How to choose a company for IT outsourcing? A practical decision map

First, count what you need

Choosing an IT outsourcing provider should not begin with comparing three similar quotes. First, establish the size of the environment, its critical systems and current gaps, such as untested backups, missing monitoring, accounts belonging to former employees, unclear administrator credentials or missing documentation. The provider can then price a defined scope instead of the vague label “IT support”. This also makes quotes easier to compare because every discussion covers the same users, critical systems, risks and support hours. The company should therefore prepare a short fact list before requesting a quote.

• How many workstations, locations, servers, devices and applications are to be supported.
• Which systems cannot tolerate downtime, for example ERP, email, sales, production or invoicing.
• How much does an hour of downtime really cost and who decides on priorities in a crisis.
• What risks are already known: backup, MFA, monitoring, accounts, licences, documentation and overdue updates.
• What support hours does the company need and what happens outside of them?
• Who makes decisions in the event of a critical failure, access change or security incident.

Start with the problem, not the subscription

IT outsourcing may mean helpdesk, server administration, network, Microsoft 365, backup, cybersecurity, monitoring or entire IT maintenance. Without determining what is critical for the company, you compare offers that look similar but carry completely different responsibilities.

Management decisions before signing the contract

The board does not need to be familiar with every administrative tool, but it should approve the risk level, budget, accountability model and exit conditions. Without these decisions, IT outsourcing easily turns into a subscription that only works for simple requests, and in the event of a critical failure, it leaves the company without the owner making the decision.

• Which company services have the highest priority and how much downtime is acceptable.
• What SLA level the company buys consciously, and not by default in the cheapest package.
• Who approves work outside of your subscription, changes to admin access, and security exceptions.
• What monthly reports should the management board or the COO receive?
• What must be transferred at the end of cooperation so that the company does not lose control over the environment.

Criteria that should be included in the contract

A good SLA is not a promise of "quick response". It should distinguish between response time, workaround time, repair time, priorities, channels for submitting requests, service windows, reporting and exclusions. A company with one location and 20 seats usually needs a different model than an organisation with 150 users in several cities. If ERP, email and invoicing are critical, the supplier should ask about the cost of downtime, backup, support hours, email applications, documentation status and access policies.

• Subscription scope and work billed separately.
• Response and recovery times for critical, high, medium and low failures.
• Rules for remote access, privileged accounts, MFA and logging of administrator activities.
• Requirements for backup, recovery testing, documentation and monitoring.
• Exit plan: agree acceptance of documentation, configurations, data, licences and ticket history, plus secure transfer of account control. Remove the former provider’s access and replace passwords, keys and access tokens known to them, accounting for service dependencies and continuity.
• Monthly reporting, escalation procedures and communication with users.

Comparison of offers without the lowest price trap

Two IT outsourcing offers may have a similar subscription plan but completely different levels of responsibility. Therefore, the comparison should include not only the monthly price, but also SLA, team competences, security coverage, reporting, out-of-hours service and the cost of exiting the contract.

• Price: check whether it covers only user reports or also administration, monitoring, backup, documentation and risk review.
• SLA: Compare response time, workaround time, repair time, support hours and escalation procedure for a critical failure.
• Risk: Assess MFA, privileged accounts, backup, EDR or antivirus, subcontractors and incident liability.
• Evidence: Require a sample report, takeover checklist, change log, backup status, and list of recommendations after 90 days.
• Ending the relationship: compare notice periods, handover costs and the support provided when changing suppliers.

Quality evidence worth asking for

A good IT outsourcing company should not base its credibility solely on sales presentation. Ask for a sample report, a description of the escalation process, a sample takeover plan, the scope of documentation and how to report risks. This allows you to check whether the service will be measurable after launch.

• Sample monthly report: tickets, priorities, response times, failures, recommendations and outstanding work.
• Template of an environment takeover checklist: accounts, licences, backup, servers, network, domains, DNS and documentation.
• Critical failure escalation procedure with contact persons and hours of availability.
• Administrator access policy, MFA, privileged accounts and activity logging.
• Evidence of an assessed management system, such as a current certificate of conformity to ISO/IEC 27001:2022, including its scope and validity.

IT provider evaluation checklist

Record the comparison in one table to avoid choosing on price and promises alone. Give each criterion a business weight, supporting evidence and a question for the provider.

• Scope: distinguish recurring services, project work and responsibilities retained by the customer.
• Escalation: specify who declares a critical incident, how often the customer receives updates and when higher support levels become involved.
• Security: check MFA, privileged accounts, backup, EDR or antivirus, remote access and incident handling.
• Evidence: request a monthly report, handover checklist, change log, backup test and risk review.
• Exit: agree documentation, secure transfer of account control, configurations, licences, ticket history and knowledge transfer.

Phased takeover plan

Check critical access, MFA, backups, monitoring and escalation at takeover. Address urgent gaps according to risk from the outset. Reviews after 30/60/90 days measure progress; they do not defer baseline safeguards.

List of interview questions

Bring a checklist to the provider meeting. Establish scope, response and recovery targets, responsibilities, evidence and exit conditions before comparing fees.

• What exactly is included in the subscription and what is billed separately?
• What is the response time and recovery time for critical, high, medium and low failures?
• Who supports the company outside working hours and is there a team behind the service, not one person?
• How are backups tested and what does data recovery look like in reality?
• What does reporting, escalation and contact person identification look like?
• How are documentation, account control and data handed over at the end of the contract?
• How are the former provider’s access and passwords, keys and access tokens known to them removed or replaced safely?
• Which risks are addressed immediately at takeover, and how is progress reported?

Should price be the main criterion?

Price is important, but it cannot replace assessment of scope, SLA, security and exit conditions. The cheapest subscription without inventory, backup, reporting and liability usually transfers the cost to downtime, user work and subsequent rescue projects.

• Compare what is included in the subscription and what becomes a paid project after signing.
• Check whether the price covers monitoring, documentation, Microsoft 365 administration and backup review.
• Treat low price with no SLA, no reporting and no takeover checklist as deferred operational risk.
• Ask how many people can support the environment, not only who will be the account manager.
• Evaluate the cost of a critical outage, rescue project or provider change against the monthly fee.
• Confirm that onboarding includes inventory, access cleanup, backup verification and a visible escalation path.

What should be included in an IT outsourcing contract?

At a minimum, this includes a precise scope, separately described subscription and project work, SLA with response and repair times, out-of-hours support rules, access security, backup tests, reporting and terms of termination of cooperation. A contract without these elements makes it difficult to enforce quality in the first major failure.

Billing models - what you usually get

Most often, you will encounter a subscription, a package of hours or a project settlement. The subscription gives you a predictable budget for ongoing maintenance, the hourly package fits irregular needs, and the project includes implementations, migrations or modernisations. In many companies, the best is a mixed model: a subscription for ongoing services plus separately billed projects.

• The subscription should include a service catalogue, a support-request channel, an SLA, reports and regular environment reviews.
• Bundled hours make sense for irregular support, but it's harder to enforce proactive maintenance.
• The project should have a scope, schedule, acceptance criteria, documentation and rules for handing over to maintenance.
• A mixed model is clearest when ongoing maintenance and larger changes are separated in reporting.

A good supplier also asks questions

A provider should establish the number of users, locations, critical systems, backup arrangements, support hours and security requirements before proposing a scope and fee. Missing information makes quotations difficult to compare.

• The provider asks about critical systems, downtime costs, decision owners and current user problems.
• The provider checks backup, MFA, documentation, administrator accounts, licences and overdue updates.
• Both parties agree incident priorities, response targets and escalation before signing the SLA.
• The provider explains monthly reporting, risk reviews and the conditions for ending the service.

Evidence to check before choosing an IT outsourcing provider

During handover, we review documentation, administrator accounts, MFA, backups, monitoring and escalation. Customer and provider agree decision owners, work scope and reporting. Urgent gaps need risk-based action from the start; 30/60/90-day reviews assess progress.

• The supplier prices the environment without asking about the number of systems, locations and risks.
• The contract promises "full service" but does not define priorities or exclusions.
• There is no sample monthly report or escalation process.
• There are no clear rules for transferring documentation after the end of cooperation.

Measurable outcome: choosing an IT outsourcing provider

A supplier decision affects downtime risk, user productivity, incident response, audit evidence and the cost of changing partners later.