How to choose a local IT company: checklist and questions

To choose an IT company, compare providers on five things you can verify: who owns your accounts, exactly what work is covered, how support requests are handled and when, how the provider secures its own access to your systems, and how the arrangement ends. Ask every provider the same questions, get the answers in writing, and compare scope before you compare price. The checklist below works for any provider, including us.

What should you decide before contacting anyone?

Ten minutes of preparation makes every conversation more useful. Write down:

• People and devices. How many staff, computers, and locations, and whether anyone works remotely.
• Core systems. Email platform, where files live, any local server, and the business software you depend on.
• What prompted this. A recurring problem, a project, a departing IT contact, or a wish for ongoing cover.
• What you need most. Fast help for staff, security and backups handled, on-site presence, or a single project done well.
• Any rules you work under. Patient data, payment cards, client financial records, or an insurer’s security requirements.

If you are unsure whether you need ongoing support or a one-time fix, our explainer on what managed IT is sets out the models.

The evaluation checklist

1. Account ownership

• Your domain name, Microsoft 365 or Google Workspace tenant, and backup account are registered to your business.
• You hold an administrator login of your own, and the provider is given separate access.
• Documentation of your setup is yours and is handed over on request.

This is the single most useful thing to confirm, because it determines how easy every future change will be.

2. Scope in writing

• The proposal names the users, devices, and systems covered.
• Recurring tasks are listed: updates, backup checks, account changes, network firmware.
• Exclusions are stated, along with the rate for out-of-scope work.
• Third-party subscriptions and hardware are shown separately.

3. Support process

• How you make a request (email, portal, or otherwise) and during which hours.
• What response expectations are agreed, and whether they differ by urgency.
• Whether on-site visits are included, limited, or billed separately.
• What happens when your usual contact is unavailable.

4. The provider’s own security

An IT provider holds powerful access to your systems, so their habits matter. A joint advisory from CISA, the NSA, the FBI, and allied agencies recommends that customer contracts “require MFA to be enforced on all MSP accounts used to access customer environments” and that provider access be limited to the systems being managed. (MFA, or multi-factor authentication, is a second sign-in step beyond the password.) Ask:

• Do you use multi-factor authentication on every account that can reach our systems?
• How do you store our passwords and documentation?
• Will you tell us promptly if your own systems are compromised?

The FTC’s vendor security guidance makes the same points for any vendor: put security provisions in the contract, limit access to what is needed, and require multi-factor authentication.

5. Backups and recovery

• What is backed up, how often, and where the copies are kept.
• When a restore was last tested, and how you will see the results of future tests.
• Roughly how long a recovery would take for your most important system.

Our business data backup guide explains what a sound backup setup looks like.

6. Reporting

• What you will receive regularly: update status, backup test results, open issues, upcoming renewals.
• Who you can talk to about planning and budgets, and how often.

7. Exit terms

• The contract term, renewal mechanism, and cancellation notice.
• What the provider hands back when the arrangement ends, and within what time.
• Whether any tools or licenses stop working when you leave, so you can plan replacements.

Questions to ask every provider

Ask the same questions of each and note the answers side by side.

1. Who will we deal with day to day, and who does the work?
2. What are your support hours, and what happens outside them?
3. What is included in the recurring fee, and what is billed separately?
4. How do you price projects and out-of-scope work?
5. Is there an onboarding fee, and what does onboarding involve?
6. Which security tools do you include, and who holds the licenses?
7. How do you document our environment, and can we see it?
8. How will we know backups are being tested?
9. Do you work with businesses in our industry, and do you coordinate with our software vendors?
10. What happens if we want to end the arrangement?
11. Do you carry professional liability and cyber insurance?
12. Can we start with a defined project before committing to ongoing support?

Should you choose a small provider or a larger firm?

Provider size is a real factor, and both ends of the range suit different businesses. Neither is better in general.

Factor	Smaller local provider	Larger firm
Who you deal with	Usually the same person or few people each time	Often a service desk, with different staff on different requests
Familiarity with your setup	Tends to be held by the people you talk to	Tends to be held in documentation and ticket history
Cover for absence and busy periods	Depends on the provider’s backup arrangements, so ask directly	More people available to absorb absences and spikes
Breadth of specialist skills	Depends on the individuals, often with outside specialists for niche work	More in-house specialists for areas such as compliance or large networks
Extended-hours support	Less commonly offered	More commonly offered, sometimes at extra cost
Flexibility of scope	Often willing to tailor scope or take single projects	Often standardized packages with minimum sizes
On-site visits	Often straightforward if they are nearby	Varies by where their staff are based

Questions that help with a smaller provider: who covers when you are unavailable, and where is our documentation kept so someone else could step in? Questions that help with a larger firm: will we have a consistent contact, and is there a minimum size or package we need to fit?

Match the answer to what you wrote down earlier. A practice that needs extended hours has different needs from an office that wants one familiar person who knows its setup.

Does “local” matter?

It matters for some work and not for other work. Most day-to-day support, such as account changes, software problems, and email issues, is done remotely whoever you choose. Being nearby makes a difference for network and Wi-Fi problems, cabling, new computer installs, cameras, and office moves, where someone needs to be in the room. If your needs lean that way, ask how on-site visits are scheduled and charged. For reference, we are based in Laguna Hills and work on-site across Orange County.

What to read closely in the contract

• Term and renewal. Whether it renews automatically and how much notice is needed to stop.
• Scope changes. How new users, devices, or locations change the price.
• Rate for extra work. Hourly rate, minimum charge, and travel.
• Ownership. A plain statement that accounts, data, and documentation belong to you.
• Handover. What is returned at the end and how quickly.
• Liability and insurance. What the provider is responsible for.

Published market price ranges, useful for a sanity check, are in our managed IT cost guide.

Common mistakes

• Choosing on the monthly total. Differences in scope explain most differences in price.
• Skipping the ownership question. It is easy to fix at the start and awkward later.
• Not asking about absence. Every provider of every size should have an answer.
• Signing before seeing a written scope. A conversation is not an agreement.
• Evaluating once and never again. A short yearly review of scope and results keeps the arrangement useful.

A simple way to score providers

Give each provider 0, 1, or 2 on each of the seven checklist areas: 0 for no clear answer, 1 for a verbal answer, 2 for a clear answer in writing. A provider that scores well on ownership, scope, and exit terms is one you can work with confidently, and one you could leave cleanly if your needs change.

Common questions

How many IT companies should I compare?

Two or three is usually enough to see how scope and price vary. More than that tends to produce confusion, since proposals are rarely structured the same way. Using the same question list for each makes the comparison manageable.

Should an IT company be able to show me their documentation of my systems?

Yes. Documentation of your devices, accounts, licenses, and network is part of what you are paying for, and it belongs to your business. Ask to see a sample of how it is kept and confirm you will receive a copy on request and at the end of the arrangement.

Is it reasonable to ask for a trial project first?

Yes. A defined project with a clear deliverable shows you how a provider communicates, documents, and delivers, without a long commitment. Many providers are happy to work this way.

What if I already have a provider and I am not sure about switching?

Run your current provider through the same checklist. Often a conversation about scope and reporting resolves the concern. If you do decide to move, our guide to switching IT providers sets out the handover steps.

How Coastal Growth Co. can help

We are happy to be measured against this checklist. We agree the scope and price in writing before paid work, your accounts and documentation stay yours, and you can start with a single project. Read more on the managed IT and support page and the about page, or get in touch with your questions.