Business

Due Diligence Questions for IT Provider Procurement | blueAPACHE

Most IT provider due diligence produces a lot of paper and very little discrimination, because the questions asked are ones every provider can answer well. the questions that actually separate providers, grouped by area, with a note on

Most IT provider due diligence produces a lot of paper and very little discrimination, because the questions asked are ones every provider can answer well. the questions that actually separate providers, grouped by area, with a note on what a good answer looks like. It is written to be used against any provider, including us.

Scope and service definition

  1. Provide a scope matrix — every service, marked in or out. Not a narrative description. A matrix.
  2. Which of our named line-of-business applications will you support, and to what level? Vague answers here become disputes in month four.
  3. What is explicitly excluded that organisations our size typically need? The single most useful question in a procurement. A candid answer indicates a provider who has read your estate; "nothing is excluded" indicates one who has not.
  4. What is chargeable outside the subscription, and at what rates?

Service levels and coverage

  1. What are your response and resolution commitments, by priority? And get the definitions of each priority — P1 means different things to different providers.
  2. Is out-of-hours coverage rostered staff or on-call escalation? Both are legitimate; they are not the same thing and are sometimes priced similarly.
  3. Where are your support staff located, and in which timezones?
  4. What happens when you miss a service level? Service credits are common and usually small; the more informative question is what the remediation process looks like.

People and accountability

  1. Who is our named account contact, what authority do they hold, and who is above them? Ask for names and roles.
  2. What is your staff turnover in the service desk and engineering teams? A provider who tracks and will share this is unusual and telling.
  3. How many engineers hold current certifications in the specific technologies in our estate? Not partner logos — certified individuals.

Security and compliance evidence

  1. Provide the ISO 27001 certificate. What is the exact scope statement, and is our service inside it?
  2. Which certification body issued it, and which accreditation body accredited them?
  3. Provide a control ownership matrix — which security controls you operate, which remain ours. The ASD Essential Eight is a good frame; ask strategy by strategy.
  4. What is your contractual incident notification commitment, and what triggers it? If you are APRA-regulated, this must support your own 72-hour obligation.
  5. Do you subcontract any part of this service? Subcontractors are in your supply chain.
  6. What are your reporting, review and audit rights? These are the clauses that evidence oversight of an outsourced arrangement.

→ How to Verify a Provider's ISO 27001 Certificate → APRA CPS 234 and Third-Party Outsourcing Obligations

Commercial and contractual

  1. What is the minimum term, and what is the reasoning behind it? A provider who can explain the reasoning is easier to negotiate with than one who cannot.
  2. How does pricing change over the term — indexation, review mechanics, volume bands?
  3. What insurance do you carry, and at what limits? Ask for certificates of currency.
  4. How is liability structured? Look for whether confidentiality, security, privacy and intellectual property matters are treated differently from general commercial liability.
  5. What are the disengagement provisions and data return obligations? Negotiate this at the start; it is far harder at the end.

Transition and exit

  1. What does transition-in involve, how long, and what is the deliverable? Is it contractually defined work or best endeavours?
  2. How do you rebuild environment knowledge if the incumbent does not cooperate? Some friction is normal; the answer separates a considered plan from an optimistic one.
  3. Which of our people do you need, when, and for how long? Transitions fail on customer-side availability as often as on provider capability.
  4. What does exit look like — cost, timeline, format of returned data?

The three answers that discriminate most

In practice, three questions separate providers more reliably than the rest:

"What is excluded that we'll probably need?" — tests candour and estate comprehension.

"Who has authority to make an operational change at 3am to contain a security incident?" — tests whether security and operations are genuinely integrated or contractually adjacent.

"Give us a reference who had a bad month." — tests confidence in how the provider behaves under pressure, which is the only condition that actually matters.

How we answer some of these

→ Commercial Terms — What blueAPACHE's Published General Terms Cover → Onboarding and Transition-In — What Switching MSP Actually Involves

↑ Back to top