitments precisely
Response means the provider acknowledges or starts work on a request under the contract's definition. Restoration means the affected service works again, perhaps through a workaround. A permanent fix can take longer. Ask what starts and pauses each clock, which hours count and how severity is assigned.
Use business examples to test the wording: one person cannot print; the entire office loses access to its order system; an account may be compromised. Identify the contact route outside normal hours and who can authorize emergency work. Match the commitment to the business's tolerance for delay.
Onboard, review and prepare for transition
- Establish a baseline. Reconcile the device, application and account inventories with the provider. Record gaps and owners.
- Test the service. Submit an ordinary ticket, rehearse escalation and verify that notifications reach the intended people. Use a controlled restore test for representative data.
- Approve a maintenance plan. State change windows, communications, rollback responsibilities and how exceptions are tracked.
- Review outcomes. Look at recurring incidents, aged tickets, restoration times, failed updates and unresolved risks alongside workload. A fast ticket closure can still leave a recurring problem.
- Maintain an exit pack. Keep an up-to-date inventory, diagrams, license records, support contacts and agreed export procedures. Test access removal when staff or providers change.
If reports show the same incident repeatedly, ask for its underlying cause, the proposed remedy and the cost of leaving it unresolved. Separate routine support improvements from projects that need a business case.
Use the editable support-scope worksheet before approaching providers. Ask each bidder to respond to the same fields, then keep the completed version with the agreement and review it when the business changes.