A business buying IT support for the first time usually does it in a bad week, which is the worst moment to make a five-figure annual decision. The useful thing to know beforehand is that there is an order to this. A small number of things carry nearly all of the risk, they are cheap to fix, and a provider that proposes them first is behaving differently from one that opens with a platform. Knowing the order lets you read a proposal rather than be sold one.
What to fix in the first month
Four things, in this order. Multi-factor authentication on everything, because credential theft is how most incidents start. A backup of your cloud services that you have watched somebody restore from. Administrative accounts separated from daily-use accounts, so a compromised mailbox is not also a compromised tenant. And a list of leavers whose accounts are still live, which in most businesses is longer than anybody expects. None of these is expensive and together they remove most of the ordinary risk.
What can wait, and usually should
New hardware, unless machines are actually failing. A security platform, until the four items above are done, because layering detection over an estate with no multi-factor is paying to be told about the thing you could have prevented. A migration, unless something is genuinely end of life. A provider that proposes any of these before the basics is selling from its price list rather than reading your estate, and that is a useful thing to learn in the first meeting.
Getting the estate documented
Most first contracts start with an onboarding project, and it is worth what it costs if it produces something you own: an asset list, a network diagram, an application inventory with who owns each, licence counts, and the administrative credentials held somewhere you can reach without the provider. Ask explicitly whether that documentation is yours and what happens to it if you leave. A provider that treats your own estate documentation as its intellectual property is telling you about the exit before you are in.
Setting up an office or a new machine build
The two jobs that most often start a relationship are a new office and a standard machine build, and both are worth doing properly once. A standard build means every new starter gets an identical machine configured the same way, which turns a half day of improvisation into twenty minutes. A new office means cabling, wireless designed by walking the floor, and a circuit ordered many weeks early. Ask for both as fixed-price projects with a named deliverable rather than as hours.
Questions people ask about business it support services
What should a business fix first?
Multi-factor authentication everywhere, a tested backup of cloud services, separated administrative accounts, and closing the accounts of people who have left.
Do we need new hardware before signing a contract?
Rarely. Unless machines are failing, hardware refresh can follow the basics. A proposal that opens with hardware is reading its price list rather than your estate.
What should onboarding produce?
An asset list, a network diagram, an application inventory, licence counts and credentials you can reach without the provider. Ask who owns it if you leave.
What is a shadow IT policy for?
Deciding in advance what happens when a team buys its own software, which they will. A policy that says how to ask beats one that says no.