What UK Firms Should Check in Managed IT Providers

Choosing a managed IT provider can feel a little like giving someone the keys to your building.

You expect them to fix things, keep the doors secure and help when something goes wrong. But those keys also give them considerable access. Before handing them over, it is reasonable to ask who holds them, how they are protected and what happens if one goes missing.

That question has become particularly relevant in the UK.

The Cyber Security and Resilience Bill reached House of Lords committee stage in September 2026. Among its proposed measures is the introduction of regulatory duties for qualifying medium and large managed service providers. The government’s reasoning is straightforward: MSPs often have extensive access to multiple customers’ systems, networks and data, making them an attractive route for cyber attackers seeking a “one-to-many” impact. The Bill has not yet completed its passage through Parliament, and detailed requirements would follow through secondary legislation.

This is more than a regulatory story. It is a useful reminder for every organisation buying managed IT services in the UK.

Your IT provider is not simply another supplier. It may administer your Microsoft 365 environment, create user accounts, manage security tools, access sensitive data and coordinate your response to a serious incident. Choosing one should therefore involve more scrutiny than comparing monthly prices and asking how quickly the helpdesk answers.

Our view is simple: outsourcing IT execution can be an excellent business decision, but it does not mean outsourcing scrutiny. The right provider should give directors better visibility, stronger evidence and clearer decisions.

Here is what to examine.

1. Can they provide strategic IT leadership?

Many businesses begin looking for an MSP because support has become difficult. Tickets are slow, systems are inconsistent and technology decisions are being made five minutes before they become urgent.

Solving those problems matters. But a provider offering virtual IT leadership should do more than run an efficient helpdesk.

Ask how they will develop and maintain your technology roadmap. A credible answer should cover:

• Business objectives and expected growth
• Technology risks and technical debt
• Device and software lifecycles
• Security improvements
• Regulatory and customer requirements
• Budget priorities
• Upcoming projects and organisational change

Strategic IT planning should also have a rhythm. Will roadmap reviews happen monthly, quarterly or only when somebody remembers to arrange one? Who attends them? What decisions and actions will be recorded?

A roadmap does not need to be an elegant 40-page presentation that spends most of its life asleep in SharePoint. It needs to tell you what should happen, why it matters, what it will cost and when the business should act.

Good virtual IT leadership connects technology to growth, resilience and operational priorities. It gives management fewer surprises and more time to make sensible decisions.

2. Does “fully managed” actually cover the full job?

“Fully managed” is one of those phrases that can mean almost anything.

For one provider, it means answering support tickets and monitoring laptops. For another, it includes user onboarding, access management, vendor coordination, security operations, backups, governance, reporting and leadership advice.

Before agreeing to full IT outsourcing, map the complete responsibility model. At a minimum, establish who owns:

• End-user support
• Device monitoring and maintenance
• Microsoft 365 administration
• Joiner, mover and leaver processes
• Software licensing
• Patching and vulnerability management
• Identity and administrative access
• Email and endpoint security
• Backup and recovery
• Cyber incident response
• Internet, telecoms and third-party vendor issues
• Asset and lifecycle management
• Policies, compliance evidence and reporting
• IT budgeting and strategic planning

The NCSC recommends that MSP contracts include a clear matrix showing what the provider will do and what remains the customer’s responsibility. It also advises businesses to define incident notification, liability and technical reporting arrangements. Its guidance for SMEs was published in November 2025.

This matters because gaps rarely announce themselves politely. They tend to appear when an employee leaves with unnecessary access, a backup fails to restore or two suppliers each insist that the other one owns the problem.

The best outsourced IT model creates clear accountability. You should know who is responsible before the uncomfortable moment arrives.

3. Is the pricing genuinely predictable?

Predictable IT costs do not necessarily mean that every conceivable task is included in one flat fee. They mean you can understand the normal cost of running your environment and recognise what would cause that cost to change.

Ask providers to separate:

• Recurring managed-service fees
• Per-user or per-device charges
• Security licences
• 24/7 support costs
• Projects and major changes
• Onboarding or transition fees
• Hardware and software procurement
• Out-of-scope work
• Contractual price increases

It is also worth testing a few realistic scenarios.

What happens to the monthly price if you hire ten people? Is setting up each user included? What if the business opens another office, replaces a server or needs urgent assistance at the weekend? Are routine Microsoft 365 changes covered, or does each one become a small invoice?

A suspiciously low headline price often works like a budget airline ticket: perfectly real, but perhaps not the amount you will ultimately pay once you include the things required to complete the journey.

A good provider will be open about this. Predictable pricing is not about pretending projects never happen. It is about reducing ambiguity and helping leaders budget sensibly.

4. What does 24/7 monitoring mean in practice?

The phrase “24/7 monitoring” sounds reassuring, but it needs unpacking.

There is an important difference between:

• A tool collecting alerts around the clock
• A security operations centre reviewing those alerts
• A person taking action when something suspicious happens
• An engineer being available to help employees with general IT problems

These are not the same service.

Ask what is monitored, who reviews the alerts and what action can be taken without waiting for your approval. Find out whether the service covers endpoints, identities, email, cloud systems, firewalls and other business-critical infrastructure.

Then ask how incidents are escalated:

• Is the monitoring team staffed continuously?
• What qualifies as a critical alert?
• How quickly will containment begin?
• Who in your organisation will be contacted?
• Can the provider disable an account or isolate a device?
• Will you receive an incident report?
• Is general out-of-hours IT support included separately?

A dashboard noticing something at 2:13am is useful. A competent person investigating and containing it at 2:18am is considerably more useful.

The practical value of 24/7 monitoring lies in shortening the gap between suspicious activity and effective action.

5. Can they demonstrate their own security?

Your provider may hold privileged accounts across much of your environment. It is therefore reasonable to ask how the provider protects itself.

The NCSC recommends checking for recognised certifications such as Cyber Essentials Plus, ISO 27001 or SOC 2. Certification is not a magic shield, but it can provide independent evidence that important controls and processes exist.

You should also ask about:

• Multi-factor authentication for provider accounts
• Separation and protection of administrator identities
• Least-privilege access
• Security logging
• Staff screening and access removal
• Internal security training
• Vulnerability and patch management
• Incident response testing
• Backup and recovery arrangements
• Security controls applied to subcontractors and software platforms

The proposed Cyber Security and Resilience Bill reflects the significance of this risk. The government specifically identifies the trusted access held by MSPs as a reason they can become attractive targets.

Do not settle for “we take security very seriously”. Most organisations do, at least in PowerPoint. Ask for evidence.

6. Do they provide useful reporting and governance?

A long report is not necessarily a useful report.

Directors need information that helps them understand exposure, priorities and progress. Useful reporting might include:

• Support volumes, response times and recurring issues
• Device health and patching status
• Vulnerabilities and remediation progress
• Account and access risks
• Backup and recovery-test results
• Security incidents and trends
• Technology risks requiring a business decision
• Licence use and potential savings
• Roadmap actions, owners and deadlines

The UK government’s Cyber Governance Code of Practice says boards should gain assurance that supplier risk is assessed and that cyber strategy aligns with wider organisational strategy. It also recommends formal cyber reporting at least quarterly.

That does not require every director to become a security engineer. It does require the provider to translate technical information into business language.

“Four devices have critical vulnerabilities” is technical information.

“Four sales laptops remain exposed because an old application is blocking updates; replacement will cost £3,200 and should happen this month” is management information.

Look for the second kind.

7. Do they understand your industry?

Industry-specific IT support is not about decorating a proposal with the right sector terminology. It is about understanding which operational and information risks matter most in your environment.

A private healthcare provider may need careful handling of patient information, dependable clinical access and strong evidence for governance reviews. An asset management firm may place greater emphasis on access control, due diligence and sensitive communications. A creative agency may be particularly exposed to project deadlines, large-file workflows and client impersonation fraud.

Ask prospective providers about organisations with similar operating requirements, but do not rely on a logo slide alone. Explore what they learned, how their service differs by sector and which controls they would prioritise for your business.

The objective is not to find an MSP that knows every detail of your industry on day one. It is to find one that understands context, asks intelligent questions and can adapt its service accordingly.

A practical shortlist for UK SMEs

When assessing managed IT support for UK SMEs, directors should be able to answer ten questions:

1. Who will provide strategic IT planning and how often will we meet?
2. Which responsibilities are included, excluded or shared?
3. What will our normal monthly cost be?
4. What could generate additional charges?
5. What exactly is monitored 24/7?
6. Who investigates and responds to out-of-hours security alerts?
7. How does the provider secure its own privileged access?
8. What evidence will we receive about service quality and cyber risk?
9. How will backups and incident recovery be tested?
10. How will we retrieve our data, documentation and access if the contract ends?

If the answers are clear, specific and supported by evidence, you are probably having a useful conversation.

If every answer is “it depends” followed by a promise to confirm later, keep asking.

Choose the relationship, not just the toolset

Most established providers can offer remote support, endpoint protection, Microsoft 365 administration and monitoring tools. Those components matter, but tools alone do not create a dependable outsourced IT function.

The real difference is how the service is delivered: whether people respond with clarity, whether responsibilities are understood, whether risks are surfaced early and whether technology decisions support the direction of the business.

Recent UK guidance and proposed legislation point in the same direction. Managed providers occupy a position of considerable trust, so they should be selected and governed accordingly.

The best managed IT services UK businesses can buy should make technology feel calmer, costs more foreseeable and risk easier to understand. You should gain both capable hands for today’s problems and experienced leadership for tomorrow’s decisions.

Considering a fully managed IT service or virtual technology leadership? Schedule a call with Unizen to discuss what your organisation needs from its next IT partner.