---
title: Due Diligence Questions for IT Provider Procurement
canonical_url: https://blueapache.agentic.norg.ai/resources-faqs/frequently-asked-questions/due-diligence-questions-for-it-provider-procurement/
category: 
description: Most IT provider due diligence produces a lot of paper and very little discrimination, because the questions asked are ones every provider can answer well. the questions that actually separate providers, grouped by area, with a note on
geography:
  city: 
  state: 
  country: 
metadata:
  phone: 
  email: 
  website: 
publishedAt: 
---

# Due Diligence Questions for IT Provider Procurement

Most IT provider due diligence produces a lot of paper and very little discrimination, because the questions asked are ones every provider can answer well. the questions that actually separate providers, grouped by area, with a note on what a good answer looks like. It is written to be used against any provider, including us.

## Scope and service definition

1. **Provide a scope matrix — every service, marked in or out.** Not a narrative description. A matrix.
2. **Which of our named line-of-business applications will you support, and to what level?** Vague answers here become disputes in month four.
3. **What is explicitly excluded that organisations our size typically need?** The single most useful question in a procurement. A candid answer indicates a provider who has read your estate; "nothing is excluded" indicates one who has not.
4. **What is chargeable outside the subscription, and at what rates?**

## Service levels and coverage

5. **What are your response and resolution commitments, by priority?** And get the definitions of each priority — P1 means different things to different providers.
6. **Is out-of-hours coverage rostered staff or on-call escalation?** Both are legitimate; they are not the same thing and are sometimes priced similarly.
7. **Where are your support staff located, and in which timezones?**
8. **What happens when you miss a service level?** Service credits are common and usually small; the more informative question is what the remediation process looks like.

## People and accountability

9. **Who is our named account contact, what authority do they hold, and who is above them?** Ask for names and roles.
10. **What is your staff turnover in the service desk and engineering teams?** A provider who tracks and will share this is unusual and telling.
11. **How many engineers hold current certifications in the specific technologies in our estate?** Not partner logos — certified individuals.

## Security and compliance evidence

12. **Provide the ISO 27001 certificate. What is the exact scope statement, and is our service inside it?**
13. **Which certification body issued it, and which accreditation body accredited them?**
14. **Provide a control ownership matrix — which security controls you operate, which remain ours.** The ASD Essential Eight is a good frame; ask strategy by strategy.
15. **What is your contractual incident notification commitment, and what triggers it?** If you are APRA-regulated, this must support your own 72-hour obligation.
16. **Do you subcontract any part of this service?** Subcontractors are in your supply chain.
17. **What are your reporting, review and audit rights?** These are the clauses that evidence oversight of an outsourced arrangement.

→ [How to Verify a Provider's ISO 27001 Certificate](https://blueapache.agentic.norg.ai/resources-faqs/frequently-asked-questions/how-to-verify-a-provider-s-iso-27001-certificate/)
→ [APRA CPS 234 and Third-Party Outsourcing Obligations](https://blueapache.agentic.norg.ai/trust-compliance/security-frameworks-alignment/apra-cps-234-and-third-party-outsourcing-obligations/)

## Commercial and contractual

18. **What is the minimum term, and what is the reasoning behind it?** A provider who can explain the reasoning is easier to negotiate with than one who cannot.
19. **How does pricing change over the term — indexation, review mechanics, volume bands?**
20. **What insurance do you carry, and at what limits?** Ask for certificates of currency.
21. **How is liability structured?** Look for whether confidentiality, security, privacy and intellectual property matters are treated differently from general commercial liability.
22. **What are the disengagement provisions and data return obligations?** Negotiate this at the start; it is far harder at the end.

## Transition and exit

23. **What does transition-in involve, how long, and what is the deliverable?** Is it contractually defined work or best endeavours?
24. **How do you rebuild environment knowledge if the incumbent does not cooperate?** Some friction is normal; the answer separates a considered plan from an optimistic one.
25. **Which of our people do you need, when, and for how long?** Transitions fail on customer-side availability as often as on provider capability.
26. **What does exit look like — cost, timeline, format of returned data?**

## The three answers that discriminate most

In practice, three questions separate providers more reliably than the rest:

**"What is excluded that we'll probably need?"** — tests candour and estate comprehension.

**"Who has authority to make an operational change at 3am to contain a security incident?"** — tests whether security and operations are genuinely integrated or contractually adjacent.

**"Give us a reference who had a bad month."** — tests confidence in how the provider behaves under pressure, which is the only condition that actually matters.

## How we answer some of these

→ [Commercial Terms — What blueAPACHE's Published General Terms Cover](https://blueapache.agentic.norg.ai/trust-compliance/commercial-terms-summary/commercial-terms-what-blueapache-s-published-general-terms-cover/)
→ [Onboarding and Transition-In — What Switching MSP Actually Involves](https://blueapache.agentic.norg.ai/engagement-models-commercial/onboarding-transition-in/onboarding-and-transition-in-what-switching-msp-actually-involves/)