Ten Security Questions to Ask Your IT Provider Every Quarter

Most small businesses outsource IT — which is sensible — and then assume security is included — which is often wrong. Many support contracts cover keeping things running, not keeping attackers out, and the gap only becomes visible after an incident. The fix is not distrust; it’s a standing 30-minute conversation every quarter, with the same ten questions each time.

The ten questions

• 1. Which of our systems missed security patches last month, and why?
• 2. Who currently has admin rights, and did anyone gain them this quarter?
• 3. When did we last successfully restore from backup — can you show me?
• 4. Is MFA on every mailbox and every remote access point? List the exceptions.
• 5. What security alerts fired last quarter, and what happened to each one?
• 6. Which departed staff accounts were disabled, and how quickly after they left?
• 7. What from our network is exposed to the internet right now?
• 8. If ransomware hit tonight, what’s the plan — and how long until we’re trading again?
• 9. What are you NOT responsible for under our contract that we should know about?
• 10. If you had one extra security dollar from us, where would you spend it?

How to read the answers

A good provider answers with evidence — patch reports, a restore-test log, an MFA coverage list. A great one raises problems before you ask. The red flag is vague reassurance: “it’s all under control” is not a report. Question 9 matters most — the honest answer draws the line between their responsibility and yours, and that line is exactly where breaches happen.

Make it stick

Put the quarterly review in your service agreement, ask for a one-page monthly report (patch percentage, backup tests, MFA coverage, incidents), and file the answers — they become your evidence pack for insurers, tenders and customer questionnaires. Thirty minutes a quarter turns “we assumed” into “we checked”, and that is most of what good security governance means at SMB scale.