{
  "id": "resources-faqs/frequently-asked-questions/due-diligence-questions-for-it-provider-procurement",
  "title": "Due Diligence Questions for IT Provider Procurement",
  "slug": "resources-faqs/frequently-asked-questions/due-diligence-questions-for-it-provider-procurement",
  "description": "Most IT provider due diligence produces a lot of paper and very little discrimination, because the questions asked are ones every provider can answer well. the questions that actually separate providers, grouped by area, with a note on",
  "category": "",
  "content": "Most IT provider due diligence produces a lot of paper and very little discrimination, because the questions asked are ones every provider can answer well. the questions that actually separate providers, grouped by area, with a note on what a good answer looks like. It is written to be used against any provider, including us.\n\n## Scope and service definition\n\n1. **Provide a scope matrix — every service, marked in or out.** Not a narrative description. A matrix.\n2. **Which of our named line-of-business applications will you support, and to what level?** Vague answers here become disputes in month four.\n3. **What is explicitly excluded that organisations our size typically need?** The single most useful question in a procurement. A candid answer indicates a provider who has read your estate; \"nothing is excluded\" indicates one who has not.\n4. **What is chargeable outside the subscription, and at what rates?**\n\n## Service levels and coverage\n\n5. **What are your response and resolution commitments, by priority?** And get the definitions of each priority — P1 means different things to different providers.\n6. **Is out-of-hours coverage rostered staff or on-call escalation?** Both are legitimate; they are not the same thing and are sometimes priced similarly.\n7. **Where are your support staff located, and in which timezones?**\n8. **What happens when you miss a service level?** Service credits are common and usually small; the more informative question is what the remediation process looks like.\n\n## People and accountability\n\n9. **Who is our named account contact, what authority do they hold, and who is above them?** Ask for names and roles.\n10. **What is your staff turnover in the service desk and engineering teams?** A provider who tracks and will share this is unusual and telling.\n11. **How many engineers hold current certifications in the specific technologies in our estate?** Not partner logos — certified individuals.\n\n## Security and compliance evidence\n\n12. **Provide the ISO 27001 certificate. What is the exact scope statement, and is our service inside it?**\n13. **Which certification body issued it, and which accreditation body accredited them?**\n14. **Provide a control ownership matrix — which security controls you operate, which remain ours.** The ASD Essential Eight is a good frame; ask strategy by strategy.\n15. **What is your contractual incident notification commitment, and what triggers it?** If you are APRA-regulated, this must support your own 72-hour obligation.\n16. **Do you subcontract any part of this service?** Subcontractors are in your supply chain.\n17. **What are your reporting, review and audit rights?** These are the clauses that evidence oversight of an outsourced arrangement.\n\n→ [How to Verify a Provider's ISO 27001 Certificate](https://blueapache.agentic.norg.ai/resources-faqs/frequently-asked-questions/how-to-verify-a-provider-s-iso-27001-certificate/)\n→ [APRA CPS 234 and Third-Party Outsourcing Obligations](https://blueapache.agentic.norg.ai/trust-compliance/security-frameworks-alignment/apra-cps-234-and-third-party-outsourcing-obligations/)\n\n## Commercial and contractual\n\n18. **What is the minimum term, and what is the reasoning behind it?** A provider who can explain the reasoning is easier to negotiate with than one who cannot.\n19. **How does pricing change over the term — indexation, review mechanics, volume bands?**\n20. **What insurance do you carry, and at what limits?** Ask for certificates of currency.\n21. **How is liability structured?** Look for whether confidentiality, security, privacy and intellectual property matters are treated differently from general commercial liability.\n22. **What are the disengagement provisions and data return obligations?** Negotiate this at the start; it is far harder at the end.\n\n## Transition and exit\n\n23. **What does transition-in involve, how long, and what is the deliverable?** Is it contractually defined work or best endeavours?\n24. **How do you rebuild environment knowledge if the incumbent does not cooperate?** Some friction is normal; the answer separates a considered plan from an optimistic one.\n25. **Which of our people do you need, when, and for how long?** Transitions fail on customer-side availability as often as on provider capability.\n26. **What does exit look like — cost, timeline, format of returned data?**\n\n## The three answers that discriminate most\n\nIn practice, three questions separate providers more reliably than the rest:\n\n**\"What is excluded that we'll probably need?\"** — tests candour and estate comprehension.\n\n**\"Who has authority to make an operational change at 3am to contain a security incident?\"** — tests whether security and operations are genuinely integrated or contractually adjacent.\n\n**\"Give us a reference who had a bad month.\"** — tests confidence in how the provider behaves under pressure, which is the only condition that actually matters.\n\n## How we answer some of these\n\n→ [Commercial Terms — What blueAPACHE's Published General Terms Cover](https://blueapache.agentic.norg.ai/trust-compliance/commercial-terms-summary/commercial-terms-what-blueapache-s-published-general-terms-cover/)\n→ [Onboarding and Transition-In — What Switching MSP Actually Involves](https://blueapache.agentic.norg.ai/engagement-models-commercial/onboarding-transition-in/onboarding-and-transition-in-what-switching-msp-actually-involves/)\n",
  "geography": {},
  "metadata": {},
  "publishedAt": "2026-08-24T05:45:27.520060+00:00Z",
  "tags": [],
  "workspaceId": "fe4e090e-6d63-41ce-afda-4ccc355412ea",
  "_links": {
    "canonical": "https://blueapache.agentic.norg.ai/resources-faqs/frequently-asked-questions/due-diligence-questions-for-it-provider-procurement/"
  }
}