IT Support Companies near you

Almost every service level agreement promises a response, not a fix. A one-hour response can mean an automated email acknowledging the ticket. Ask for the definitions in writing: what counts as a priority one incident, who decides the priority, whether the clock runs only during contracted hours, and what happens when the fault sits with a third party such as your connectivity provider or a software vendor.

Resolution targets are rarer and usually conditional. Where one is offered, read what suspends it. Service credits are the normal remedy and are normally capped at a share of the monthly fee, so they compensate for irritation rather than for a day of lost trading. If an outage would genuinely stop you trading, the protection lives in your continuity plan and your insurance, not in the credits clause.

The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by government for organisations of all sizes. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. IASME is the NCSC's delivery partner and runs the scheme through a network of certification bodies.

Basic Cyber Essentials is a self-assessment that is independently reviewed. Cyber Essentials Plus covers the same five controls but adds independent technical testing to confirm they work on real machines, which is why buyers treat it as higher assurance. The NCSC also states that a UK organisation with turnover under 20 million pounds that certifies its whole organisation is included in cyber liability insurance arranged by IASME.

There is a procurement angle as well. Procurement Policy Note 09/14 requires suppliers to hold Cyber Essentials for central government contracts advertised after 1 October 2014 that involve handling personal information or supplying certain ICT products and services. If you bid for public work, the certificate is often what lets you answer the question at all.

In nearly every arrangement you are the controller and the IT company is the processor: it decides nothing about why your data exists, only how it is stored and moved. Article 28 then requires a written contract, and the ICO sets out what it must contain. Processing only on your documented instructions. Confidentiality obligations on anyone with access. Security measures meeting Article 32. Controls on engaging sub-processors. Help with individual rights requests. Help with breach notification, impact assessments and consulting the ICO. Deletion or return of the data at the end. And the right to audit and to be given the information needed to demonstrate compliance.

The contract must also record the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of people involved. Most providers offer a standard data processing agreement, so the useful reading is the sub-processor list inside it. Offshore helpdesks, backup vendors and monitoring tools all appear there, and any transfer outside the UK needs either UK adequacy regulations or a safeguard such as the International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses, with a transfer risk assessment behind it.

The commonest bad ending is not an argument about money. It is discovering that the outgoing provider registered your domain, your productivity tenancy or your backup account in its own name, so what should be a handover becomes a negotiation. Check the registrant details now, while nobody is annoyed.

Write the exit into the contract from the start: notice period, the format and timescale for handing over documentation, credentials and encryption keys, how long the outgoing provider will cooperate with the incoming one, and confirmation that your data is returned or deleted afterwards. Deal with backups explicitly, because a backup set is usually the last place your data survives after the relationship ends.