The Four Questions for Your IT Provider

The Four Questions for Your IT Provider

•

Episode description

The Four Questions for Your IT Provider

Your IT provider holds the keys to everything: email, files, laptops, backups, often your accounting system. Nearly half of UK micro businesses now outsource cyber security, yet most cannot tell you who at their provider can access their network, from where, or using what credentials. Following October’s major backup service breach that affected thousands of customer environments, this episode equips small business owners with four essential questions to ask the supplier they trust most. Noel Bradford and Lucy Harper examine multi-factor authentication requirements, access controls, breach notification timescales, and independent certification. The conversation addresses the accountability gap created when providers operate outside forthcoming regulation, explores the practical difference between ‘all good’ and provable security, and explains why a good IT provider welcomes scrutiny. With the Cyber Security and Resilience Bill still progressing through Parliament, small firms cannot wait for government intervention. This episode provides the tools to audit your most connected supplier this week.

Chapters

  • Cold Open: The Moving Mouse A Tuesday morning at Kessler Heating. Priya arrives to find her mouse pointer moving on its own. Windows open and close without input. Is it the IT company doing updates, or something else? Most small businesses cannot tell the difference.
  • Welcome and Series Context Episode two of the nine-part UK Small Business Cyber Outlook 2027 series. Following last week’s supplier and customer risk mapping exercise, this episode focuses on the IT provider: the one supplier who can log directly into your business.
  • The Keys to Everything Why IT providers deserve dedicated scrutiny. Forty-four per cent of micro businesses now use external cyber security providers. These suppliers access email, files, backups, and accounting systems remotely via centralised management consoles. One compromised console opens hundreds of client networks. Phishing attacks abusing remote management tools rose 475 per cent in 2024. October’s backup service breach demonstrated the systemic risk when provider tools are compromised.
  • The Butcher and the Sausages Addressing the conflict of interest. Noel Bradford runs security for an MSP and now instructs listeners to interrogate their providers. The justification: good providers welcome scrutiny and can prove their claims. ‘All good’ is a feeling; evidence is what business owners require.
  • The Four Questions Question one: Is MFA enabled on every tool that reaches our systems, including provider-side consoles? Question two: Who can access our environment, and from where? Question three: How quickly will you notify us of a breach? Question four: Do you hold Cyber Essentials Plus? For each question, the episode details what constitutes a strong answer, what signals concern, and how to request supporting evidence.
  • All Good, or Proof Distinguishing fast reassurance from substantive evidence. A four-minute ‘all good’ reply lacks the time required to gather screenshots, access lists, contract clauses, and certificates. The restore test: ask your provider to recover one file from last month while you observe. A competent provider should complete this in under thirty minutes. How to frame the request without damaging the working relationship, and when a poor response justifies changing supplier.
  • The Regulation Gap The Cyber Security and Resilience Bill introduces mandatory incident reporting for medium and large managed service providers: twenty-four hours for initial reports, seventy-two hours for full disclosure, fines up to seventeen million pounds. Small and micro providers appear to fall outside this scope. For businesses using smaller IT firms, contractual terms and direct questioning remain the only accountability mechanism until secondary legislation clarifies coverage.
  • Outro and Next Steps Action summary: send the four questions in writing, note response time, request one piece of evidence per answer, ask for a live file restore, chase any outstanding answers about October’s backup gap. Next episode: Shadow AI and the poisoned inbox, examining unapproved AI tools in use across small business teams.

Links