7 Questions You Should Be Asking Your IT Provider Every Quarter (But Probably Aren’t)
Every business owner should sit down with their IT provider once a quarter and get direct answers on seven things: open vulnerabilities, backup test results, employee security behavior, network performance, compliance status, upcoming costs, and where you’re falling behind. If your provider only surfaces at renewal time or when something breaks, you’re paying for reactive support and calling it a partnership.
We run quarterly business reviews with every client, and we’ve noticed something: the owners who get the most value are the ones who show up with questions. Most don’t know what to ask. Here’s the list.
1. What Vulnerabilities Exist on Our Network Right Now?
Not “are we secure,” which invites a comfortable yes. Ask for specifics: how many systems are missing patches, whether endpoint protection is current on every device, and whether there were any near misses this quarter. A provider doing the job well can pull this up in minutes because they’re tracking it continuously. If the answer is vague, that tells you something.
2. When Did You Last Test a Full Backup Restore?
This is the question that separates real backup strategies from wishful thinking. Plenty of businesses believe they’re backed up right until the day they need a restore and discover the job has been silently failing for months. Ask when the last test restore ran, what’s actually covered, and where copies live. If the honest answer is “we’ve never tested a restore,” treat that as an emergency, because a backup you’ve never restored from is a hope, not a plan.
3. Are Our Employees Following Security Basics?
One person clicking one link is still the most common way small businesses get breached. Ask whether there have been unusual logins or risky behavior this quarter, whether everyone is actually enrolled in multifactor authentication (not just “we have MFA available”), and whether it’s time for another round of phishing simulation. A proactive provider raises these before you ask.
4. What’s Slowing Us Down?
Slow computers are a payroll expense. If ten employees each lose 12 minutes a day to lag, reboots, and glitchy software, that’s roughly 40 hours a month of paid time evaporating. Ask about recurring tickets, aging hardware, and whether anything in the environment is undersized for how your team actually works now. Your help desk ticket history already contains the answer; someone just has to read it.
5. Are We Still Compliant?
Whatever framework applies to you, HIPAA for healthcare, PCI-DSS if you take cards, CMMC if you touch defense contracts, the requirements shift. This matters in our market: Houston’s medical corridor and the defense and aerospace work spread across Dallas-Fort Worth mean a lot of local small businesses carry compliance obligations they inherited from their customers. Ask whether anything changed this quarter and whether your policies, software, or training need updating before an auditor asks first.
6. What Should We Budget for Next Quarter?
Good IT has no surprise invoices. Ask which licenses renew soon, which machines are approaching end of life, and what projects are on the horizon. Your provider should be handing you a 12-month hardware refresh forecast without being asked. Emergency replacements always cost more than planned ones, in both dollars and downtime.
7. Where Are We Behind?
The broadest question and often the most valuable one. What are businesses your size doing that you’re not? Which rising threats should you actually worry about, and which are noise? A provider who works with dozens of companies sees patterns you can’t see from inside one business. That perspective is a big part of what you’re paying a managed IT services partner for.
What If Your Provider Can’t Answer These?
That’s the real test. If these seven questions produce hedging, jargon, or a promise to “look into it,” or if your provider has never offered a quarterly meeting at all, you’re getting break-fix service at managed-service prices. Technology and threats both move too fast for an annual conversation.
Want a second opinion on what your current provider should be telling you?