What IT and security providers do
- Help-desk support for staff, on site or remote.
- Devices, networks, Wi-Fi and phone systems.
- Cloud email and files, such as Microsoft 365 or Google Workspace.
- Backups and disaster recovery.
- Security: multi-factor authentication, patching, endpoint protection and staff training.
- Help reaching certifications that customers ask for.
Security frameworks and certifications
- Cyber Essentials (UK): a government-backed scheme run by the NCSC covering five basic technical controls. Some UK public contracts require it.
- ISO/IEC 27001: the international standard for an information security management system.
- SOC 2 (US): an AICPA attestation report often requested by business customers of software and service companies.
- NIST Cybersecurity Framework (US): free guidance for managing cyber risk, now at version 2.0.
- EU: the NIS2 Directive raises security duties for many medium and large organisations in key sectors.
Start with our cyber security basics for small businesses. For remote staff, see our sister site BestVPNs.
Questions to ask an IT provider
- What response times do you guarantee, and how is that written into the contract?
- How do you secure your own access to our systems?
- How do you back up our data, and how often do you test a restore?
- Do you provide support across our time zones?
- Will we keep admin access and documentation if we leave?
What affects the cost
Number of users and devices, sites, required response times, security tooling and whether projects are included. Many MSPs price per user or per device per month, with projects quoted separately.
Last updated: 16 October 2026
