Choosing an IT provider: NCSC's checklist, answered

Choosing an MSP

Do they hold recognised security certifications, for example Cyber Essentials Plus or ISO 27001?

We hold Cyber Essentials, certified through CyberSmart, an IASME certification body, and we are working towards Cyber Essentials Plus in the first quarter of 2027. We do not hold ISO 27001. For a five person firm the audit would cost more than it tells you, and Cyber Essentials Plus tests the same controls we put on your devices.

Can they provide references, testimonials or case studies from other SMEs?

Yes. Salcombe Distilling Co, Bond Legal and a South Hams farm are written up as case studies on this site, with the people named. Ask us for two clients in your sector and we will put you in touch.

Do they have a proven track record of security and service quality?

Salcombe Distilling Co has used us as its IT department since 2018. Bond Legal has passed Cyber Essentials two years running with us. Every ticket is logged with its response time and we show you the numbers at your review, not a marketing average.

Do they demonstrate transparency about their services and processes?

Every plan on this site lists exactly what is in it, with the price. The responsibility matrix says on one page what we own and what you own. Anything you decline is written down and signed, so nobody is surprised later.

Are their service levels, response times and uptime, clearly defined in SLAs?

Yes, in the service schedule for your plan. Response target is one business hour. Priorities are set by how many people are affected: Low, nobody blocked; Medium, one person; High, several; Urgent, a breach or the office down, which you phone in and we pick up.

Do they fit your needs and budget?

Plans run from £45 a person a month plus VAT, which is the realistic floor for a business that wants to be secure, with no fixed term and 90 days' notice. Support only without the security floor is £39. We quote after we have seen your setup. If you are a two person firm on L3 at the £150 minimum, you are still our client, not a nuisance.

Services NCSC says to ask for

Timely patch management for all systems and software

Critical updates within 14 days of release on every managed device, unsupported systems removed or isolated. Measured, not promised: our monitoring checks every device and the review shows you the result.

Automated, off site data backups and regular testing of restore processes

Microsoft 365 is backed up independently of Microsoft and a restore is tested every quarter. Servers are backed up with an offline or immutable copy. Both are in every plan from L3.

Security monitoring and logging, with alerts for suspicious activity

Every device is monitored around the clock with alerts for health and security events, and managed endpoint detection and response from L3. L5 adds people watching 24 hours a day and 12 months of logs.

Use of two step verification across all access points

Enforced on Microsoft 365 and every cloud service that supports it from L3, with no exceptions for convenience. Phishing resistant keys on L5. Our own admin accounts use it too.

Clear incident response and management procedures

A written incident response policy on L4 and a rehearsed one on L5. On every plan: you call, we pick up, and we tell you what we know, what we are doing and when you will next hear from us.

Application of timely security updates and firmware patches

Firmware on the firewalls, switches and access points we supply is updated in the monthly maintenance window, or automatically where the kit supports it. Kit we did not supply is updated by agreement once we have checked it.

Contract and agreement

Is there a detailed service level agreement?

Yes. The service schedule sets out hours, response targets by priority, what is included and what is charged separately.

Are roles, responsibilities and liabilities clearly defined?

Three documents: the responsibility matrix, one page of who owns what; the risk acceptance schedule for anything you choose not to do; and the liability terms in our agreement.

Does the contract specify how and when security incidents are notified?

We notify you of a security incident affecting your data or systems within 24 hours of confirming it, sooner if it is still live, and we help you with the 72 hour decision on whether to tell the ICO.

Are there provisions for regular reviews and reporting?

A written review every year on L3 and every quarter on L4 and L5, with a scorecard of every control, what changed and what to fix next.

Is the principle of least privilege applied to MSP access?

Our engineers use named accounts separate from their day to day logins, with multifactor authentication, and only the access the job needs. Access to your Microsoft 365 is through partner roles or named accounts in your own tenant, which you can see and block at any time.

Are there clauses for managing obsolete accounts and infrastructure?

Leavers are removed on the day you tell us. Our own engineers' access is removed on their last day with us. The review lists every account with access to your systems, and unsupported hardware and software is flagged for removal.

Is there a clear process for contract review, renewal or termination?

No fixed term, 90 days' notice either way. On exit we hand over admin credentials, documentation and your data, and remove our own access. It is written into the agreement.

Risk and responsibility

Have you assessed your MSP's supply chain risks?

We use a small, deliberate set of tools: Microsoft 365 through a UK distributor, remote monitoring and patching, endpoint detection and response, cloud backup, security awareness training, vulnerability scanning and an IASME certification body. Every one is named in your service schedule with where it holds your data, and we review the set each year. We hold Cyber Essentials ourselves.

Are accountability and liability for cyber security incidents explicitly documented?

Yes, in the agreement, the responsibility matrix and the risk acceptance schedule. We are insured for professional indemnity and public liability.

Do MSPs have a tested incident response and recovery plan?

We run the same tabletop exercise on ourselves that we sell on L5, and we test restores of our own systems on a schedule.

Are backup and disaster recovery procedures outlined and agreed upon?

Yes, per plan in the service schedule: what is backed up, how often, where it is held, how long it is kept and when the restore is tested.

Is there a process for regular security training and awareness?

Annual awareness training for your team on L3, monthly phishing simulations on L4 and L5. Our own staff do the same training and the same phishing tests.

Ask your current provider the same questions

Print this page, or send it to them. A good provider will answer every line without fuss. If the answers are vague, or the answer to the certification question is a shrug, you have learned something worth knowing.

Source: NCSC, Choosing a managed service provider, version 1.0, 24 November 2025. Our plans are on the Protect page. Written by Alex Robertson, Managing Director of IT WORKHOUSE, Kingsbridge.