Contents
Short answer
First clarify what support you actually need. Then check scope of services, responsibilities, response times, emergency availability and how administrator access is handled. Make sure you keep control of access, documentation and data – including for the case that you switch provider later.
Clarify your needs first
Types of provider
Roughly, you can distinguish classic IT providers or managed service providers (running workplaces and systems), IT security providers, managed security service providers (ongoing security operations), MDR providers (detection and response on endpoints) and incident response specialists (help in an acute incident). These are market terms, not legally defined categories; services overlap.
What support do you need?
Typical areas: workplace IT, Microsoft 365 or Google Workspace, backups, patch management, network, security monitoring, MDR and incident response. Write down which you handle yourself and which should be done externally.
Help in an emergency
For acute incidents, the German BSI publishes selection criteria and a list of qualified APT response providers. That list mainly targets serious, targeted attacks and is not a general recommendation list.
Provider checklist
- 1
Scope of services
Is it clear in writing what’s included and what isn’t?
- 2
Responsibilities
Who is responsible for backups, updates and security incidents – you or the provider?
- 3
Response times and availability
How quickly do they respond, including evenings, weekends and emergencies?
- 4
Cover
Is there a deputy if the main contact is unavailable?
- 5
Documentation
Are systems, configurations and access documented – and do you receive that documentation?
- 6
Access and MFA
How are administrator accounts and credentials managed and protected?
- 7
Subcontractors
Is any work passed to third parties, and do you know about it?
- 8
Data locations
Where is your data processed, where that matters to you?
- 9
Offboarding and contract end
How is access revoked and data handed back?
Step by step
- 01
Write down your needs
Record which areas should be supported externally and which downtimes are tolerable.
- 02
Talk to providers
Speak to several providers and ask them all the same questions from the checklist.
- 03
Weigh evidence
Certifications such as ISO 27001 can be a criterion. They don’t replace checking scope, responsibilities and actual implementation. A provider without a certificate isn’t automatically unsuitable.
- 04
Ask for references
Ask about experience with businesses of your size and sector.
- 05
Put responsibilities in writing
Before signing, clarify who is responsible for what – especially backups, updates and incidents. Have contracts reviewed by an expert if needed.
- 06
Review regularly
Once a year or after changes, check whether service and needs still match.
Who controls the administrator accounts?
External providers can have very far-reaching access to your systems. So check:
- Individual accounts for every person at the provider
- Multi-factor sign-in for all administrator accounts
- No unnecessarily shared admin accounts
- Permissions only as far as needed
- Logging, where appropriate
- Fast revocation when staff change or the contract ends
- At least one emergency administrator account stays in your own hands
What happens if you switch provider?
Prepare for switching from the start of the contract. Clarify how you get back or take over:
- Credentials and admin rights, including for cloud services
- Documentation and configurations
- Backups and data exports
- Domains and licences – ideally registered to your business
- An orderly handover to the new provider
- Revocation of all access for the previous provider
Checklist
- Needs are written down.
- Scope and responsibilities are clear.
- Response times and emergency availability are agreed.
- Admin accounts are individual, with MFA and limited to what’s needed.
- Domains, licences and an emergency admin account belong to your business.
- Documentation and data handover at contract end are agreed.
Common mistakes
- Choosing a provider before your own needs are clear.
- Assuming the provider takes care of “everything” without clarifying it in writing.
- Accepting shared admin accounts without MFA.
- Letting the provider register domains and licences in its own name.
- Treating a certificate as proof of actual security.
Frequently asked questions
Do we need an IT provider plus a separate security provider?
Not necessarily. Some IT providers cover security topics too. What matters is that responsibilities are clear and the services you need are actually included.
Is an ISO 27001-certified provider automatically secure?
No. Certification can be a criterion but doesn’t replace checking scope and implementation.
Who is responsible for backups?
That must be agreed explicitly. Without it, each side often assumes the other is taking care of it.
What do we do in an emergency if the provider can’t be reached?
Keep a deputy, your own emergency admin account and contacts for incident response help in your incident plan.
Should we have the contract reviewed?
If you’re unsure, yes. This page only provides orientation and doesn’t replace a contract review.
Sources
- BSI IT-Grundschutz – OPS.2.3 Nutzung von Outsourcing (Edition 2023)
- BSI – Qualifizierte Dienstleister (Auswahlkriterien und Verfahren)
- BSI – Cybersicherheit für KMU: Die TOP 14 Fragen (3. Auflage, PDF)
- ENISA – Cybersecurity guide for SMEs: 12 steps (2021)
Checked on 7 October 2026.
This content is for general guidance and does not replace individual legal, contractual or data protection advice.