Small Town Sysadmin
Free CJIS checklist

Tech basics

How to choose an IT company, and what a fair contract looks like

The questions to ask before you hire an IT company, the contract terms that protect you, and the red flags to watch for. Written for offices without an IT person.

For a small office without its own IT person, the IT company you hire is effectively your IT department. They’ll hold the keys to your computers, your email, and often your data. That’s a lot of trust, so it’s worth choosing carefully and getting the agreement in writing.

Questions to ask before you sign

About the work:

  • What exactly is included in the monthly price, and what costs extra?
  • How fast do you respond to an urgent problem? What counts as urgent? Is that in writing?
  • Who answers the phone after hours and on weekends?
  • Can you give us references from offices like ours, with a similar size and type of work?

About security:

  • How do you protect your own systems? IT companies are attractive targets, because breaking into one can mean breaking into all of its clients at once. The federal Cybersecurity and Infrastructure Security Agency (CISA) specifically warns small businesses about this risk.
  • What access will you have to our systems, and is it limited to what you actually need?
  • Do you use subcontractors, and would they have access to our data?
  • How are our backups done, where are they kept, and how often do you test restoring them? (See backups for a small office.)

About leaving:

  • If we part ways, what do we get back, and how fast? You want your passwords, documentation, and data handed over completely, without a fight.

What a fair contract includes

CISA’s guidance for organizations hiring IT companies recommends getting these things clearly in writing:

  • A clear list of services: what they handle, and what’s still your responsibility.
  • Response times and service levels: specific numbers, not “prompt service.”
  • Access rules: what the company can access, limited to what the job requires, and reviewed from time to time.
  • Maintenance and outages: how planned downtime is scheduled and announced, so updates don’t knock you offline in the middle of a workday.
  • Security responsibility: who at the company is accountable for keeping your systems secure.

And a few more that protect you:

  • Ownership: your data, accounts, and passwords belong to you. The contract should say so.
  • An exit plan: how records, passwords, and documentation are handed over if you leave.
  • Reasonable terms: watch for long automatic renewals and steep cancellation fees.

Red flags

  • They won’t say what’s included, or the answer changes each time you ask.
  • Only they know your passwords, and they won’t give you a copy.
  • They’re the only admin on your email or systems, with no account for you.
  • No clear answer about backups, or no memory of the last restore test.
  • Pressure to sign today.

Keep a master list yourself

Whoever you hire, keep your own list, in a safe place, of your important accounts: email administration, domain name, website, internet provider, and bank. If the company disappears, or the relationship goes badly, that list is what lets you keep running. The free important accounts master list is a ready-made sheet for it.

Sources

All articles