Questions to Ask Your IT Provider This Quarter

Published October 23, 2026 · Last reviewed October 23, 2026

Why quarterly beats an annual review

An annual security conversation tends to produce a long document that nobody reads. People join and leave, devices are replaced, and contracts renew, so the facts change faster than that. A short, regular meeting with the same few questions makes drift visible, and it keeps the provider and the business used to talking about evidence.

The model below fits a thirty-minute call. It works for a large provider and for the one person who looks after your office. If you have not yet agreed expectations, start with the eight questions in the MSP guide, then use this page as the maintenance routine.

The three standing questions

1. Who has administrator access today? Ask for the list from the console, with the date it was last reviewed. Compare the names with the people you know. Anyone you do not recognise, or who has left, is the first thing to fix.
2. What is not patched, and since when? Ask for devices that have missed updates for more than 30 days, and for any internet-facing device that appears in the CISA Known Exploited Vulnerabilities catalogue. A dated list is the answer; “we are up to date” is not.
3. When was a restore last tested, and what was restored? The answer is a date and a thing: a file, a mailbox or a server. See restore testing.

The rotating topic

Add one topic each quarter, so that the year has covered the main areas.

• Quarter one, access: multi-factor authentication coverage by account type, and the leaver checklist. Ask for the enrolment report and the date the last departed employee’s accounts were closed. See MFA for everyone.
• Quarter two, backups: which copy cannot be deleted by an administrator account, and how long a full restore would take. See immutable and offline backups.
• Quarter three, exposure: which services are reachable from the internet, such as remote access, firewall management pages and mail gateways, and why each is open. See internet-facing exposure.
• Quarter four, incident readiness: whether the call list is current, whether the insurer’s hotline is on the card, and whether the contract states a notification time. See the first-hour plan.

Running the call

Send the questions two days ahead so that the provider can pull the data. Ask that answers arrive as attachments or exports, and file them in a dated folder. In the call, spend the time on what changed since last quarter, not on reading out what is the same. End by agreeing on up to three actions with a name and a date next to each.

Keep the tone cooperative. The aim is a shared picture of your environment, not an audit of the provider. A good provider tends to value the routine because it makes its own reporting easier and shows its work.

A worked example, with invented details

In the first quarter of this hypothetical year, a 35-person firm’s owner asks the three standing questions plus the access topic. The administrator list has seven names, and one belongs to a contractor who finished work in the spring. The patch list shows one laptop that has not updated in 50 days because its owner works remotely and rarely restarts it. The last restore test was eight months ago. The three actions are: remove the contractor today, ask the remote worker to restart by Friday with the provider checking, and run a restore test next week. The next call confirms all three are done. Names and numbers are invented to show the rhythm.