“Managed IT” can mean almost anything. One provider’s monthly plan covers your computers, accounts, backups and security. Another covers a help desk phone line and little else. If you run a small business, the contract is usually the only place you find out which one you bought.
Here’s a plain checklist you can use to compare proposals, or to check the agreement you already have.
The short answer
A solid managed IT agreement should spell out, in writing, which devices and accounts are covered, how fast someone responds, how your data is backed up and restored, what security basics are kept in place, who owns your accounts and passwords, and what happens when you leave. If any of those are vague or missing, ask before you sign.
The buyer’s checklist
- What’s covered, by name. A list of the computers, phones, servers, printers, network gear and cloud accounts included. “All IT” is not a list. Ask what counts as out of scope and how out-of-scope work is billed.
- Support hours and response times. When can your staff get help, how do they ask for it, and how quickly does someone respond for an urgent problem versus a routine one? Ask what happens if those targets are missed.
- Updates and patching. Who keeps operating systems, browsers and other software up to date, and how often? The SBA recommends setting software to install updates automatically and keeping all operating systems, browsers and applications current.
- Backups you can actually restore. What gets backed up, how often, where the copies live and when a restore was last tested. A backup nobody has tried to restore is a hope, not a plan.
- Accounts, passwords and multi-factor authentication. Is multi-factor authentication turned on for email, banking, payroll and other key accounts? Is each person on a separate account? Are former employees removed promptly? These are all on the SBA’s list of basics.
- Security basics in plain English. Antivirus on every computer, a firewall, a secured Wi-Fi network, and a secure way to work remotely. Ask the provider to describe what they do without jargon.
- Staff training. The SBA names employees and work-related communications as a leading cause of small business data breaches. Does the plan include help spotting phishing emails and suspicious downloads?
- Who owns what. Your domain, email, cloud accounts, software licenses and admin passwords should be in your business’s name, with at least one owner-level login you control. This matters most on the day you change providers.
- Reporting. What do you get each month? A short summary of tickets, updates, backup status and open risks is a reasonable thing to ask for.
- Price, term and exit. The monthly price, what raises it, how long the term runs, whether it renews automatically, how much notice you have to give, and what help you get handing everything over to the next provider.
Red flags in a proposal
- Admin passwords or your domain held in the provider’s name, with no copy for you.
- No written list of covered devices and accounts.
- Response times described as “fast” or “priority” with no numbers attached.
- Backups mentioned, but no word on restore testing.
- A long term that renews automatically, with a short notice window and no exit help.
- Security promises that sound absolute. No one can guarantee you won’t be breached; a good provider explains how they reduce risk and what happens if something goes wrong.
Free government checklists worth a look
You don’t need to become an expert, but a few free resources make it easier to ask good questions. The SBA’s cybersecurity guide for small businesses covers training, networks, updates, multi-factor authentication, access audits and backups, and points to free planning and assessment tools. It also notes there’s no substitute for dedicated IT support, whether that’s an employee or an outside consultant.
NIST’s Small Business Cybersecurity Corner collects plain-language guidance, and its small business quick-start guide to the Cybersecurity Framework 2.0 is a short way to see the full picture. Your provider should be able to map what they do to it in a few sentences.
How Green Orb can help
You work directly with Kevin Whitney, backed by a 25-agent operation. Kevin has spent about 30 years in IT leadership and has been independent since 1997, so he has read plenty of IT agreements from both sides of the table.
- IT contract review. Send us the managed IT proposal or agreement you have now. We’ll walk through it against this checklist and flag gaps, vague terms and questions to raise before you sign or renew. This is a business review, not legal advice. How contract review works.
- AI Audit: $750 flat. If part of what you want from IT is less repeat work, Kevin maps how your business runs, ranks your top five time-savers, lists what to leave alone and gives you a written 90-day plan. What the audit includes.
- Monthly care, optional: $300 or $750 a month. Billed monthly, cancel any time. How monthly care works.
Every price is fixed and agreed in writing before work starts, plus applicable taxes. We give recommendations, not guarantees; results depend on your systems, vendors and people. Prefer to talk first? Text us at 404-333-8432.
Not sure what your IT contract covers?
Start with a $750 AI Audit, ask about an IT contract review, or book a free 30-minute call first.
Sources
- U.S. Small Business Administration, “Strengthen your cybersecurity”, viewed November 4, 2026.
- National Institute of Standards and Technology, Small Business Cybersecurity Corner, viewed November 4, 2026.
- National Institute of Standards and Technology, NIST SP 1300, Small Business Quick-Start Guide (CSF 2.0), viewed November 4, 2026.