7 Cybersecurity Questions to Ask Your IT Provider
Cybersecurity affects every aspect of your business, from you and your employees to your customers. Knowing how you’re defended can help you spot gaps and assess whether your IT provider is doing its best to keep you protected.
That’s why we’ve outlined 7 cybersecurity questions you can ask your IT provider today. Afterward, you’ll have a much better understanding of where your company and provider stand.
Key Takeaways
- Conduct a cybersecurity audit at least once a year, with additional reviews when significant changes are made to your IT environment.
- Continuous vulnerability scanning helps identify security weaknesses before attackers can take advantage of them.
- Plan to replace your technology around asset management lifecycles to reduce the risk of outdated hardware. Proper decommissioning is also critical to a healthy technology life cycle.
- An AI usage policy and proper data governance can help reduce the risk of unmanaged AI use.
- Security certifications and independent audits help determine an IT provider’s expertise regarding security risk.
- Regular Cyber awareness training can reduce the chances of your employees falling to social engineering attacks like phishing.
- Test your backups regularly to make sure your data can be recovered when needed.
1. Do you perform cybersecurity audits?
A comprehensive cybersecurity audit is like a health checkup for your organization’s defenses. By auditing your security, you can identify vulnerabilities, review access controls, and determine whether you align with applicable compliance requirements. It helps give you a detailed picture of your cybersecurity posture as a whole.
Your IT provider should conduct annual, comprehensive security audits as a baseline. That said, major changes, like installing new servers, deploying new computers, or significant employee changes, also warrant a review.
Bottom line: Ask your provider how often they perform comprehensive audits, routine check-ups, and whether they continuously monitor your environment for notable changes.
2. How are security vulnerabilities identified and handled?
Cyberattacks can happen when vulnerabilities go undetected. According to the Sophos State of Ransomware 2025 Report, exploited vulnerabilities were the leading technical cause of ransomware attacks, accounting for 32% of incidents. And while an audit can help you uncover weaknesses in your security environment, vulnerability scanning helps identify and remediate the actual threats.
These vulnerabilities can take many forms: maybe an outdated piece of software has a security flaw, or an account lacks multi-factor authentication (MFA). Whatever it is, a cybercriminal can use it to potentially access your business.
If an audit is the overview, vulnerability scans are the work of finding and fixing weaknesses. A good IT provider will use a combination of vulnerability scanning, endpoint detection and response (EDR) tools, and patch management to secure your business.
Bottom line: Ask your provider how often they scan for vulnerabilities, how fast they push critical security patches, and how they prioritize potential threats.
3. What hardware changes should we plan over the next 6-12 months?
Hardware doesn’t last forever. When technology gets old, it can stop receiving critical security updates, making that old computer a dusty security risk.
A good IT partner should have a documented list of your business assets – laptops, computers, mobile phones, etc. – with plans for rolling replacements. This process is known as IT asset management, and it’s critical to a healthy security posture.
But the risks don’t stop after a computer is replaced. Hard drives that contain sensitive data need to be properly disposed of, and old systems need to be disconnected from the internet to avoid potential exploitation.
Bottom line: Ask your IT provider how they handle technology replacements and how they dispose of aging hardware.
4. Do you secure AI tools?
According to data from the U.S. Census Bureau, 56% of workers said they used AI on the job. This isn’t necessarily a bad thing, but if that AI use goes undocumented, it can lead to cybersecurity issues, such as data exposure or compliance violations.
To properly secure your AI, you need two things: an AI usage policy and strict data governance.
Without a policy, your employees won’t know what tools they can and can’t use or what information is safe to enter into those tools. And without strong data governance and AI access policies, your own AI tools may access and expose sensitive data.
Bottom line: Ask your IT provider if they offer guidance regarding AI policies and how they manage data governance to secure AI in the workplace.
5. What certifications do you have and are you independently audited?
Certifications and independent audits offer proof that your IT provider knows what they’re doing.
Cybersecurity certifications like CompTIA Security+, CISSP (Certified Information Systems Security Professional), and CEH (Certified Ethical Hacker) show that an IT professional has invested the time and energy into specializing their security expertise.
Beyond individual certifications, independent audits can help you understand how a provider secures its own systems. When you partner with an IT provider, you’re giving them access to sensitive data that, if handled incorrectly, can spell serious harm. A SOC 2 report, for example, gives you an independent look at how the provider handles that responsibility.
Bottom line: ask your IT provider which security certifications they have and if they have independent SOC 2 reports they can share.
6. Do you offer cyber awareness training?
60% of data breaches (Verizon) in 2025 involved the human element. What does that tell us? Your employees are your first line of defense against cyber threats. Not antivirus. Not encryption. Not firewalls. Your people.
Cybercriminals count on employees making mistakes. It’s why so many social engineering tactics revolve around tricking people into sharing sensitive information they shouldn’t or clicking malicious links.
That’s where cyber awareness training comes in.
By arming your team with the knowledge they need to spot cyber threats, you can drastically reduce the chance they’ll fall for an attack. In fact, KnowBe4 reported that continuous training can reduce phishing susceptibility by up to 86%.
Bottom line: Ask your IT provider if they offer regular cyber awareness training, simulated phishing attacks, and micro training that can be customized to fit your business.
7. How often is my data being backed up and has it been tested?
Data backups are a pillar of business continuity. Without them, you may have no way to recover data lost during an incident, whether that’s a power outage or a cyberattack.
You should schedule your backups depending on how much data your business can afford to lose. That will most likely mean backing up your data at least once a day, though critical backups may need to be updated more frequently. These backups should also be performed outside of business hours, as active backups can slow down your network.
However, having a backup in place doesn’t necessarily guarantee your backups are working. Backups can fail even when they seem to be functioning fine.
That’s why you should regularly test your backups. Here’s a schedule we recommend:
- Every month: Restore a few files and confirm that they open.
- Every quarter: Test a large recovery, like restoring a server or virtual machine.
- Every year: Walk through your full recovery plan. Simulate a real incident to make sure everyone knows what to do.
After each test, record the date, how long recovery took, and any notable events.
Bottom line: Ask your IT provider how often your data is backed up and when the last time they tested a successful recovery was.
What if your IT provider can’t answer these questions?
You look for a new provider.
That may sound harsh, but it’s true. A reliable IT provider should be able to answer all of these questions with detailed and satisfactory answers. If they can’t, it means you aren’t getting the protection your business needs and deserves.
At The 20 MSP, we offer everything we’ve covered here, from 24/7 vulnerability scanning to backups, with SOC 2 Type II reporting. Because you deserve a provider that will do everything in their power to mitigate your cybersecurity risk.
If you’re looking for a provider that takes cybersecurity seriously, reach out to The 20 MSP today.
About The 20 MSP
As a leading provider of managed IT services, The 20 MSP serves thousands of businesses nationwide, including single and multi-location organizations, delivering white-glove service, secure and streamlined IT infrastructure, and 24/7/365 support. We believe in building lasting relationships with clients founded on trust, communication, and the delivery of high-value services for a fair and predictable price. Our clients’ success is our success, and we are committed to helping each and every organization we serve leverage technology to secure a competitive advantage and achieve new growth.
