IT Support Companies near you

Because there is no register to search, the checks that would normally take a minute have to be assembled yourself. Ask how long the company has operated under its current name, ask for clients of roughly your size in roughly your industry, and telephone two of them rather than reading a testimonial. Ask whether the firm carries commercial general liability and errors and omissions coverage, and ask to see the certificate rather than a claim on a web page.

Vendor certifications held by individual technicians are real qualifications, but they are issued by the vendors whose products they cover, not by a regulator, and they say nothing about whether the company will answer the phone on a Friday afternoon. Treat them as evidence of product knowledge and nothing more.

The more useful question is what security baseline the provider works to internally and will apply to you. The Canadian Centre for Cyber Security publishes baseline controls aimed at organizations with fewer than 499 employees, covering incident response planning, patching, malware protection, secure device configuration, strong authentication, employee training, backups, mobility, perimeter defences, cloud security, website security, access control and portable media. A support company that can walk you through that list and say where you currently stand is demonstrating something a certificate cannot.

The agreement should say which users, devices, sites and systems are covered, what response looks like for different severities, which hours are included, and what falls outside and is billed as a project. Vagueness here is where most support relationships sour: a firm that says everything is included rarely means it, and the disagreement arrives during an outage.

The Cyber Centre's guidance on contracting with managed service providers is a practical checklist for the rest. It advises contractually retaining legal ownership of your data, retaining the ability to receive a copy of a compromised virtual server for forensic analysis, and keeping the right to terminate if servers move unexpectedly, if security practices deteriorate, or if the provider is acquired by an organization you would not have chosen. It also suggests asking where the provider's infrastructure is located and whether storing data internationally creates legal risk for you.

On access, the same guidance is blunt: avoid giving a provider credentials or access to sensitive systems outside their responsibility, administer services from designated computers using multi-factor authentication, strong passwords and least privilege, and consider privileged access management so that access to your systems can be granted when needed and taken away afterwards. Standing administrator access to everything, held indefinitely, is a choice rather than a necessity.

PIPEDA's safeguards principle requires personal information to be protected against loss, theft and unauthorized access, disclosure, copying, use or modification, with safeguards appropriate to the sensitivity of the information. The Privacy Commissioner describes three kinds working together: physical measures such as restricting access to offices, technological tools such as passwords, encryption, firewalls and security patches, and organizational controls such as limiting access, staff training and agreements. PIPEDA does not prescribe particular technologies, which means the judgement about what is appropriate remains yours and has to be revisited as risks change.

In day-to-day terms that turns into a short list your provider should be able to evidence on request: patches applied on a known schedule rather than when someone remembers, multi-factor authentication on email and remote access, backups with at least one copy held offline, unique accounts with least privilege instead of shared logins, default passwords changed on network equipment, and logs that are actually reviewed. The Cyber Centre recommends offline backup copies specifically because they offer the most protection against ransomware, and recommends testing restoration rather than trusting the report.

Ask for a short monthly or quarterly report showing patch status, backup and restore test results, open security issues and accounts added or removed. A provider who cannot produce that is not measuring the work, and neither are you.

The duty to report sits with the organization accountable for the information, not with the contractor who was managing the server. Under PIPEDA, an organization must report to the Privacy Commissioner any breach of security safeguards involving personal information under its control where it is reasonable to believe the breach creates a real risk of significant harm, and must notify affected individuals as soon as feasible. Significant harm is defined broadly, covering humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss and identity theft. Organizations must also notify other organizations or government institutions that may be able to reduce or mitigate the harm.

Record-keeping applies to everything, not just the reportable events. Section 10.3 of PIPEDA requires an organization to keep and maintain a record of every breach of security safeguards involving personal information under its control, and to give the Commissioner access to those records on request; the Commissioner's guidance states the records are kept for two years. Quebec and Alberta add their own regimes: a Quebec enterprise must log every confidentiality incident in a register kept for at least five years, including incidents that carry no risk of serious injury, and must notify the Commission d'accès à l'information and the people concerned where the incident presents a risk of serious injury. Alberta's PIPA requires notification to the Commissioner without unreasonable delay under section 34.1 where a reasonable person would consider there is a real risk of significant harm.

None of that works if you learn about the incident late. Your support agreement should require the provider to notify you promptly on discovering a suspected compromise, to preserve logs and evidence rather than reimaging first, and to cooperate with the investigation. Agree now who assesses the real risk of significant harm, because that assessment is yours to make and the clock is short.