43% of businesses experienced a cyber breach or attack during the previous 12 months, according to the UK Government's Cyber Security Breaches Survey 2025. That's the context for learning how to choose an IT support company in 2026. You're not buying faster ticket replies. You're handing someone admin access to Microsoft 365, Azure, endpoints, backups and regulated data.
Choose badly and you get a pleasant help desk that can't secure your tenant, integrate your systems, or restore you after an incident. Choose well and you get a partner who reduces risk, owns transformation, and proves both with evidence. Score for that.
Score the Four Areas and Verify Security First
Fix the weights before you meet anyone. Security and resilience 40%, technical capability 25%, service delivery 20%, commercial fit 15%. Don't soften them after a polished demo. A company that scores well on price and personality but poorly on security is a liability, not a bargain.
Map Access Before You Score
List everything the provider will touch. That means Microsoft 365, Azure, identity systems, endpoints, backups, line-of-business applications and any regulated data. Then require documented controls for privileged access, multifactor authentication, patching, incident response, backup restoration and supplier offboarding.
This discipline is rare. The Cyber Security Breaches Survey 2025 found 43% of businesses reported a cyber breach or attack in the previous 12 months, yet only 14% reviewed the cyber risk of immediate suppliers and 7% reviewed their wider supply chain. It also found only 11% of UK businesses required suppliers to hold any standards or accreditations. Don't copy that complacency.
Demand Evidence You Can Check
Ask every bidder for the same pack, in writing, with dates.
- Cyber Essentials status: Certificate, level and expiry date, not a logo on a slide.
- Penetration testing: Scope and date, plus how findings were closed.
- Staff vetting: DBS checks where pupils or vulnerable people are involved, and vetting proportionate to the sensitivity of the work.
- Insurance and notification: Cyber-insurance expectations and contracted incident-notification times.
- Recovery proof: A recent restore-test result, not a screenshot showing a successful backup job.
Use NCSC Cyber Essentials guidance as your floor. The scheme covers five technical controls, boundary firewalls and internet gateways, secure configuration, access control, malware protection, and security-update management. Certification must be renewed every 12 months, and basic certification for smaller companies is expected to cost approximately £300 to £500 plus VAT, while Cyber Essentials Plus pricing depends on network size and complexity.
Treat that certificate as a starting point only. For a Microsoft estate, test named competence in conditional access, Entra ID, Defender, Intune, backup independence from the tenant, and secure Power Platform and Dynamics 365 integrations. Generic cloud expertise earns no marks.
Exit belongs in the security score too. Require a written method for returning data, revoking admin access, transferring documentation and deleting copies held by the supplier. There's a useful distinction in data destruction versus deleting files, and your contract should reflect it. Deleting a shortcut isn't destruction, and removing a login isn't offboarding. Our own guide to a third-party risk assessment will help you structure that supplier check.
Reject rule: If a bidder can't explain exactly how tenant-admin privileges are controlled and logged, or how your data is returned and deleted at exit, stop scoring and reject them, however attractive the fee.
| Area | Weight | What good looks like | Reject if |
|---|---|---|---|
| Security and resilience | 40% | Documented MFA, patching, incident response, backup restore and offboarding | Cannot explain tenant-admin control or data return and deletion |
| Technical capability | 25% | Proven Microsoft 365, Azure, Entra ID, Defender, Intune and integration skills | Only generic cloud claims or help-desk badges |
| Service delivery | 20% | Named owner, measurable response and restore targets, reporting and on-call cover | A single vague response-time promise |
| Commercial fit | 15% | Clear GBP scope, monthly terms and an exit plan that matches the estate | Cheapest per-user price with licensing, projects and exit excluded |
Total the scores only after you've seen evidence. Sales confidence isn't evidence.
How to Run the Selection From Brief to Reference
Run one sequence for every bidder. If you let each firm define the test, you'll compare presentations, not capability.
Seven Steps, Same Test
Write a one-page brief. Cover headcount, each East Midlands site, line-of-business software, what counts as an outage, and any charity, school or regulated-data duty. Say which systems stop the business when they stop. The usual slip is writing a device list and calling it a brief.
Longlist three to five firms. You need strong remote support and practical on-site attendance in Lincoln, Nottingham, Leicester, Scunthorpe, Grimsby or Newark, wherever your people work. A national call centre that can't attend site when hardware fails isn't local cover.
Send the same evidence request. Security pack, a sample monthly report with real measures, the on-call rota, named account ownership and two references. Use a structured RFP IT template so answers land in the same order and gaps are obvious. Don't accept a brochure instead.
Mark against the fixed weights. Score what's evidenced, not what's promised. If the security pack is thin, the security score is low. Don't rebalance the sheet to rescue the firm you liked most.
Meet the engineers. Insist on the people who'd own your account, including a director-level contact, not only the salesperson. Ask who holds tenant-admin rights, who does out-of-hours escalation, and who covers holidays. Vague answers here predict vague ownership later.
Call a comparable reference. Similar Microsoft estate, similar spread of sites, similar regulatory pressure. Ask about a serious incident, a missed target, and a project handover. Happy generalities tell you nothing.
Price only the survivors. Build the full cost in pounds for firms that cleared the security bar. Anything else rewards unsafe firms for being cheap.
One Point of Contact for Third Parties
Prefer a contract that can cover third-party applications through one point of contact, so your team isn't passed between vendors when finance software, a phone system or a sector application fails. We can customise IT support agreements to cover any requirement, including third-party applications, providing one point of contact. Whoever you choose, get that scope named application by application.
Keep a short log of every promise made in meetings, with dates. Carry only the top two firms into contract drafting, and pause the process if a bidder won't share engineers or references. Reluctance at this stage won't improve after signature.
Write Service Levels You Can Actually Measure
Turn your brief into clocks before anyone signs. Define priority by business impact, not by who shouts loudest. A production outage affecting every user is P1. One person with a workable workaround is P3, even if that person is senior.
Separate the Four Clocks
Specify acknowledgement, engineer engagement, restoration and resolution separately. These are different events. An automated email is acknowledgement. A qualified engineer working on the cause is engagement. Users able to work again is restoration. The underlying fault closed and documented is resolution.
A remote note saying your ticket is open is not a restoration, and you shouldn't pay for it as if it were.
The UK Government Contract Management Playbook recommends KPIs and SLAs be SMART, specific, measurable, achievable, realistic and time-bound. Ask how performance is measured, how it's reported, and what happens when a level is missed. Put service credits in writing while you still have influence.
| Priority | Business impact | Acknowledge | Engineer starts | Restore target |
|---|---|---|---|---|
| P1 | All users or a critical system is down | 15 minutes | 30 minutes | 4 hours |
| P2 | Several users or a key application is degraded | 30 minutes | 2 hours | 1 business day |
| P3 | One user and a workaround exists | 4 business hours | Next business day | 3 business days |
| P4 | A request or minor change | 1 business day | Scheduled | Agreed date |
Treat those numbers as a starting draft to edit for your operating hours and risk, not as universal law. If you trade evenings or weekends, your P1 clock must run then too.
Report What Matters Monthly
Require a monthly pack covering first-response time, mean time to restore, repeat incidents, backlog age, change success rate, patch compliance, backup-test success and customer satisfaction. If a provider can't produce an anonymised version from the last 12 months during due diligence, they won't produce a good one for you. It also helps to independently track your application's availability so you're not marking the supplier's homework using only the supplier's figures.
Watch for three traps. A single response-time metric hides slow restoration. Excluding all third-party outages makes nobody accountable for chasing the third party. Buying the cheapest per-user package before modelling project, licensing, after-hours and exit costs gives you a fiction, not a budget.
Put UK GDPR processor duties in the written contract. For a notifiable personal-data breach, name who investigates, who preserves evidence, who contacts the ICO within the required window, and who updates your leadership while facts are incomplete. An informal promise of quick help won't survive a real incident at 2am.
Add Up the Real Cost in Pounds
Compare proposals in pounds sterling only. If a template or overseas benchmark shows US dollars, convert the idea into GBP and rebuild the lines for your estate. Copying a foreign per-user figure into a UK budget is how boards approve numbers nobody can deliver.
Here's the comparison that matters. Analysis cited by the UK Government on the economic impact of cyber attacks put the estimated average cost of a significant cyber attack against an individual UK business at almost £195,000 in 2025. A cheap plan that skips backup testing, conditional access work or incident rehearsal isn't a saving. It's an unpriced risk.
Build One Yearly Total
Add the monthly support fee, Microsoft 365 and Azure licensing you still pay, project days, after-hours cover, on-site visits, cyber tooling and the cost of leaving. Then model three years, including headcount growth and one realistic project, not just the first quiet month.
Ask what's included. Our IT support services include unlimited phone support, unlimited remote support, regular onsite visits if required, director level contact, and plans to suit most budgets, with convenient monthly payment options. For larger companies, we create a plan that can include specialist skills support, project execution, holiday cover or a disaster recovery plan. Use that shape of question with every bidder, and check our notes on managed IT support pricing before you compare totals.
| Cost line | Question to ask | Watch-out |
|---|---|---|
| Monthly support | Is phone and remote support unlimited or hour-capped? | A low fee that meters every call |
| Microsoft licensing | Who pays for Microsoft 365 and Azure, and who administers it? | Support priced as if licences were included |
| On-site visits | Which East Midlands sites are included and which are chargeable? | Travel appearing only after signature |
| After-hours cover | Is 24×7 monitoring and call-out in the fee? | Evenings billed as projects |
| Projects and holiday cover | Are migrations, overflow and staff absence day-rate or included? | A help desk that cannot cover change |
| Exit | What is charged to return data, documentation and admin access? | A cheap start with an expensive departure |
Reject a quote that excludes third-party applications you rely on daily and prices them later as extras. That isn't a lower price. It's an incomplete one.
Tell a Help Desk From a Transformation Partner
A fast queue proves a firm can answer tickets. It doesn't prove it can change how your organisation works, connect your systems, or keep an AI rollout safe.
UK government research in the managed service providers market report 2025 found only 14% of providers referenced system integration in their offerings, while just 5% referenced IT support for operational technology. That gap matters if you're adopting Microsoft 365, Azure, Dynamics 365, Power Platform or Copilot.
Ask for Architecture, Not Badges
Require evidence of architecture ownership, data-migration experience, API and identity integration, adoption measurement, documentation and support after go-live. A Microsoft badge might show a sales threshold. It doesn't show who designed the conditional access policies, cleaned the data before migration, or measured whether staff adopted the new process.
For Copilot or other AI tools, test the unglamorous work first. Can the provider assess data quality, permissions and information leakage before deployment? If overshared SharePoint sites and loose Teams permissions stay untouched, Copilot will surface the wrong material faster. That's your problem, delivered efficiently.
The short briefing below is worth watching before you interview transformation candidates, because it separates reactive cover from accountable partnership.
The Neglected Question
Ask what happens when the project finishes. Your contract should name who owns the solution design, licences, automation flows, security settings, documentation and ongoing optimisation, plus exit assistance if the relationship ends. If the builder keeps the knowledge and you keep the invoice, you haven't bought a capability. You've rented one.
Culture shows up here too. A good partner gives plain advice on whether your current estate is poor, salvageable or sound, whoever supplied it. For many medium-sized businesses, our support is generally based on a hybrid cloud system that integrates existing on-site servers with the cloud, because forced replacement wastes money. Score this transformation capability inside your 25% technical block. Don't invent a fifth weight to excuse a weak operator.
Questions to Put to Every Bidder
Put the same questions to every bidder, record the answers in writing, and score them against the four areas. Verbal assurance in a meeting isn't contract language, and it won't help you during an incident or a dispute.
If you need a broader due diligence frame for software suppliers, this Italian overview on how to valutare i fornitori SaaS is a useful cross-check. Adapt the discipline to UK GDPR and your Microsoft estate.
| Question | Strong answer | Red flag |
|---|---|---|
| Who holds tenant-admin rights? | Named roles, conditional access and logged elevation | Shared admin logins |
| Which certificate is current and when does it expire? | Certificate and expiry date supplied in writing | Old logo without a renewal date |
| Who handles a personal-data breach? | Named investigator, evidence owner and ICO contact within 72 hours | Breach handled as an ordinary ticket |
| What happens when a target is missed? | Monthly report with service credits | Single response-time metric only |
| Who owns the work after go-live? | Client owns design, licences, flows and documentation | Ownership left vague |
| What does exit cost? | Data return and admin handover priced in advance | Charges appear only at departure |
| Is advice on the estate candid? | Plain verdict, poor, salvageable or sound | Recommendations that always need new kit |
Add two more questions in the meeting. Which named engineer and director stay accountable for your account, and how are holidays and after-hours covered? Can they name a reference with a similar Microsoft estate and sites across the East Midlands who'll discuss a difficult incident, not just renewals?
Scoring discipline: A red flag doesn't get balanced out by charm, a discount, or a fast first response. Lower the mark and write down why.
If the answer on breach ownership, admin rights or exit changes depending on who you ask in the firm, you've learned something important. Believe the inconsistency.
Book the Review and Make the Call
Keep the two firms that cleared the security bar. Rescore them on the same sheet, bring your one-page brief, and list every question the proposals still dodge. Hold the weighting firm. A polished presentation is not evidence.
Book a working session, not another demo. F1Group offers a free, no-obligation consultation with a local IT specialist, and a free IT review that identifies IT solutions to implement and what may be done to keep your IT services running smoothly. Use that time to test security evidence, Microsoft capability, reporting discipline, and whether the price in pounds covers your real estate. Push past the help desk. Ask who owns tenant design after go-live, who carries a rollout from build to adoption, and who answers when the project team leaves.
End the meeting with a yes, a no, or a short list of evidence still required before signature. If admin rights, restore tests or exit terms stay vague, stop. File each reference call date with your score sheet so the decision can be defended at renewal or in a dispute, then diarise the certificate expiry and first monthly report from day one.
Request your free consultation and bring your toughest questions. A provider worth hiring will welcome them.