IT Support Companies near you

The first weeks are discovery, not support. A competent firm inventories every machine, every server, every cloud tenant and every line-of-business application, then documents how they connect. Until that inventory exists, nobody can honestly promise a response time, because nobody knows what is out there.

Next comes the credential handover. Domain admin, the Microsoft 365 or Google Workspace global admin, the domain registrar, the DNS host, the firewall, the backup platform and the phone system all have to change hands or be reissued. This is the moment to insist the accounts are created under your organization's name, not your provider's, and that you keep a copy of the credentials in your own password vault.

Only then should monitoring agents, patch management and endpoint protection go on. A provider that installs its tooling on day one and documents the environment later is working blind, and you will discover which machines were missed the first time something fails.

Almost every managed contract promises a response time by severity: an hour for a site-down event, four hours for a single user, next business day for a request. Response means somebody acknowledges the ticket and begins work. It does not mean the problem is fixed, and most agreements deliberately make no promise about resolution, because a failed hard drive or a vendor outage is outside the provider's control.

Read what coverage hours mean. Business hours support that ends at six in the evening Eastern is a different product for a firm with a West Coast office. Check whether after-hours work is billable, whether there is an on-call number that reaches a human, and what the escalation path is when the first technician cannot solve it.

Also check what the remedy is when the agreement is missed. In practice the usual remedy is a service credit against the next invoice, which is small. The more useful protection is a short termination notice period and a written exit obligation, so a provider that keeps missing its own targets can be replaced without a fight.

HHS says plainly that an IT contractor or vendor, including a managed services provider, that provides maintenance or support for systems and in doing so creates, receives, maintains or transmits electronic protected health information is a business associate of the covered entity. So is a cloud service provider engaged to store or process that information. The practice must obtain a written business associate agreement before disclosing patient information, and the business associate is directly liable for certain provisions of the HIPAA Rules, not merely contractually liable to the clinic.

The chain keeps going. HHS states that a business associate must have its own agreement in place with a subcontractor before disclosing protected health information to it, and that all downstream subcontractors are themselves business associates. If your IT firm uses an offshore help desk or a third-party backup vendor, those agreements have to exist too.

For firms handling customer financial information, the FTC's Safeguards Rule requires a written information security program with nine elements, including designating a qualified individual to run it, a written risk assessment, multi-factor authentication, and oversight of service providers through contracts that spell out security expectations. The FTC notes the rule reaches many non-bank businesses defined by activity rather than by name, such as mortgage lenders, tax preparation firms and investment advisers. If you are one of those, your IT provider is a service provider under that rule and the contract needs to say so.

CISA publishes Cyber Essentials as a guide for leaders of small businesses and small government agencies, organised around six areas it calls Yourself, Your Staff, Your Systems, Your Surroundings, Your Data and Your Crisis Response, with a toolkit that breaks each into smaller actions. It is a reasonable checklist to hand a prospective provider and ask which items they cover and which they do not.

The NIST Cybersecurity Framework 2.0 is the broader reference. NIST describes it as a taxonomy of high-level cybersecurity outcomes usable by any organization regardless of size, sector or maturity, and in February 2024 NIST added a sixth Function, Govern, alongside Identify, Protect, Detect, Respond and Recover. Version 2.0 is explicitly aimed at all organizations, not only critical infrastructure.

Neither is a certification and neither is mandatory for a private business. Their value here is as a common vocabulary: if a provider can map its monthly service to named outcomes, you can see what is in scope. If it cannot, the gaps stay invisible until an incident finds them.

The United States has no single federal breach notification law for ordinary business data. The FTC's data breach guide for business states that all states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information, so the obligation depends on where the affected people live, not where your office is. A company with customers in a dozen states may face a dozen slightly different clocks and content requirements.

Some states also require a report to the state attorney general. California, for example, requires any person or business that must notify more than 500 California residents of a single breach to send a sample copy of the notice electronically to the Attorney General.

If patient information is involved, the HIPAA Breach Notification Rule sets its own clock: individuals must be notified without unreasonable delay and no later than 60 days after discovery, and a business associate must notify the covered entity within the same 60 days. Your contract should say the provider tells you immediately, preserves logs, and cooperates with a forensic investigator, rather than quietly cleaning up and moving on.