Hire Event Vendors

FAQs

1. What should I verify about an IT support provider’s scope, qualifications, and response model?

Confirm the services offered (helpdesk, on-site support, network administration, security, backups, cloud management) and whether they provide managed services (MSP) or project-based work. Ask for certifications (CompTIA, Microsoft, Cisco, AWS, Google Cloud) and proof of relevant experience with systems like your OS, server platforms, applications, or industry-specific tools. Clarify their support model: hours of coverage (business hours, 24/7), SLA response and resolution targets, escalation paths, and whether remote support is included. Request references from similar clients and a one-page summary of their standard onboarding and documentation practices (asset inventory, network diagram, account/access lists).

2. What should a clear quote and contract include, and what hidden costs should I watch for?

The quote should itemize recurring fees (per-user, per-device, flat monthly), one-time onboarding/setup costs, licensing or third-party subscription pass-throughs, and hourly rates for out-of-scope work. Contract must state SLAs (response times, uptime guarantees), termination and data-handling terms, liability limits, insurance, and data retention/back-up responsibilities. Watch for hidden costs: extra charges for emergency after-hours support, surge pricing for incident response, vendor markup for software/licenses, fees for on-site visits or long travel, and costs to recover from breaches if incident response isn’t in scope. Require a documented change-order process and a clear definition of “normal business hours” and what constitutes billable work versus included maintenance.

3. How do I evaluate their security posture, backups, and incident response capability?

Ask for details on their security practices: patch management cadence, antivirus/EDR tooling, MFA enforcement, logging and monitoring, and vulnerability/pen-test history or reports. Verify backup strategy—RPO/RTO targets, off-site or cloud copies, encryption at rest/in transit, and regular restore tests. Request their incident response plan, typical containment timelines, and examples of past incident handling (redacted). Confirm whether they provide SOC, SIEM, or outsourced MSSP integration and whether tabletop or live incident drills are included or available.

4. What documentation, access control, and handover procedures should I require?

Require a documented inventory (hardware, software, network map), admin credential management policy (vaulting, rotation, least-privilege), and written runbooks for common tasks and recovery steps. Specify onboarding and offboarding checklists for staff, procedures for privileged access requests, and a secure process for handing over keys/credentials if the contract ends. Ask for regular reporting (ticket metrics, patch status, backup reports) and a documented change-management workflow to approve configuration or software updates.

5. What contingency planning, SLAs, and exit/transition terms should be included to protect my operations?

Insist on clear SLAs with measurable metrics (response times by severity, resolution targets, uptime guarantees) and remedies for missed SLAs (service credits or termination rights). Require business-continuity plans, defined disaster-recovery testing windows, and a commitment to retain and deliver exported data and configuration exports at contract end. Include an exit plan with transition support (knowledge transfer, credential handover, overlap period) and a final audit of assets and licenses. Verify insurance and indemnity clauses that cover data breaches and operational failures, and require periodic third-party audits or compliance attestations if relevant to your industry.