by The Computing Australia Group | 
Choosing an IT support company is one of the most important technology decisions a small or medium business makes. Your provider will have access to your systems, your data and often your admin passwords. So the right one keeps your business running and secure, while the wrong one can leave gaps you only discover after something goes wrong.
This guide sets out nine things to look for, the questions to ask before you sign, the red flags to avoid and how pricing usually works. It draws on guidance from the Australian Signals Directorate (ASD) as well as our own experience supporting Perth businesses.
Updated 8 November 2026
What's changed when choosing an IT support company
- Ransomware payment reporting is now enforced. Since 30 May 2025, businesses above the $3 million turnover threshold must report ransomware payments to ASD within 72 hours, and the education-first period ended on 31 December 2025. See factor 3.
- ASD published guidance on AI-enabled attacks (July 2026). Its small business guidance points readers to ASD's questions to ask managed service providers. See "Questions to ask".
- ASD Essentials published (October 2026). It succeeds the Essential Eight over about two years, so ask how a provider plans to help you transition.
Signs your business needs an IT support company
Many businesses start looking when one of these becomes a regular frustration:
- The same problems keep coming back. Slow computers, dropouts or printer issues that never get properly fixed.
- One person holds all the knowledge. A staff member or a single contractor is the only one who knows how things work.
- Security is guesswork. Nobody can say for sure whether backups work, devices are patched or multi-factor authentication is on.
- You’re growing. New staff, new sites or new software are outpacing what you can manage informally.
- Clients or insurers are asking questions. Cyber insurance forms and client security questionnaires need answers you don’t have.
Nine things to look for in an IT support company
Select any factor to jump to the detail and the question to ask.
Proactive monitoring
Problems found and fixed before staff notice them.
Response times in writing
Clear service levels for urgent and routine issues.
Security as standard
Essential Eight controls built into the service.
Tested backups
Backups that are checked by restoring, not assumed.
Local people
Technicians who can come on site when needed.
Documentation you own
Your systems written down, and handed over if you leave.
Plain-English reporting
A named contact and regular, understandable updates.
Fair contract and exit
Reasonable terms and a clear offboarding process.
Breadth and advice
Microsoft 365, cloud, networks and planning ahead.
1. Proactive monitoring, not just break-fix
With break-fix support, you call when something breaks and pay for the time to fix it. In contrast, a managed service monitors your devices and systems, applies updates and flags warning signs, such as a failing drive or a full disk, before they cause downtime.
Ask: “What do you monitor, and what happens when an alert fires outside business hours?”
2. Clear response times in writing
A service level agreement (SLA) should say how quickly the provider responds to urgent and routine requests, and during which hours. Also check the difference between round-the-clock monitoring and round-the-clock support, because they’re not the same thing.
Ask: “What are your response times for a critical issue, and are they in the contract?”
3. Security built into the service
Your IT provider usually has privileged access to every system you run, which makes their own security as important as yours. ASD recommends asking managed service providers whether they implement the Essential Eight, administer systems securely, monitor activity and can respond to incidents. In addition, your provider should be able to help you meet obligations such as ransomware payment reporting and the Notifiable Data Breaches scheme.
Ask: “Which Essential Eight controls do you put in place for clients, and how do you secure your own access to our systems?”
4. Backups that are tested
Backups only matter if you can restore from them. A good provider backs up servers, cloud services such as Microsoft 365, and key devices, keeps a copy separate from your main systems, and tests restores regularly.
Ask: “When did you last test a restore for a client, and how long did it take?”
5. Local people who can come on site
Most issues can be fixed remotely. However, some problems, such as network faults, new installations and hardware failures, need someone on site. A provider based in your city can get there quickly and understands local suppliers and conditions.
Ask: “Where are your technicians based, and how quickly can someone be on site?”
6. Documentation that belongs to you
Your network, accounts, licences and settings should be written down, kept up to date and accessible to you. Otherwise, everything depends on one provider’s memory, which makes changing provider or recovering from an incident much harder.
Ask: “Will we have access to our documentation and admin accounts at all times?”
7. Plain-English reporting and a named contact
You should know who to call and what’s happening without needing a technical background. Look for regular reports on tickets, security status and upcoming risks, plus a person who reviews your technology with you at least once or twice a year.
Ask: “Who will be our main contact, and what will your regular reports show?”
8. A fair contract and a clear exit
Read the term, notice period and what happens when you leave. A good provider will hand over passwords, documentation and admin access in an orderly way. Be cautious of long lock-in periods or vague offboarding terms.
Ask: “If we decide to move on, what does your offboarding process include?”
9. Breadth of skills and forward planning
Small businesses rarely need a specialist for every area, but they do need a provider who can cover the essentials: Microsoft 365, cloud services, networks, devices, security and dealing with other vendors on your behalf. The best providers also help you plan ahead, for example for software reaching end of support or a new office fit-out.
Ask: “How do you help clients plan IT spending for the next year or two?”
Questions to ask an IT support company before you sign
Use these in your first meetings. The second column shows what a good answer usually sounds like.
| Question | What a good answer sounds like |
|---|---|
| Do you implement the Essential Eight for your own systems? | Yes, with a clear explanation of their controls and maturity level. |
| How do you secure remote access to our systems? | Multi-factor authentication, individual named accounts and logged access. |
| What do you monitor, and when? | Devices, servers and security alerts, with defined after-hours handling. |
| How do you handle a security incident? | A documented plan covering containment, evidence, restoring systems and your reporting obligations. |
| How often do you test backups? | On a schedule, with restore results they can show you. |
| Who owns our documentation and admin accounts? | You do, and they can show where it’s kept. |
| What are your response times? | Specific times for each priority, written into the agreement. |
| What happens if we leave? | A defined handover of access, documentation and data. |
ASD publishes its own list of questions to ask managed service providers, which is worth reading alongside this one.
Red flags when comparing an IT support company
- Vague answers about security. If they can’t explain how they protect their own access to your systems, keep looking.
- Shared or generic admin logins. Every technician should use their own named account with multi-factor authentication.
- No written service levels. “We’re always quick” isn’t a commitment.
- Documentation they won’t share. Your system information should never be held hostage.
- Long lock-in contracts with unclear exit terms. Good providers keep clients by doing good work.
How an IT support company usually prices its services
Most providers use one of these models, or a mix of them. Ask exactly what’s included and what is billed on top.
| Model | How it works | Suits |
|---|---|---|
| Per user, per month | A fixed fee for each staff member, usually covering support, monitoring and security tools | Most office-based businesses |
| Per device, per month | A fee for each computer, server or network device | Businesses with shared or specialist equipment |
| Block of hours | Prepaid time used as needed | Small teams with occasional needs |
| Break-fix | Pay for each job when something goes wrong | Very small setups, but with less prevention |
Comparing an IT support company with hiring your own staff? Read our guides to in-house vs managed IT services, the pros and cons of IT outsourcing and what managed IT services cost.
Ask about AI, too
AI is changing both IT support and cyber attacks. ASD's July 2026 guidance warns that attackers now use AI to move faster. So it's worth asking any provider how they use AI themselves.
- How do you use AI with our data? A good provider can explain which tools they use and how client data is protected.
- How do you defend against AI-driven phishing? Look for email filtering, multi-factor authentication and staff awareness training.
- Can you help us use AI safely? For example, preparing Microsoft 365 permissions before rolling out Copilot.
We use AI tools daily and have trained models on more than 200,000 of our own service tickets. Read more about our AI consulting and automation services.
How CAG works as your IT support company
The Computing Australia Group has been an IT support company for Western Australian businesses for 21 years, from our base in Belmont. We’re a Microsoft partner, and our technicians support clients in industries including mining, oil and gas, manufacturing, government and corporate. We document each client site thoroughly, so your systems are written down and easy to hand over.
Our managed IT services include a helpdesk, 24/7 monitoring, endpoint detection and response with automatic containment, backup and disaster recovery, and Essential Eight assessments with help mapping your controls to ASD Essentials. We also offer IT audits and consulting if you’d like an independent view of where you stand. Based nearby? See our page on IT support in Belmont.
Perth IT support
Looking for a new IT support company?
Talk to our team. We'll answer every question on this list, review your current setup and explain how we'd support your business.
Your questions answered
Choosing an IT support company
What is the difference between IT support and managed IT services?
IT support often means fixing problems when you call. Managed IT services add ongoing monitoring, updates, security and planning for a regular fee, so fewer problems happen in the first place.
How do I compare IT support quotes?
Compare what’s included, not just the price: response times, monitoring, security tools, backup, on-site visits and how extra work is billed.
Should my IT provider be local?
Most support happens remotely, but a local provider can get on site quickly for hardware, network and installation work.
Security and contracts
What security should an IT support company provide?
At minimum, multi-factor authentication, patching, endpoint protection, monitoring and tested backups, ideally aligned with the Essential Eight. They should also secure their own access to your systems.
Can I change IT support company easily?
Usually, yes, if your documentation and admin accounts are in order. Check your current contract’s notice period and ask the new provider how they manage the handover.
Do IT providers help with ransomware reporting?
A good provider will help you contain an incident, preserve evidence and restore from backups, and can support you in meeting reporting obligations. The legal obligation to report a ransomware payment sits with your business.
Sources and further reading
- Australian Signals Directorate — Questions to ask managed service providers
- Australian Signals Directorate — Essential Eight
- Australian Signals Directorate — ASD Essentials
- ASD — Defending against AI-enabled cyber attacks: Guidance for small businesses (PDF)
- Department of Home Affairs — Ransomware payment reporting factsheet (PDF)
- OAIC — Notifiable Data Breaches scheme
This article is general information, not legal advice. Last reviewed 8 November 2026.
About the author
Chris Karapetcoff
Director (Client Growth and Success), The Computing Australia Group
Chris has worked with The Computing Australia Group for over 20 years and looks after its client relationships. He helps organisations get outstanding value from their IT spend, with plain-English advice and a complete IT solution they can build on. As he tells every client: your IT system should just work.
