A managed IT provider should report to you regularly on your backups, security, hardware, Microsoft 365, spending and plans for the year ahead, without waiting for you to ask. If your IT provider only engages when things break, you’re receiving reactive IT support rather than proactive IT management.
We’re Stratus IT, a managed IT provider working with professional services firms across KZN and Gauteng, and we put together this checklist of 12 areas every business should hear about, with the questions to ask.
Why should your IT provider report to you regularly?
Every quarter or every six months, we sit down with the decision makers at our client businesses to tell them where they stand with their technology and what it will take to move forward. Most of those businesses are accounting practices, law firms, engineering companies, insurance brokerages and logistics operators with 20 to 150 staff, and nearly all of them run on Microsoft 365.
Plenty of businesses have never had a meeting like that. They hear from their IT provider when a laptop dies or an invoice needs approving, and the state of everything else stays a mystery.
Of course, what your provider reports on depends on what your agreement covers, so some of these areas may fall outside your current service. If they do, the checklist still helps you see where the gaps are and decide which ones matter to your business.
Take the questions below into your next meeting with your provider and pay attention to how they answer you.
1. Are your backups working, and could you recover from them?
Most backup systems send an email saying the backup was successful. That email only confirms the copy was made. It can’t tell you whether the copied files are complete, or whether they’d open if your server failed or ransomware locked your system. The only way to know is a restore test, where your IT provider retrieves files from the backup and checks they work. Your provider should be running these tests as part of your backup and disaster recovery setup and sharing the results with you.
Ask your provider:
- Are all critical systems and data being backed up?
- Were there any backup failures during the quarter?
- When was the last successful restore test?
- How quickly could the business recover from a major incident?
Review outcome: Clear confirmation that your backups are working and recoverable.
2. What are your biggest cybersecurity risks right now?
In a business of 20 to 150 people, the biggest security risks tend to be ordinary ones, like a laptop missing updates or a firewall nobody checks. Your provider should be looking for them and reporting what they find every quarter, ranked by how much damage each could do.
Those reports also help you meet your legal obligations. Under Section 19 of POPIA, any business that holds personal information must regularly check that its security safeguards work and update them as risks change.
Ask your provider:
- What are the biggest current security risks?
- Are there any exposed accounts or vulnerable systems?
- Are security patches up to date?
- Have there been any suspicious events or attempted attacks?
Review outcome: A prioritised list of security risks and recommended actions.
3. Which hardware is aging, and what needs replacing?
Every laptop, server, switch and firewall has a warranty end date and a point where the manufacturer stops releasing updates for it. Your provider should keep an up-to-date asset register that tracks both, so replacements can be planned and budgeted a year or two ahead. We build IT asset lists for our clients, particularly those who need them for insurance.
Ask your provider:
- Which computers, servers, switches or firewalls are aging?
- Which devices are out of warranty?
- Are any devices approaching end of life or end of support?
- What should be replaced over the next 6 to 24 months?
Review outcome: No surprise hardware failures or emergency capital expenditure.
4. Is your Microsoft 365 secure and properly set up?
For most of our clients, Microsoft 365 holds email, company files, user identities and a growing share of daily work, which makes its settings worth checking every quarter.
For example, when a client told us that staff would be travelling internationally, we reviewed their Microsoft 365 location policies in advance and made the appropriate controlled changes. This avoided access problems while ensuring the security policy remained intentional and documented.
Ask your provider:
- Is multi-factor authentication (MFA) properly enforced?
- Are administrator accounts secured?
- Are there inactive or unnecessary user accounts?
- Are mailbox permissions, sharing policies and security settings appropriate?
Review outcome: A Microsoft 365 environment that is actively managed rather than simply licensed.
5. Which problems keep coming back?
If your staff lose their connection to Sage every month-end, your provider should spot the pattern in your ticket history, find the cause and tell you what they’ve changed to stop it happening again.
Ask your provider:
- How many support tickets were logged?
- What were the most common issues?
- Are the same problems happening repeatedly?
- What can be changed to reduce future support requirements?
Review outcome: Fix recurring problems instead of repeatedly treating symptoms.
6. How healthy and resilient is your network?
Fibre faults or bad weather can cut an office off without warning, so your provider should be able to tell you whether a backup connection would take over. The network is also where businesses tend to pick up extra suppliers, with one company providing the fibre line and another looking after the firewall. When a problem crosses the line between them, your IT provider should take the lead in sorting it out with both, so you never have to referee.
Ask your provider:
- How healthy is the network?
- Are switches, wireless access points and firewalls performing correctly?
- Are there any bottlenecks or capacity concerns?
- What happens if the primary internet connection is down?
Review outcome: A clear understanding of network performance and business continuity risk.
7. What are you paying for, and do you still need it?
When someone leaves a company, their account usually gets blocked, but the licence often keeps billing every month until somebody removes it. Subscriptions taken out for a single project pile up the same way. Your provider should list what you’re paying for at each review and flag anything that is no longer necessary. .
Ask your provider:
- What software and licences is the business paying for?
- Are there unused or unnecessary licences?
- Are users on the correct Microsoft 365 plans?
- Are there opportunities to consolidate or reduce costs?
Review outcome: Technology spend remains appropriate and controlled.
8. What IT spend should you budget for?
Microsoft raised prices on most commercial Microsoft 365 plans from 1 July 2026, and existing customers move to the new pricing at their first renewal after that date (Microsoft). If your renewal falls later this year, your provider should already have raised it with you, alongside any hardware, security or connectivity projects coming up in the next two years.
Ask your provider:
- What expenditure should be expected over the next 12 to 24 months?
- Which upgrades should be prioritised?
- What projects are likely to require budget?
- Are there upcoming licence or service price increases?
Review outcome: IT becomes a planned business expense rather than a collection of surprise quotes.
9. How safe are your staff habits?
Many attacks rely on everyday habits: reusing one password across work and personal accounts, approving a Microsoft sign-in prompt nobody requested, or paying a supplier after an email says their banking details have changed. Saving client documents to a personal Google Drive or sharing them over unmanaged messaging platforms can create significant data-governance and POPIA risk.
Your provider should also be able to confirm that every former employee’s accounts have been closed and their company laptop recovered.
Ask your provider:
- Are staff following good cybersecurity practices?
- Have there been phishing incidents or risky user behaviour?
- Are unmanaged or personal devices accessing company information?
- Does additional security awareness training make sense?
Review outcome: Reduce the human element of cybersecurity risk.
10. Could your business keep running after a serious incident?
A disaster recovery plan is a written plan for getting your business working again after a major failure, such as a server crash or a cyberattack. It sets out which systems must be restored first and who is responsible for each step. For a law firm, that would usually mean email and the document management system.
The plan should also cover power cuts. A server that loses power suddenly can damage files, and getting it running again can take longer than the power cut itself. Backup power keeps your server running long enough to shut down safely.
Ask your provider:
- When was the disaster recovery plan last reviewed?
- Has recovery been tested?
- What are the critical systems that need to come back online first?
- What would happen if the office, server or cloud environment became unavailable?
Review outcome: Management knows how the business would continue following a serious technology incident.
11. What has changed, and what's coming?
Software vendors regularly change their products, support dates and terms, and your provider should be tracking the changes that affect your business. Windows 10 is a current example. For businesses still running it, the first year of Microsoft’s paid Extended Security Updates ends on 13 October 2026. The per-device price doubles each year after that, for up to three years, and a business that joins late must pay for the year it skipped (Microsoft). A deadline like this should reach you through your provider months in advance, with a count of affected machines and the cost of each option.
Ask your provider:
- What has changed in the IT environment during the quarter?
- Are Microsoft or other vendors making changes that affect the business?
- Are there new cybersecurity threats that require attention?
- Are there upcoming end-of-support dates or technology changes?
Review outcome: The business is informed before changes become problems.
12. Where is your technology heading?
Your provider should be able to show you what comes next on a single page instead of a 40-page technical report:
Where we are → What needs attention → What we’re doing next → What it will cost
Priorities move as risks get dealt with and the business grows, so the plan needs updating at every review. Without one, IT spend tends to follow whichever problem is loudest that week.
Ask your provider:
- What should happen over the next 3, 6 and 12 months?
- Which projects will improve security, reliability, productivity or scalability?
Review outcome: A roadmap your management team understands and can budget for.
How does your IT provider score?
Give your provider one point for each area they’ve reported on in the last six months. For a wider look at your setup, try our IT Self-Check.
| # | Area | What you should have received | Warning sign |
|---|---|---|---|
| 1 | Backup and recovery | Date and result of the last restore test | Backup emails, but no restore ever tested |
| 2 | Cybersecurity risk | A ranked list of risks and actions | You only hear about risks after an incident |
| 3 | Hardware lifecycle | A 6 to 24-month replacement plan with costs | Replacements happen after something fails |
| 4 | Microsoft 365 | A check of MFA, admin accounts and settings | Nobody has reviewed settings since setup |
| 5 | Support trends | Recurring issues and what was done about them | The same tickets, month after month |
| 6 | Network resilience | A backup plan if your internet line fails | Suppliers blaming one another |
| 7 | Licensing and spend | Licences and services you could cancel | Invoice lines nobody can explain |
| 8 | Budget forecast | A 12 to 24-month spend forecast | Large quotes arriving without warning |
| 9 | Staff security | Phishing incidents and leaver checks | Former staff still have working accounts |
| 10 | Disaster recovery | A tested plan with a recovery order | "We'll sort it out when it happens" |
| 11 | Changes and updates | Upcoming vendor deadlines and price changes | You find out about changes from an invoice |
| 12 | Roadmap | A 3, 6 and 12-month plan | IT plans that exist only in someone's head |
10 to 12: Your IT is being managed. 6 to 9: There are gaps worth raising at your next review. 0 to 5: You’re most likely getting IT support without IT management.
What should a true MSP be doing for your business?
At Stratus IT, we’ve supported professional services firms across KwaZulu-Natal and Gauteng for over a decade through our Managed IT service. We treat every client’s business the way we’d want our own treated, and part of that is meeting decision makers every quarter or six months to go through where their technology stands, what needs attention and what it will cost.
A true MSP should be helping you understand where you are, what your risks are, what needs to happen next and which technology decisions are coming.
FAQs:
What if my IT agreement doesn't cover all 12 areas?
Many support agreements cover fixing problems as they’re reported, and that’s a fair arrangement if it’s what you signed up for. If yours doesn’t include regular reporting, ask your provider what adding it would involve. Knowing which areas aren’t covered is useful in itself, because it shows you where your business carries risk that nobody is monitoring.
How often should my IT provider review my IT with me?
No law sets a schedule. We meet our clients’ decision makers every quarter or every six months. Reviews that happen less than once a year are unlikely to catch deadlines like the Windows 10 cut-off or a Microsoft price change before they cost you.
Does POPIA require my business to review its IT security?
POPIA doesn’t set a review schedule. Section 19 does require a business to regularly verify its security safeguards and keep them updated as risks change, and documented reviews with your IT provider are one practical way to show you’re doing that. Your legal adviser can confirm what applies to your business.
Will insurers or large clients ask about my IT?
A growing number of our clients are being asked by insurers or larger customers to demonstrate specific cybersecurity controls. Requirements vary, but commonly include areas such as MFA, endpoint protection, firewalls, backups, access controls and documented security practices. Records from each IT review, along with an up-to-date asset list, make those questions far easier to answer.
What should I do if my IT provider can't answer these questions?
Send them this checklist and ask for a review date. A provider who manages your environment should be able to answer most of it within a meeting or two, and vague answers after that are worth taking seriously.
