How to Choose a Reliable IT Consultant: 10 Expert Checks

Choosing an IT consultant is one of the few purchasing decisions where the vendor ends up holding the keys to everything. They will have administrative access to your systems, your backups, and often your remote access tooling. That is why the evaluation deserves more rigor than a proposal comparison.

Here are the ten checks we recommend to businesses across New England, in the order we would run them.

1. Examine their own security posture first

A provider's internal practices matter more than their brochure. Ask whether multifactor authentication is enforced on their remote access and management tools, whether administrative credentials are unique per client rather than shared, and how they segment their own network. The joint advisory issued by CISA and its international partners on protecting managed service providers and their customers is explicit on these points, and it warns specifically against reusing administrative credentials across customers.

2. Read the certification, not the logo

A SOC 2 badge on a website tells you almost nothing. Ask for the report itself and check three things: whether it is Type II rather than Type I, when the observation period ended, and which trust services criteria were in scope. If the period ended more than a few months ago, ask for a bridge letter. The same discipline applies to ISO/IEC 27001:2022, where the certificate scope and the statement of applicability tell you what was actually assessed.

3. Ask which control framework they follow

Good providers can name the standard they work from. The Center for Internet Security released CIS Controls version 8.1 in June 2024, adding a governance function, and its Implementation Group 1 is described as essential cyber hygiene for smaller organizations. A provider who says they follow CIS Implementation Group 1, or the NIST Cybersecurity Framework, is giving you something you can verify. A provider who says they follow best practices is giving you a phrase.

4. Treat them as a supply chain risk, because they are

This is not theoretical. The 2021 Kaseya VSA incident reached roughly 1,500 downstream businesses through their providers, and the 2025 ConnectWise ScreenConnect breach, which a nation state actor used to reach a small number of customer instances of a tool many providers use daily. Verizon's 2026 Data Breach Investigations Report found third party involvement in 48 percent of breaches, a sixty percent increase year over year. Ask what happens to you if their tooling is compromised, and ask it out loud.

5. Put the service level agreement under a lamp

No standards body publishes an IT support service level template, so the quality varies enormously. Look for severity tiers with plain language definitions, a response commitment separate from a resolution target, the hours those commitments apply, an escalation path with names or roles, and what remedy exists when a target is missed. Vague language such as prompt response is a decision to measure nothing.

6. Insist on documentation you own

Ask what documentation you receive and when. Network diagrams, an asset inventory, credential records and written runbooks should be yours, maintained during the engagement rather than assembled at the end. The UK National Cyber Security Centre guidance on choosing a managed service provider, published in November 2025, names the service level agreement, clearly defined roles, responsibilities and liabilities, incident notification, regular reviews and reporting, least privilege access, and a clear process for contract review, renewal or termination as contract items, and that guidance travels well on this side of the Atlantic.

7. Ask how changes get made

Most outages we are called in to clean up began with an unannounced change. ITIL 4 describes change enablement as maximizing successful changes by assessing risk, authorizing the change, and managing the change schedule, and it separates standard changes that are pre approved from normal changes that need authorization and emergency changes that are expedited. You do not need your provider to be certified. You need them to be able to describe their process without inventing it on the call.

8. Ask about logging and visibility

The CISA advisory on managed service providers recommends enabling and improving monitoring and logging, and retaining important logs for at least six months. Ask what is logged, how long it is kept, and whether you can see it. A provider who cannot show you a report is a provider who cannot show you an incident.

9. Agree on the numbers you will both watch

Agree in advance on a small set of measures and a cadence for reviewing them. First contact resolution, mean time to resolve, customer satisfaction and ticket backlog are the usual four. Two cautions from the benchmarking literature. SQM Group, which sells first contact resolution benchmarking, reports an all industry average around 71 percent and considers 80 percent or better world class. And mean time to resolve should be measured in business hours rather than calendar hours, as the HDI Metric of the Month work by Jeff Rumburg has long argued, otherwise a Friday afternoon ticket looks like a catastrophe.

10. Check references like an auditor, not a shopper

Ask referees three specific questions. When something went wrong, how quickly were you told, and by whom? Have you ever asked for a report or a log and received it? And what did offboarding look like for a client who left? The Federal Trade Commission's guidance on vendor security for small businesses makes the underlying point plainly: establish a process so you can confirm that vendors are following your rules, and do not just take their word for it.

Red flags we would not ignore

A compliance logo with no report behind it. Shared administrative credentials across customers. No multifactor authentication on their own tools. Reluctance to name a response commitment. Documentation described as proprietary. An agreement with no exit path for your data and credentials. Any one of these is a conversation. Two of them together is an answer.

Talk to us

We are happy to be evaluated against this list, and we will hand over the evidence rather than the adjectives. Email lpatel@lavitsolutions.io, call (781) 506-6008, or request a consultation. LavIT Solutions works with businesses throughout Massachusetts, New Hampshire and New England.

Frequently asked questions

Does an IT consultant need SOC 2 or ISO 27001? Neither is legally required for most engagements, but one of them is meaningful evidence that a provider is audited against a standard rather than self assessing. If a provider has neither, ask which framework they follow and how they demonstrate it.

What should a service level agreement actually promise? At minimum, severity definitions, a response time per severity, the hours those times apply, an escalation path, and a stated remedy when a target is missed. Resolution targets are helpful but should be separate from response.

Who owns the documentation and passwords? You should. Agree in writing that network documentation, asset inventories and credentials are your property and will be handed over in a usable format if the relationship ends.

Sources

CISA: Protecting against cyber threats to managed service providers and their customers
National Cyber Security Centre: Choosing a managed service provider
Center for Internet Security: CIS Controls implementation groups
Verizon: Data Breach Investigations Report
Federal Trade Commission: Cybersecurity for small business, vendor security
CISA: Kaseya ransomware attack guidance for affected providers and customers
Help Net Security: ConnectWise ScreenConnect customer instances compromised
AXELOS: ITIL 4 change enablement practice
SQM Group: First contact resolution benchmarks