How to Choose an IT Services Provider in Ontario: 10 Questions to Ask

Choosing an IT services provider affects far more than the speed of the help desk. The provider may have access to administrator accounts, business systems, backups, security tools, cloud services and confidential information. Its processes can influence how quickly employees receive help, how well recurring problems are prevented and how prepared the business is for disruption.

Ontario businesses should therefore compare providers using a consistent set of operational, security and commercial questions. A polished proposal or low monthly price does not reveal whether the service scope, response commitments, documentation and exit process are suitable for your organization.

This guide explains what to ask, what evidence to request and which warning signs deserve closer attention.

Start by Defining What Your Business Needs

Before speaking with providers, document the environment and the problems you expect the relationship to solve.

Record:

  • Number of employees, devices and locations
  • Standard working hours and after-hours requirements
  • Remote, hybrid and on-site work patterns
  • Critical applications and business processes
  • Cloud and on-premises systems
  • Existing internal IT responsibilities
  • Security, privacy and contractual requirements
  • Recurring support problems
  • Upcoming projects, growth or office changes
  • Acceptable downtime for important systems

This information gives every provider the same starting point and makes proposals easier to compare.

Understand the Type of IT Relationship You Need

Not every provider offers the same operating model.

Break-fix support responds when something has already failed and is usually billed by time or incident.

Managed IT services provide an ongoing scope of monitoring, maintenance and support for an agreed recurring fee.

Co-managed IT divides responsibilities between an internal team and an external provider.

Project services cover defined work such as migrations, deployments, office moves or infrastructure upgrades.

A business may use more than one model, but responsibilities should be explicit. Problems appear when both parties assume the other is handling the same system, task or risk.

1. Which Services Are Included—and Which Are Not?

Ask for a written service description. It should identify whether the agreement includes help desk, remote support, on-site work, monitoring, patching, endpoint security, backup monitoring, Microsoft 365 administration, vendor coordination, procurement, reporting and strategic planning.

Ask specifically about exclusions. Major migrations, hardware installations, after-hours work, recovery from a security incident and support for industry-specific applications may be priced separately.

“Unlimited support” is not useful unless the provider defines the users, devices, request types, hours and activities covered by that phrase.

2. Who Is the Provider Best Equipped to Support?

A provider should understand organizations with similar size, technology, locations and operational requirements.

Ask:

  • Which industries and organization sizes do you support most often?
  • Do you support businesses with our mix of cloud and on-premises systems?
  • Can you work with an internal IT employee or team?
  • Do you provide on-site service in our locations?
  • Which technologies fall outside your expertise?

Relevant experience matters more than a long list of vendor logos.

3. What Do the Service-Level Commitments Actually Measure?

A service-level agreement, or SLA, should define how requests are prioritized and which timing commitments apply.

Clarify the difference between:

  • Acknowledgement: confirmation that the request was received
  • Response: engagement by an appropriate support resource
  • Work commencement: when troubleshooting begins
  • Target resolution: an objective rather than a guarantee
  • Escalation: when and how a request moves to another resource

Ask whether priorities are based on the number of users affected, the business impact, the availability of a workaround and the criticality of the system.

A promise to answer quickly is not the same as a promise to restore service quickly.

4. How Does the Provider Manage Cybersecurity Responsibilities?

Security should be explained through responsibilities and processes—not only product names.

Ask about:

  • Administrative and privileged access
  • Multi-factor authentication
  • Endpoint and email protection
  • Patch and vulnerability management
  • Security monitoring
  • Backup protection
  • Incident notification and escalation
  • Employee access to client systems
  • Subcontractors and third-party tools
  • Secure offboarding of technicians and clients

The Canadian Centre for Cyber Security recommends that organizations understand the sensitivity of their information, define security requirements and evaluate how a managed service provider protects systems and data.

Hiring an IT provider does not automatically transfer every security, privacy or legal obligation. The agreement should identify what the provider manages and what remains the client’s responsibility.

5. How Are Backups and Recovery Tested?

A dashboard showing completed backup jobs does not by itself confirm that important systems can be restored within the time the business requires.

Ask:

  • Which systems and data are protected?
  • How frequently are backups created?
  • How long are recovery points retained?
  • Where are copies stored?
  • Who monitors failed jobs?
  • How often are restores tested?
  • Which systems must be restored first?
  • What recovery times are planned?
  • Who coordinates the response during an outage or ransomware incident?

Backup, disaster recovery and business continuity are related but not identical. The provider should be able to explain the role of each.

6. What Happens During Onboarding?

Onboarding should be a documented transition, not an improvised exchange of passwords.

A useful process may include:

  • Asset and software inventory
  • Network and cloud discovery
  • Credential and administrative-access transfer
  • Documentation review
  • Deployment of approved management and security tools
  • Backup and security assessment
  • Identification of unsupported systems
  • Initial remediation plan
  • Employee communication
  • First-month service review

Ask which onboarding work is included, which remediation is separately quoted and when recurring billing begins.

7. How Transparent Are Pricing and Exclusions?

Compare the complete service scope rather than the headline monthly fee.

Clarify:

  • Pricing basis: per user, per device, per location or flat fee
  • Minimum monthly commitment
  • On-site charges
  • After-hours rates
  • Project work
  • Hardware and software licences
  • Travel
  • Onboarding
  • Security incidents
  • Annual price adjustments
  • New-user and new-location changes
  • Termination and transition fees

A lower proposal may simply exclude work that another provider includes.

8. Who Owns the Accounts, Credentials and Documentation?

The business should understand who owns and controls:

  • Domains and DNS
  • Microsoft 365 or cloud tenants
  • Administrator accounts
  • Backup accounts and recovery data
  • Hardware and software licences
  • Network documentation
  • Configuration records
  • Security-tool portals
  • Vendor agreements

Ask whether the client receives current documentation and appropriate administrative access. Restricting privileges for daily use is good security practice; preventing the organization from accessing its own systems and records is a different issue.

9. How Will the Provider Report Performance and Risk?

Useful reporting goes beyond the number of closed tickets.

Ask whether reviews cover:

  • Ticket trends and recurring issues
  • Response performance
  • Patch and update status
  • Backup results and restore tests
  • Security activity
  • Device and warranty lifecycle
  • Capacity or performance risks
  • Projects and recommendations
  • Technology budget planning

Reports should help the business make decisions, not simply prove that tools are running.

10. What Happens if the Relationship Ends?

Review the exit process before signing.

Clarify:

  • Contract term and automatic renewal
  • Notice periods
  • Early-termination charges
  • Credential and documentation handover
  • Data export
  • Licence transfer
  • Removal of management tools
  • Transition assistance
  • Final billing
  • Data retention and deletion after termination

A professional offboarding process protects both parties and reduces disruption during a provider change.

Ontario-Specific Considerations

For Ontario organizations, location may matter when support requires physical access to offices, cabling, networks, servers or employee devices. Ask where the provider has technical resources and which areas receive on-site service.

Also identify any privacy, security, insurance or contractual requirements that apply to your organization. PIPEDA requires organizations to use safeguards appropriate to the sensitivity of personal information, but it does not prescribe one vendor or product. Businesses in regulated sectors may have additional obligations that require qualified legal, privacy or compliance guidance.

Local presence is useful only when it is supported by a clear service model, appropriate expertise and documented commitments.

Red Flags When Comparing IT Providers

  • The service scope exists only in marketing language.
  • Exclusions are not documented.
  • “24/7” is used without explaining whether it means monitoring, ticket intake or technician availability.
  • SLA priorities and timing terms are unclear.
  • Security is described only through product brands.
  • Backup is offered without restore testing.
  • The provider keeps exclusive control of client accounts.
  • Project and after-hours charges are unclear.
  • There is no documented onboarding process.
  • References or evidence cannot be provided.
  • The agreement does not explain offboarding.

A Practical Comparison Checklist

Use the same checklist for every provider:

  • Service scope
  • Exclusions
  • Support hours
  • On-site coverage
  • SLA definitions
  • Escalation process
  • Cybersecurity responsibilities
  • Backup and recovery testing
  • Certifications and experience
  • Onboarding
  • Reporting
  • Pricing and adjustments
  • Documentation ownership
  • References
  • Termination and transition

Evaluating Access Group as Your IT Partner

Access Group provides IT services for small and mid-sized businesses across Toronto and the GTA, including IT support, infrastructure, cloud, procurement, cybersecurity, help desk and on-site assistance.

The right service scope depends on your users, systems, business hours, locations, security requirements and internal capabilities. A useful first conversation should therefore focus on your current environment and the outcomes you need—not a predetermined package.

Evaluating IT Support for Your Ontario Business?

Speak with Access Group about your current IT environment, recurring support issues, security priorities and upcoming plans.

Discuss Your IT Requirements

Frequently Asked Questions

What is the difference between managed IT and break-fix support?

Break-fix support responds after an issue occurs and is commonly billed by incident or time. Managed IT uses an ongoing service scope that may include monitoring, maintenance and support for a recurring fee.

Should an IT provider offer an SLA?

The agreement should clearly define service expectations. If an SLA is used, review priority definitions, coverage hours, response terms, escalation and any exclusions.

Is a local Ontario IT provider always better?

Not automatically. Local resources can help when on-site work is required, but service quality also depends on scope, expertise, processes, security, documentation and accountability.

What security questions should we ask?

Ask about privileged access, multi-factor authentication, patching, monitoring, backup, incident response, subcontractors, employee access and the division of responsibilities between provider and client.

What should happen when we change IT providers?

The outgoing provider should follow the agreed offboarding process for documentation, credentials, data, licences, tool removal, final billing and transition assistance.