Most business owners don't know exactly what their IT provider does for security. The computers work and someone answers the phone. That's fine until something goes wrong and everyone finds out which jobs nobody was doing.
You don't need a technical background to check. You need the right questions and a sense of what a good answer sounds like. Here are twelve we'd ask, whether your IT is handled by an outside company, one person in-house, or us. A good provider will be glad you asked.
Accounts and access
1. Is multi-factor authentication turned on for email, remote access and every admin account?
A good answer is "yes," followed by how they enforce it and how they handle exceptions. A stolen password alone shouldn't be enough to get into your mailbox or your systems. Be wary of "most users" or "we were going to get to that."
2. Who has administrator access, and what happens when someone leaves?
You want a short, known list of admin accounts and a written offboarding checklist: accounts disabled, passwords changed, devices collected, and shared or forwarded mailboxes reviewed. If nobody can tell you who holds the keys, that's your answer.
3. How do you connect to our computers remotely, and is that access logged?
Remote support tools are useful, but attackers like them too. In one matter we handled, an attacker used a remote-desktop tool to move funds; see the remote-access fraud case study. A good answer covers how remote access is secured, who can use it and where the record of each session lives.
Patching and protection
4. How do updates and patches get applied, and how would I know they're done?
"Automatically" is a start, not an answer. Ask what happens when a patch fails, and whether firewalls and other network devices are patched too, not just laptops. Look for regular reports you can actually read. That's part of what our IT monitoring and maintenance service delivers.
5. Is endpoint protection on every device, and who looks at the alerts?
Security software that raises an alert nobody reads doesn't protect much. Ask who reviews alerts, how fast, and what they do next. Our cybersecurity services cover next-generation endpoint protection, managed firewalls and multi-factor authentication.
6. What protects us from phishing and fake payment requests?
Listen for email filtering, warnings on outside senders and security awareness training for staff. We once advised an executive who was thinking about removing the external-sender warning; our written recommendation was to keep it. See the business email compromise advisory and our article on holiday wire fraud.
Backups
7. When did you last test a restore, and what did you restore?
This is the most important question on the list. A backup job that reports "success" every night only tells you data was copied somewhere. A good answer includes a date, what was restored and how long it took. Our backup and disaster recovery service includes regular recovery tests.
8. Is at least one copy of our backups out of reach of ransomware?
Attackers often go after backups first. You want at least one copy that's offline, off-site or can't be changed or deleted for a set period, even by an administrator. Our article on the SafePay ransomware advisory explains why this matters.
Monitoring and response
9. Who's watching after hours and on weekends?
Ask what's monitored, by whom, and how you'll be told. Our inline threat management service inspects traffic at your firewall, endpoints and email as it happens, with around-the-clock monitoring and clear alerts.
10. If we're hit tomorrow, what's the plan?
A good provider can walk you through it: who calls whom, how affected systems are isolated, when your insurance carrier is notified, and how evidence is kept. That last part gets missed. Wiping and rebuilding a machine too quickly can destroy what you'll need to find out what happened; see why you should preserve digital evidence before you reset a device.
Documentation and planning
11. Do we have our own copy of the documentation and admin credentials?
Your network diagram, account list, licenses and admin credentials belong to your business. If you changed providers next month, could you keep running? A good provider documents your environment and makes sure you can get to it.
12. What are our three biggest risks right now, and what would you fix first?
This separates someone who keeps things running from someone who's thinking ahead. A good answer is specific to your business and comes with a plan and a budget. That's the job of IT strategy and virtual CIO services.
What the answers tell you
If the answers came back clear and specific, good. If you heard a lot of "I think so" or "we should probably look at that," you've found your to-do list.
Don't treat this as a reason to fire anyone. Share the questions with your provider and ask for written answers. Gaps often come from a patchwork of vendors where each one sees only its piece, which is the situation in our managed IT case study. For more on how one accountable team works, read One IT Team, One Flat Rate.
Frequently asked questions
What if we have an in-house IT person? Ask them the same questions. If they're stretched thin, co-managed IT can add help desk, security or project support without replacing anyone.
Get a second opinion
If you'd like someone independent to go through these questions with you, start with a free IT assessment. We'll review your setup, explain what we find in plain language and recommend next steps.
- New York: 631-982-4632
- Boca Raton, FL: 561-391-6057
- Hours: Monday–Friday, 9 AM–5 PM ET
- Request a free IT assessment
Executive Digital Group is a women-owned business founded by Tiffany Graziano and her husband, Michael Graziano. We provide managed IT, cybersecurity, digital forensics, OSINT and investigations, with remote support anywhere in the U.S. and worldwide.
Originally published on the Executive Digital Group website on November 9, 2026.