Choosing an IT Service Provider: 8 Questions to Ask

Whether it is a new website, server support or custom software, sooner or later almost every company needs an external IT service provider. The choice is wide: Kiel, Schleswig-Holstein and Hamburg alone have numerous IT system houses, agencies, software developers and independent consultants. This article helps you find the right partner with eight targeted questions, whoever you end up choosing.

First: what exactly do you need?

Before requesting quotes, outline your needs. IT service providers differ considerably in their focus:

Many providers cover several areas. A short description of your goal, scope, preferred timeframe and existing systems makes quotes comparable.

Question 1: What experience do you have with similar tasks?

Do not just ask for references in general; ask about projects similar to yours: same company size, a similar industry or comparable technology. A reputable provider can explain how they solved similar tasks, even if they cannot name clients for confidentiality reasons. If possible, talk to an existing customer.

Question 2: Who is my contact, and how do I reach them?

For smaller companies in particular, a dedicated contact who knows your environment matters. Clarify how you request support (phone, email, ticket system), when the provider is available and who takes over during holidays or illness. A one-person provider can be very good, but needs a cover arrangement.

Question 3: How quickly do you respond to incidents?

For ongoing support, response times should be set out in writing, usually in a service level agreement (SLA). This is an agreement on measurable services such as response and recovery times. Note the difference: response time means someone gets back to you, not that the problem is solved. Also ask whether there is out-of-hours cover and what it costs.

Question 4: Do you work on site or remotely?

Many IT tasks can now be handled via remote maintenance. For hardware, network problems or training, an on-site visit is often still useful. If in-person presence matters to you, a provider from your region has an advantage, for example in and around Kiel or in the Hamburg area. For pure software development, location plays a smaller role.

Question 5: What does the pricing model look like?

Three models are common:

• Time and materials: you pay for the hours actually worked. Flexible, but hard to plan.
• Fixed price: for clearly defined projects. Easy to plan, but requires a precise specification.
• Monthly flat fee: for support and managed services. Predictable costs, but check the scope carefully.

Ask what is included in the price and what costs extra, such as travel, out-of-hours work or licences. Do not compare hourly rates alone: a higher rate with a faster solution can be cheaper overall.

Question 6: How do you handle data protection and IT security?

If a provider has access to systems containing personal data, you will generally need a data processing agreement under Art. 28 GDPR. A professional provider will offer one without being asked.

Also ask about:

• how credentials and administrator rights are handled
• multi-factor authentication for remote access
• the backup concept and regular restore tests
• certifications, such as ISO/IEC 27001, if relevant to your industry

For companies covered by Germany's NIS2 Implementation Act, supply chain security is explicitly part of their obligations. This includes IT service providers.

Question 7: Who owns the code, data and access?

This question is often forgotten and becomes all the more important later. Clarify in the contract:

• Who receives the rights of use for the source code developed?
• Do you have your own administrator access to your systems, domains and accounts?
• Where is the documentation stored, and do you have access to it?

Domains, cloud accounts and licences should be registered to your company, not to the provider.

Question 8: What happens if we end the relationship?

A good contract also covers the end. Ask about notice periods, the handover of data and documentation, and whether the provider will support a transition to another provider. The more open the technologies used and the better the documentation, the easier a later switch will be.

Start small before you commit

If you are unsure, begin with a manageable assignment, such as an assessment of your IT, a small sub-project or a workshop. This lets you get to know the provider's way of working, communication and reliability before you sign a longer-term support contract.

Pay attention to soft factors too: does the provider explain technical terms clearly? Do they ask follow-up questions? Do they keep appointments? Good collaboration depends not only on technical skill but also on whether you feel understood.

Warning signs

Be cautious if a provider:

• sends a quote immediately without asking about your needs
• is unwilling to provide a written scope of services
• does not want to hand over access credentials and passwords
• relies on proprietary solutions that only they can maintain
• does not offer a data processing agreement

Checklist for your selection meeting

1. Describe your needs in writing: goal, scope, timeframe, existing systems
2. Obtain two to three quotes and compare them using the same criteria
3. Ask about similar projects and, if possible, reference calls
4. Clarify contact person, cover and availability
5. Put response times and scope of services in writing
6. Ask for a transparent pricing model and any additional costs
7. Check the data processing agreement and security measures
8. Settle rights to code, data and access in the contract
9. Agree on exit terms and documentation

Simplify Data as an IT service provider in Kiel

Simplify Data is an IT service provider based in Kiel, serving companies in Kiel, Schleswig-Holstein and Hamburg as well as remotely across Germany. You are of course welcome to put the questions in this article to us as well. Learn more about our services on the page IT service provider in Kiel.

Sources

• EUR-Lex: General Data Protection Regulation, Art. 28 Processor
• BSI: NIS2-regulated companies (German)