Choosing an IT provider: the NCSC checklist for small businesses

If someone else looks after your computers, email, backups or website hosting, they are what the National Cyber Security Centre (NCSC) calls a managed service provider, or MSP. For many small firms that is the person or company who "does the IT". It is also a supplier with a great deal of access to your systems and often to your customers' details. The NCSC has published guidance on choosing one, and it is practical enough to turn into a set of questions you can ask this week.

Why the choice matters

The NCSC says MSPs often have access to your systems and data, which may include customer details. Its reasoning is simple: checking a provider's security before you sign reduces the risk of data breaches, downtime and regulatory penalties. The guidance is written for small and medium-sized organisations (larger ones with more than 250 people are pointed to different NCSC cloud guidance).

The wider picture explains why this is worth an hour of your time. The NCSC's small organisations guide says there are 5.5 million small organisations in the UK with between 0 and 49 employees, and that one in two small businesses suffers a cyber incident every year. Most small firms do not have an in-house IT person, so the supplier you pick is effectively your IT department.

Step one: check what they can prove

The NCSC suggests looking for certification as a starting point. It names Cyber Essentials Plus, which it describes as the UK government's minimum baseline standard for cyber security, and says you can check a certificate on the Cyber Essentials website. ISO 27001 and SOC 2 also indicate that a provider takes information security seriously.

It adds an important caution: a certificate does not replace configuring each service securely. A provider can hold a badge and still leave your own accounts poorly set up, so use the certificate as a conversation starter, not the end of the conversation.

The NCSC also recommends asking for references, especially from other small businesses, to judge how reliable the provider is and how they handle incidents. Finally, look for transparency: can they explain their services, policies and responsibilities clearly, and will they tell you quickly if something goes wrong on their side?

Step two: ask about the security basics

The guidance lists five areas to discuss before signing.

• Patching: ask for their update policy. The NCSC recommends patching critical or high-risk vulnerabilities within 14 days of release, and the checklist includes firmware as well as software.
• Backups: the NCSC calls regular, tested backups the most effective route to recovery from ransomware. Ask how often they run, where they are stored, who can access them, how often restores are tested and how the provider would recover you from a ransomware attack.
• Access: use two-step verification, give people only the access their job needs, remove it when they leave, and limit administrator accounts. Ask whether the provider protects its own access to your systems with two-step verification too.
• Logs: ask whether security logs are kept, for how long, and whether you or an incident response provider can see them. The NCSC suggests writing the retention period into the contract.
• Incident response: they should have clear steps for responding to an incident, for working with you, and for the case where the provider itself is affected.

Step three: read the contract for these points

The NCSC encourages a responsibilities matrix, a simple table showing what the provider handles and what stays with you. Alongside it, the contract should cover roles and responsibilities, whether the provider will tell you about its own incidents, who is liable for vulnerabilities and damage, and what technical reporting you will receive. That last point matters because insurers may ask for health or configuration reports to validate a claim.

On service levels, the guidance gives example figures. For response time (from logging an issue to the investigation starting) it cites one business day as standard for general requests and under one hour for urgent issues. For resolution time it gives two to three business days as a starting point for routine medium-priority issues. It notes that faster response times usually cost more, so decide which of your systems genuinely need the fast option.

Other contract details the NCSC highlights:

• Regular reviews and reports: scheduled audits can find unapplied patches, unnecessary admin rights and weak password policies. Health reports can cover uptime, patch compliance, backup success rates and security alerts, and they create an audit trail.
• Incident notification: set timeframes by severity. The NCSC points out that small firms are often less resilient to downtime, so these timings matter.
• Remote access: ask how the provider connects to your systems, for example through VPNs, encrypted tunnels or restricted IP ranges, and how administrative logins are protected.
• Length, renewal and exit: agree the term, renewal and termination terms so you keep flexibility if your business changes or the service slips.
• End-of-life systems: decide who tracks the dates when support ends and who advises on replacements, because unsupported systems can be exploited.

What to do this week

If you already have a provider, you do not need to switch. Use the NCSC checklist as an audit of what you have.

• Find your contract and check the term, the renewal date and the exit terms.
• Ask for a written list of what they do and what you must do yourself.
• Ask when your last backup restore was tested, and ask to see the result.
• Confirm that two-step verification is switched on for your admin accounts and for their access to your systems.
• Ask what happens, and how fast you are told, if they suffer an incident.
• Check that you hold the administrator logins for your own domain, email and hosting, so you are never locked out.

It is also worth knowing who to call if the worst happens. The NCSC response and recovery guidance gives 0300 123 2040 for a live attack in progress, a line it says runs 24/7, and it recommends reporting a significant attack to the NCSC through report.ncsc.gov.uk. It also points to a free Cyber Action Toolkit for sole traders and small businesses.

Getting a second opinion

You do not have to take your provider's word on any of this, and a good provider will not mind the questions. If you would like an independent view of how your hosting, backups and access controls are set up, our cloud and security team can review them with you. Either way, the aim is the same: know exactly who can reach your systems, what they have promised to do, and what happens on the day something breaks.