Guide
Choosing a managed IT provider: the questions to ask before you sign
Who keeps the access credentials, how to track your requests, when your servers are monitored, who does the backups, how to exit the contract: six questions to ask any managed IT provider, with the answers to expect and the ANSSI and CNIL references.
Updated on 18 October 2026 · Figures are sourced at the bottom of the page; opinions are those of IT CyberWall.
The questions to ask
| Question | A good answer | Warning sign |
|---|---|---|
| Who holds the access credentials? | The « owner » accounts (Microsoft 365, domain name, hosting provider) stay in the company’s name; the provider has named accounts and gives you the list. | « It’s simpler if we keep the passwords. » |
| How do I track my requests? | A ticketing tool, with a history you can view. | Everything goes through a technician’s mobile phone. |
| When are my servers monitored? | Written monitoring and on-call hours, stating what triggers an alert. | « We monitor everything, all the time », with no details. |
| Who does the backups, and is it the same contract as day-to-day operations? | The contract states who operates the backup, who monitors it and who tests restoration. | Nobody can answer. |
| What commitment period, what notice period? | A written term and notice period, known before you sign. | A long automatic renewal that is hard to cancel. |
| What happens at the end of the contract? | Return of access credentials, documentation and data, then deletion of whatever the provider held. | No exit is planned. |
IT CyberWall's answer
- Backup: IT CyberWall runs and secures your systems; backup is a separate contract, with WeDoBack. We monitor that it works.
- Access: your owner accounts remain yours; our access is through named accounts and you have the list.
- Requests: every request is logged as a ticket.
- Monitoring: 24/7 for managed servers, with SMS alerts according to the agreed on-call hours.
- Commitment: 6 months’ minimum term, applied only once across all our services, then cancellable with one month’s notice.
Official references
- Traceability. The ANSSI framework for secure administration and maintenance providers (PAMS) requires all access and actions to be logged, these logs to be kept for at least 6 months and provided to the client on request, and the list of administrators to be made available to the client[1].
- Sharing of responsibilities. The same framework requires a service agreement approved in writing, stating who is responsible for what, including where work is subcontracted[1].
- End of contract. It requires assets to be returned and storage media to be securely erased[1]. For personal data, the CNIL requires the contract to settle what happens to it: destruction, or return to the client or to the new provider, with copies destroyed[2].
- Subcontracting. A provider that processes personal data on your behalf is a processor within the meaning of the GDPR: the contract sets out its instructions, confidentiality, security and written authorisation for any further sub-processors[2][3].
- Cloud. Since 12 September 2025, the European Data Act has governed switching between cloud service providers; switching charges disappear completely on 12 January 2027[4].
IT CyberWall is not a PAMS-qualified provider: we cite this framework as a checklist of questions, useful for assessing any managed IT provider.
Ask us these questions
Describe your IT estate and your expectations: we reply in writing, with the contract to back it up.
Sources
Sources consulted on 18 October 2026. Supplier prices are shown excluding tax, in the currency and region of the published price list, and may change: always check the official page before deciding.
- ANSSI – Prestataires d’administration et de maintenance sécurisées (PAMS), référentiel d’exigences v1.1 (6 October 2022) — cyber.gouv.fr/sites/default/files/2022-10/ANSSI_PAMS_referentiel_v1.1_vFR.pdf
- CNIL – Guide du sous-traitant (September 2017) — cnil.fr/sites/default/files/atoms/files/rgpd-guide_sous-traitant-cnil.pdf
- CNIL – Responsable de traitement et sous-traitant : 6 bonnes pratiques — cnil.fr/fr/responsable-de-traitement-et-sous-traitant-6-bonnes-pratiques-pour-respecter-les-donnees
- European Commission – Data Act explained — digital-strategy.ec.europa.eu/en/factpages/data-act-explained
Backup and restoration are operated by WeDoBack.