IT support: choosing a managed IT service provider
IT support providers run helpdesks, manage devices and cloud accounts, keep backups and handle basic security for organisations without a full in-house team. This page covers what to check in each market, which certificates carry weight, and how we will assess providers.
- Markets
- US · UK · UAE & GCC · International
- Criteria
- 6 (v1.0)
- Official sources
- 14
- Reviewed
- October 2026
What IT support providers do
This category covers managed service providers (MSPs), helpdesk firms, break-fix technicians and outsourced IT departments. Their work usually spans user support, laptop and phone management, email and cloud administration, backups, networks, software updates and basic security such as multi-factor authentication (MFA) and malware protection. Some sell a monthly plan covering all of it; others charge per job. Buyers range from sole traders to firms with hundreds of staff, and because these are business contracts, protection comes from the contract terms, the provider's own security practice and the data protection law of the buyer's market.
An IT provider usually holds administrator access to every system it manages, which makes its security part of the client's. Regulators now treat providers that way. A European Commission implementing regulation of October 2024 sets cybersecurity risk-management requirements for managed service providers under the European Union (EU) NIS2 Directive, and a UK Bill before Parliament in 2026 would bring medium and large MSPs under similar regulation. Our weighting therefore puts security practice first, ahead of response times and helpdesk quality, and treats certificates as supporting evidence rather than proof of good service.
Phone, email and remote help for staff, with every ticket logged, prioritised and tracked against agreed response and resolution times.
Setting up laptops, phones and servers, applying security updates on a schedule, and keeping an inventory of every device and licence.
Managing user accounts, mailboxes, file sharing and permissions in cloud platforms, including joiners, leavers and regular access reviews.
Automated backups of data and systems, stored separately from the originals, with scheduled restore tests and a written recovery plan.
Firewalls, Wi-Fi, remote access and internet links, configured securely and monitored for faults and unusual activity.
Multi-factor authentication, malware protection, limited administrator rights, staff phishing awareness and help preparing for certification.
Office moves, cloud migrations and system replacements, planned and priced separately from the monthly support plan.
Budgeting for replacements, advising on software choices and dealing with telecoms and software vendors on the client's behalf.
What to check in your market
Rules differ by country. Choose a market to see the licences, registers and complaint routes that apply there.
United States
Two federal agencies publish practical guidance that suits small organisations and the providers serving them. The Cybersecurity and Infrastructure Security Agency (CISA) advises multi-factor authentication on key systems, especially email, prompt updates that put known exploited vulnerabilities first, regular tests of partial and full restores, and removing administrator rights from everyday laptops. The Federal Trade Commission (FTC) says security expectations for vendors should be written into contracts and then verified rather than taken on trust, with each vendor's access limited to a need-to-know basis.
Ask the provider to show that multi-factor authentication is enforced on every email and administrator account it manages, including its own technicians' accounts.
cisa.govAsk for the date and outcome of the provider's most recent restore test for a client of similar size, and how long full recovery took.
cisa.govWrite the provider's security duties into the contract and agree how you will verify them, as the FTC's vendor security advice recommends.
ftc.govLimit the provider's access to the systems it actually supports, and set out in writing how that access is removed when the contract ends.
ftc.gov
If a breach at your provider exposes your data, the FTC advises reporting it to local police, or the local Federal Bureau of Investigation (FBI) office, and to your industry's regulators, then notifying the people affected. Fee and service-level disputes are decided under the contract, so check its forum clause before signing.
United Kingdom
Cyber Essentials, developed by the National Cyber Security Centre (NCSC), is the minimum standard of cyber security the government recommends for organisations of all sizes. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds independent technical testing. Version 3.3 of the requirements applies to applications started from 27 April 2026. The Cyber Security and Resilience (Network and Information Systems) Bill, before Parliament in 2026, would bring medium and large managed service providers under regulation by the Information Commission, with initial incident notifications within 24 hours.
Search the NCSC certificate search for the provider's Cyber Essentials or Cyber Essentials Plus certificate, and note the certification and expiry dates it shows.
iasme.co.ukAsk which version of the Cyber Essentials requirements the certificate was assessed against; version 3.3 applies to applications started from 27 April 2026.
ncsc.gov.ukIf you want hands-on help meeting the five controls, ask whether the adviser is an NCSC-assured Cyber Advisor.
ncsc.gov.ukAgree how quickly the provider must alert you to a personal data breach, because a reportable breach must reach the Information Commission within 72 hours where feasible.
ico.org.ukAsk whether the provider expects to fall within the Bill's managed service provider rules and how it would notify customers affected by an incident.
gov.uk
Report a personal data breach to the Information Commission when it is likely to put people's rights at risk, and tell those affected without undue delay if the risk is high. To recover money from a provider, you can make a county court claim online or by post in England and Wales; mediation may be quicker and cheaper. Scotland and Northern Ireland have separate processes.
UAE & GCC
In the UAE, the Cyber Security Council publishes the UAE Information Assurance Standard for government and non-government entities responsible for critical information systems. It aligns with international frameworks including ISO/IEC 27001; some controls apply to every entity, while others depend on each organisation's risk assessment. The Council's National Cybersecurity Accreditation Program (NCAP) is mandatory for government bodies, critical infrastructure entities and firms providing cybersecurity, training or audit services to government, with a voluntary self-assessment track for others. A private business outside those groups can still use both as a yardstick when comparing providers.
If you are a UAE government body or supply one, ask whether the provider falls within NCAP and has met its requirements.
csc.gov.aeAsk the provider to map its controls to the UAE Information Assurance Standard and state which it treats as mandatory and which as risk-based.
csc.gov.aeAgree who reports a cyber incident, and through which official channel: Dubai Police eCrime, Abu Dhabi Police Aman or the Ministry of Interior eCrimes platform.
csc.gov.ae
The Cyber Security Council directs cybercrime reports to the nearest police station or the 999 emergency number, or online through Dubai Police eCrime, the Abu Dhabi Police Aman service and the Ministry of Interior eCrimes platform. Disagreements over fees, response times or data handover are settled under the contract, so agree its court or arbitration clause in advance.
International
Offshore helpdesks and remote monitoring make IT support easy to buy across borders, but the buyer still answers for its own systems and data. In the EU, a Commission implementing regulation adopted on 17 October 2024 under NIS2 sets cybersecurity risk-management requirements for managed service providers and managed security service providers, among other digital providers. ISO/IEC 27001:2022 is the international standard for information security management systems. Certification to it is optional, and ISO notes that a certificate from an accredited body can add confidence because the certifier's competence has been independently confirmed.
Ask for the ISO/IEC 27001:2022 certificate, check that its scope names the support service you are buying, and confirm the issuing body is accredited.
iso.orgIf you operate in the EU, ask whether the provider is covered by national NIS2 rules as a managed service provider and how it meets the 2024 implementing regulation.
digital-strategy.ec.europa.euBefore agreeing to arbitration, check that both your country and the provider's appear on the New York Convention status list.
uncitral.un.org
A cross-border IT contract should state the governing law, the dispute forum and the language of proceedings. The New York Convention, which has 172 parties including the UAE, the UK and the US, provides for recognising and enforcing foreign arbitral awards, subject to each state's declarations. Personal data breaches still go to the regulator in your own market.
How we assess IT support providers
These are the editorial criteria behind every IT support provider we rank, with the weight each carries in the editorial score. The editorial score makes up 60% of a ranking and adjusted customer ratings the other 40%, as set out in how we rank.
| Criterion | Weight | What we look at | Evidence we accept |
|---|---|---|---|
| Security practice | 25% | How the provider protects the administrator access it holds: MFA, separate admin accounts, update discipline and monitoring. Weighted highest because a breach at the provider can reach every client. | Written security policies, MFA enforcement reports, patching records, remote access tool settings and results of independent testing. |
| Response times and continuity | 20% | Whether agreed response and fix times are met, backups actually restore, and service continues when key staff are absent. | Service level reports covering at least six months, restore test records and a documented continuity plan. |
| Helpdesk quality | 15% | How clearly issues are handled, whether fixes last, and how well users are kept informed while a ticket is open. | Ticket samples, repeat-fault rates, user satisfaction surveys and client references. |
| Certification and registration | 15% | Certificates such as Cyber Essentials or ISO/IEC 27001 whose scope covers the service, plus company registration. Weighted moderately because certificates show minimum controls, not service quality. | Certificates found on official searches, scope statements, expiry dates and register entries. |
| Contract and exit clarity | 15% | Whether the contract states scope, exclusions, response times, data ownership and the handover of passwords and documentation on exit. | Sample contracts, service schedules, exit clauses and documented handover procedures. |
| Pricing clarity | 10% | Whether per-user or per-device fees, out-of-scope charges and project rates are stated before signing. | Quoted rate cards, sample invoices and change-request terms. |
Before you hire
Questions to ask
- Which of your staff will hold administrator access to our systems, and how is that access protected?
- What response and fix times will you commit to in writing, and what happens when you miss them?
- When did you last restore a client's data from backup, and how long did the restore take?
- Which remote management tools do you use, and who can log in to them?
- How quickly will you tell us about a security incident that affects our data?
- What does the monthly fee exclude, and how are out-of-scope jobs charged?
- How will we get our passwords, documentation and data back if we leave?
- Where are your support staff based, and which hours do they cover in our time zone?
Red flags
- Administrator passwords shared across clients, or reluctance to explain how technician accounts are protected.
- No record of a recent backup restore test, only assurances that backups run every night.
- A contract without written response times, or with service levels described only as reasonable efforts.
- Claimed Cyber Essentials or ISO/IEC 27001 certification that cannot be found on an official search or has expired.
- An unlimited support plan with no defined scope, exclusions or fair-use terms.
- No handover clause for passwords, documentation and admin rights when the contract ends.
- Long minimum terms with steep exit fees and no trial or notice period.
How pricing works
Monthly managed plans are usually priced per user or per device, sometimes in tiers that add security tools, out-of-hours cover or on-site visits. Break-fix support is charged by the hour or in pre-paid blocks of time, while projects such as migrations carry a separate fixed or estimated fee. Software licences and security tools may be resold with a margin or billed directly by the vendor. When comparing quotes, line up what each plan excludes, the response times it commits to and how out-of-scope work is charged.
Certification carries its own cost. The NCSC prices Cyber Essentials by the size of the organisation, starting at GBP 320 plus VAT, while Cyber Essentials Plus is priced on the size and complexity of the network. A provider may charge separately for preparing a client for either assessment, so ask for that preparation work to be quoted as a fixed fee with the scope written down.
- Per user per month
- A fixed monthly fee for each staff member, usually covering their devices and accounts within the plan's scope.
- Per device per month
- A monthly fee for each laptop, server or network device managed; suits shared devices or few users.
- Hourly or block hours
- Break-fix work billed by the hour, or pre-paid blocks used as needed; check whether unused hours expire.
- Fixed project fee
- A quoted price for a defined project such as a migration, with change requests priced separately.
- Tiered bundles
- Packages that add security tools, extended hours or on-site visits at each level; compare exclusions carefully.
Top 8 IT support providers
Rankings for this category are being researched market by market. Each one will publish when enough businesses pass the eligibility checks and an editor has approved the assessment. A list is never padded to reach eight.
Questions about IT support providers
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both assess the same five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials is a verified self-assessment marked by an assessor, while Cyber Essentials Plus adds independent testing to check the controls work in practice. Certificates issued in the last 12 months can be checked on the NCSC certificate search.
Does our IT provider report data breaches to the regulator for us?
Not usually. Under UK data protection law, the organisation responsible for the data assesses whether a breach is likely to put people at risk and, if so, reports it to the Information Commission, where feasible within 72 hours. The provider's job is to detect the incident and tell you quickly enough to meet that deadline, which is why the alert time belongs in the contract.
Is ISO/IEC 27001 the same as Cyber Essentials?
No, they do different jobs. Cyber Essentials is a UK scheme focused on five technical controls. ISO/IEC 27001:2022 is an international standard for an information security management system, covering risk assessment, policies and continual improvement. Either certificate only helps if its scope covers the service you are buying, so read the scope statement as well as the logo.
Will the UK Cyber Security and Resilience Bill affect IT providers?
The government's summary says medium and large managed service providers will be brought into scope, with the Information Commission as their regulator. Significant incidents would need an initial notification within 24 hours and a fuller report within 72 hours, and providers would have to tell customers likely to be affected. The Bill was still before Parliament in 2026, and much of the detail is left to secondary legislation.
How does Top8Reviews assess IT support providers?
We score each provider against six weighted criteria. Security practice carries 25%, response times and continuity 20%, helpdesk quality, certification and contract clarity 15% each, and pricing clarity 10%. Certificates are checked on official searches where one exists. Customer reviews are published as a separate evidence stream and do not feed this editorial score.
Sources
Official sources behind this page, checked in October 2026.
- Cyber Guidance for Small BusinessesCybersecurity and Infrastructure Security AgencyUS
- Cybersecurity for Small BusinessFederal Trade CommissionUS
- Cyber EssentialsNational Cyber Security CentreUK
- Cyber Essentials: Help & resourcesNational Cyber Security CentreUK
- NCSC Certificate Search - Cyber EssentialsIASME (NCSC Cyber Essentials Delivery Partner)UK
- UK GDPR data breach reporting (DPA 2018)Information Commission (ICO)UK
- Summary of the Bill (Cyber Security and Resilience (Network and Information Systems) Bill factsheets)Department for Digital, Culture, Media & Sport and Department for Science, Innovation & TechnologyUK
- Make a court claim for moneyGOV.UKUK
- UAE Information Assurance StandardUAE Cyber Security CouncilUAE & GCC
- National Cyber Security Accreditation ProgramUAE Cyber Security CouncilUAE & GCC
- Report a Cybersecurity IncidentUAE Cyber Security CouncilUAE & GCC
- ISO/IEC 27001:2022 - Information security management systemsInternational Organization for StandardizationInternational
- NIS2: Commission implementing regulation on critical entities and networksEuropean CommissionInternational
- Status: Convention on the Recognition and Enforcement of Foreign Arbitral Awards (New York, 1958)United Nations Commission on International Trade LawInternational