What should I ask about a managed IT provider’s past security incidents?

Ask the seller to describe every incident, including near misses, in writing. Request any reports prepared at the time and any correspondence with affected clients. Ask how the problem was detected, how long it took to contain, and whether clients heard from the provider or from someone else first. The way clients were told matters as much as the event.

Check for fallout. Did any client leave, ask for compensation or start a dispute? Is any claim still open? Ask your lawyer about reporting duties and about any insurance that responded. Ask the seller whether the provider has coverage for this kind of event and what it excludes.

Then look at the provider’s own protection. Ask how staff accounts are secured, who has the most powerful access, how remote tools are controlled and how backups are tested. A guide to baseline controls for small organizations can serve as a checklist. Finally, ask what changed after each incident and whether the changes are still followed today. Remember that an incident record is only as honest as the person describing it, so check what the seller says against client emails and ticket history. Any gap deserves a calm follow-up question.

Key takeaways

• Ask for a written account of each incident, including near misses.
• Find out how clients were told and whether any dispute is open.
• Check the provider’s own safeguards against a baseline checklist.