Choosing and managing an IT partner: selection, the SLA in plain words and an exit plan
How to choose an IT partner, agree a clear SLA and stay in control of your accounts, data and exit.
In this topic: IT and data 18
You find out how good an IT partner is on two days: the day the server fails in the busiest week of the year, and the day you decide to switch. On the first day, the SLA decides how fast someone helps. On the second, what counts is who holds the administrator passwords, in whose name the domain is registered and what the contract says about handing over. Both are settled when you choose an IT partner, long before either day comes.
The questions are the same for a firm that outsources all of its IT to one managed service provider and for a group that keeps its own IT department and buys in specialist help. Only the number of parties differs.
Outsource the daily work, not the control. Choose on security evidence, references and continuity rather than on the hourly rate. Agree response and resolution times per priority, keep admin accounts, domain names and licences in your own name, and agree the exit before you sign.
- Selection
- SLA
- Ownership
- Security
- Exit
When outsourcing IT fits: break-fix, managed service or co-managed
There are three common ways to work with an IT partner. They differ in who does the daily work, and in who notices when nobody does it.
With break-fix, you call when something is broken and pay by the hour. It looks cheap, but the partner earns from faults, and preventive work such as updates easily falls between the cracks.
A managed service providerManaged service providerAn IT company that runs part or all of a client's IT for a recurring fee, mostly remotely: support, updates, monitoring and backups. runs your IT for a fixed fee per user or device: service desk, updates, monitoring and backups. Its incentive is to prevent problems. Projects usually cost extra, so ask what the fee leaves out; see IT costs and TCO.
In co-managed IT, your own IT staff keep the first line and the business applications, while the partner adds what is hard to staff in-house, such as security monitoring or out-of-hours cover.
In every model, one person inside the organisation owns the relationship, such as the managing director, the controller or the IT coordinator. That person reads the reports and decides on budget and risk.
Selection criteria for an IT partner
The partner gets the keys to everything, so start with how it protects them. The hourly rate comes last.
| Evidence | What it is | What to check |
|---|---|---|
| ISO/IEC 27001 certificate | An internationally recognised standard for an information security management system; certification is done by independent, accredited bodies (source: ISO/IEC JTC 1/SC 27, 2026) | That the scope of the certificate covers the service you buy (source: ISO/IEC JTC 1/SC 27, 2026), and that it is current |
| SOC 2 report (AICPA) | An independent auditor's report on controls for security, availability, processing integrity, confidentiality or privacy (source: AICPA, November 2026) | Ask for type 2: it also tests whether controls worked over a period, which a type 1 does not (source: Microsoft, April 2026) |
| Cyber Essentials (UK) | The UK government's recommended minimum standard; Cyber Essentials Plus adds independent technical testing (source: UK NCSC, November 2026) | That the certificate appears in the public certificate search (source: UK NCSC, November 2026) |
- References: two clients of your size and sector you may call. Ask how the last major outage went.
- Continuity: at least two people who know your environment, and clear terms if the partner is sold.
- People: who answers the phone, who does the work, and how much goes to subcontractors.
- Fit: experience with your main applications counts for more than a long list of logos.
The SLA in plain words: response, resolution and availability
A service level agreement (SLA) records the service you may expect and what happens when the partner falls short. Most disappointments start with the gap between responding and resolving.
Response time runs until a qualified person starts working on your call; an automatic acknowledgement is not a response. Resolution time runs until the service works again, often through a workaround, with the root cause fixed later. A fast response says nothing about how long you will be without the system.
Both clocks run only during the agreed service hours. With office hours only, a fault on Friday evening waits until Monday morning, even at the highest priority.
| Term | What it means | What to check |
|---|---|---|
| Priority levels | Impact and urgency, from business stopped to one user with a workaround | Examples from your own business; who sets the priority, and whether you can raise it |
| Availability | The share of agreed service time in which a service works, as a percentage | Whether it is measured per month or per year, and whether planned maintenance counts. Worked example: 99.9% allows about 43 minutes of downtime in a 30-day month, or almost nine hours a year, possibly in one go. |
| Service credits | A fee reduction when targets are missed | Usually small, so also agree a right to terminate after repeated misses |
| Reporting | A monthly report on targets met per priority | Access to the underlying tickets, behind the percentages |
| Exclusions | What the fixed fee does not cover | A written list: projects, third-party software, out-of-hours work, site visits |
Who owns what: accounts, domain names and licences in your own name
The hardest moment with an IT partner is not an outage but a parting. If the partner holds the keys, you need its cooperation to leave.
- Switching needs the old partner's cooperation
- If the partner fails, you may be locked out
- You can switch without asking permission
- The partner gets only the access it needs
- Admin accounts: the top-level accounts belong to your organisation. For its cloud services, Microsoft recommends two or more emergency access accounts, so you are not locked out when, for example, the last global administrator leaves (source: Microsoft, June 2026). Keep these break-glass accountsBreak-glass accountAn emergency administrator account that is kept sealed and used only when normal sign-in fails, so the organisation cannot be locked out of its own systems. under your own control and test them regularly, for example every quarter (source: Microsoft, June 2026).
- Domain names: registered with your organisation as the holder, in a registrar account you control. For domains such as .com, moving a domain needs a transfer code that identifies the holder, and the registrar must provide it within five calendar days of a request (source: ICANN, November 2026).
- Licences: in your organisation's name, with a record of who resells them and how they transfer.
- Documentation and passwords: network diagram, settings and a list of systems where you can reach them, with passwords in a vault your organisation owns.
Security requirements for your IT partner
A partner with administrator rights on all your systems is also a route in for attackers. Official guidance is clear about what to require.
The UK NCSC's supply chain guidance works in four stages, shown below (source: UK NCSC, October 2025). It advises setting minimum security requirements in contracts, having them passed down to subcontractors and checking that this happens (source: UK NCSC, October 2025). If your own customers send you questionnaires about your suppliers, this is where the answers come from; see security questionnaires.
- 1Understand the risksWhich suppliers can reach your systems and data, and what a breach at each would mean.
- 2Establish controlMinimum requirements in the contract, passed down to subcontractors.
- 3Check your arrangementsEvidence that the requirements are met, not promises.
- 4Continuous improvementReview as threats, services and suppliers change.
For a managed service provider, the NCSC's guidance on partners that administer cloud services adds concrete points (source: UK NCSC, January 2023). The partner gets only the access its role needs, on specific accounts, when it needs them. Every technician signs in with a personal account and MFAMFAMulti-factor authentication: signing in with a second step besides the password, such as a code or an app on a phone., so every action traces back to a person. The partner informs you of any possible breach that affects your service or data, and the security clauses also cover the partner's own suppliers. For Microsoft's cloud services, partners can receive granular, time-bound admin rights; permanent relationships are not possible (source: Microsoft, October 2026).
Managing an IT partner: a quarterly review and a few KPIs
A good partner reports without being asked. Your part is to read the report and ask the follow-up question.
Ask for a short monthly report and discuss it every quarter. Once a year, put the direction on the table: what needs replacing, what is coming and what it will cost. That turns the partner from a repair service into an adviser.
| KPI | Why it matters |
|---|---|
| SLA targets met per priority | Shows whether the promises hold where it hurts most |
| Repeat incidents | The same fault twice means the cause was never fixed |
| Devices up to date | Missing updates leave known holes open |
| Restore tests done | A backup counts only once a restore has worked |
| Hours outside the fixed fee | Recurring extra hours belong in the contract |
The exit plan: leaving an IT partner without damage
Agree how you will part while the relationship is good. An exit plan written during a dispute comes too late.
- 1Before signingNotice period, transition help and its rate, the format of returned data, and confirmed deletion.
- 2NoticeNotice in the agreed form, with a handover list and a timetable.
- 3TransitionDocumentation, accounts and licences handed over; the new partner shadows first.
- 4ClosingOld access removed, shared secrets changed, deletion confirmed in writing.
Keep a recent copy of your data that does not depend on the partner; see backup and recovery.
The UK Prudential Regulation Authority expects banks and insurers to develop, maintain and test a documented exit strategy for each material outsourcing arrangement, covering both a stressed exit, such as the provider's failure, and a planned one (source: Bank of England, November 2024). In the EU, the Data Act requires cloud providers to remove obstacles for customers who want to switch (source: European Commission, December 2025).
Are you in control of your IT partner?
Eight statements from this guide. Answer them for your own organisation and see where to start.
- 1One person inside our organisation owns the relationship and reads every report.
- 2We have seen our partner's security certificate or audit report and checked that it covers our service.
- 3Our SLA states both response and resolution times for each priority.
- 4Admin accounts, domain names and licences are in our organisation's name.
- 5We hold an emergency admin account that does not depend on the partner, and we have tested it.
- 6Partner staff sign in with personal accounts and MFA, with only the access they need.
- 7We review the partner's performance every quarter against a few agreed KPIs.
- 8The contract says how data and documentation come back to us when we leave.
Related guides
Selection questions, SLA checklist and exit plan
Below you will find fourteen questions for the selection interview with what a good answer looks like, a checklist to review an SLA before you sign, and an exit plan outline to agree with the partner.
Frequently asked questions
What does it cost to outsource IT?
One partner for everything, or several specialists?
Should our IT partner also check our security?
Does the IT partner need to be nearby?
- UK NCSC: Supplier assurance questions (December 2020)
- UK NCSC: Supply chain security guidance (October 2025)
- UK NCSC: Using MSPs to administer your cloud services (January 2023)
- ISO/IEC JTC 1/SC 27: SC 27 Journal, issue 1, on ISO/IEC 27001 certification (2026)
- Microsoft Learn: Manage emergency access admin accounts (June 2026)
- Bank of England, Prudential Regulation Authority: Outsourcing and third party risk management (November 2024)