The IT Buyer's Guide
Vol. I · Issue 01 · Spring 2026
MCSP
Intelligent Automation The IT Buyer's Guide · Vol. I
Book a Review →
The
IT Buyer's
Guide
Vol. I · Issue 01
Spring 2026
US $24.00
intelamation.com
Special Issue · Small Business

12 Questions That Save You from The Wrong IT Provider.

A field guide for the business owner who's tired of jargon, hidden fees, and the slow-motion failure of "fine for now."

12Questions Every Owner Must Askp. 30
3Models of IT, Comparedp. 06
50Tech Terms in Plain Englishp. 65
Published by
Intelligent Automation
MastheadVol. I · Issue 01Page 02
From the Publisher
A guide worth keeping on the shelf.

This is a special-edition publication of Intelligent Automation, written for the small-business owner who has more important things to do than learn the difference between an SLA and an SLO. We wrote it the way we'd want to be talked to: directly, with no acronym soup and no sales theatre.

If a single page in this issue spares you a six-figure mistake or a Tuesday morning you'll never get back, it has done its job.

AuthorDavid S. Levin · CEO EditorialIntelligent Automation Editorial · Daniel Ramos · Victor Ramos Subject25 years of MSSP fieldwork. Hundreds of business interviews. Real receipts. DesignFraunces · Manrope · JetBrains Mono. Photography licensed via Unsplash. Distributionintelamation.com · meetings.intelamation.net Inquiries[email protected] · Press · Speaking · Bulk
The IT Buyer's Guide02
ContentsInside this issuePage 03
In this issue
The Contents.
01From One Owner to AnotherEditor's Letter04
02Not All IT Is Built the SameThe Field Guide · 3 Models06
03Why Owners SwitchThe Investigation · 6 Warning Signs11
04A Clean Handoff PlanThe Playbook · How to Switch14
05The 12 Questions, DecodedThe Centerfold & Deep Dives16
06What Setup Do You Actually Need?The Workshop · Self-Diagnostic31
07The Decoder50 IT Terms in Plain English35
08The Sales-Call DetectiveSmart Questions to Ask38
09Reading a Service AgreementWithout Falling Asleep43
10Quick-Compare WorksheetThe Pull-Out47
11One Last ThingFrom the Author48
The IT Buyer's Guide03
David S. Levin · CEO, Intelligent Automation
Editor's LetterFrom One Owner to AnotherPage 05
The Letter

Dear Fellow Business Owner,

If you're reading this, there's a good chance you're looking for an IT provider who can keep your infrastructure running, available, and secure — or you're wondering, quietly, whether your current one is still pulling their weight. Either way, I'm glad you picked this issue up.

I've run an MSSP for the better part of three decades. In that time I've sat across from hundreds of business owners who were burned by their last provider, drowning in jargon, or just plain tired of guessing what "good IT" was supposed to look like.

This is not what you'd call a normal magazine. Think of it as a toolbox, not a novel. Flip to the section that fits what you're dealing with right now. Get your answer. Find a good provider. Forget this issue exists.

I'm not here to sell you anything. I'm here to walk you through the twelve questions I believe everyone should ask before signing an IT contract — the same questions I'd want my own family to ask.

David S. Levin
CEO · Intelligent Automation, LLC
Editor's Letter05
Feature One · The Field Guide
01The Three Models

Not all IT is
built the same.

Break-fix, managed, co-managed. Three very different relationships, three very different outcomes.

Photograph · Unsplash · Page 06
Field GuideThree models, demystifiedPage 07
The Field Guide

Three models. One choice.

Most owners don't know which model they're paying for. Here's the side-by-side.

Model 01

Break-Fix

Like calling a plumber when the pipe bursts. You pay only when something goes wrong — no monitoring, no contract, no incentive to prevent the next failure.

Model 02

Managed Services (MSP)

A licensed pro checking valves and tightening seals before anything leaks. Monthly fee, proactive monitoring, patching, backups, strategic guidance.

Model 03

Co-Managed IT

Your in-house team runs the day-to-day; the MSP handles infrastructure, security, audits, and the moments your team is stretched thin.

Field Guide07
Field Guide · Model 01Break-Fix ITPage 08
Model 01

Break-Fix.

"Something broke. Call someone. Pay them. Move on."

This is the most basic form of IT support, and for a while, it seems like the most logical one. There's no monitoring, no monthly fee, no proactive maintenance. You get a technician who responds when there's a problem and charges you an hourly rate.

For very small businesses — solo operators, shops, startups on a shoestring budget — Break-Fix can be perfectly fine. Especially if you only use a couple of computers, don't store sensitive data, and can afford a bit of downtime.

But once your business grows, this model cracks. The technician walks in cold, with no documentation. Response is whenever they're free. There's zero incentive to prevent the next failure — every fix is reactive. And without monitoring, problems bubbling under the surface (failed backups, expired antivirus) go unnoticed until they explode.

Break-Fix08
Field Guide · Model 02Managed ServicesPage 09
Model 02

Managed Services.

"Don't wait for the leak. Tighten the seals before it ever drips."

If Break-Fix is calling the plumber when a pipe bursts, Managed Services is having a licensed pro regularly checking the valves and tightening the seals — even when you're not looking.

You pay a monthly fee. Your provider actively manages your systems: monitoring for issues, installing updates, patching security holes, handling backups, and offering day-to-day support when something's off. But it's more than outsourced helpdesk. A good MSP doesn't just respond to problems — they prevent them. They document your environment, know your people, and over time, guide your IT strategy.

Not all MSPs are equal. Some promise the moon and deliver surface-level support. The model is proactive by design — but its success still depends on choosing the right partner.

Managed Services09
Field Guide · Model 03Co-Managed ITPage 10
Model 03

Co-Managed IT.

"In-house team plus an external safety net. Best of both."

In a co-managed setup, your internal IT team and an external MSP work together. Think of it like an in-house plumber who knows every pipe in the building, plus a professional firm that handles the city hookups and pressure testing.

Internal handles the everyday: user setups, password resets, printer issues, Janet's email not syncing. The MSP steps in for infrastructure audits, system backups, patching, security updates, and planning for growth or compliance.

You give your internal team breathing room while gaining deeper expertise, enterprise tools, and backup when someone's out sick or stumped. It only works with clear boundaries, shared documentation, and trust — without those, tickets get lost and "us vs. them" creeps in.

Co-Managed IT10
Feature Two · The Investigation
02Six Warning Signs

Why owners switch IT providers.

It's almost never one fire. It's a slow accumulation — small disappointments, dodged questions, invoices that creep.

Photograph · Unsplash · Page 11
The InvestigationSigns 1–3Page 12
Six Signs · Part One

The first three.

01Operational Failures

A ransomware attack mishandled. An outage that drags for days. Backups that turn out to be empty folders. The damage isn't just the failure — it's the absence of a calm, accountable response.

02Recurring Issues

A good provider diagnoses, documents, and ensures it doesn't come back. When that doesn't happen, your team adapts the wrong way — quiet workarounds, abandoned tickets, support you're paying for but not using.

03The Reactive Trap

They wait for things to break, then jump in. No roadmap, no check-ins, no foresight. You're the one bringing up problems — when it should be the other way around.

Trust erodes quietly — until one bad outage forces the conversation.
Six Warning Signs12
The InvestigationSigns 4–6Page 13
Six Signs · Part Two

The last three.

04Communication Breakdown

Tickets sit unanswered. Updates never come. Your team re-explains the same problem to a stranger every time. Slowly, employees stop reaching out at all — and that culture is hard to undo.

05Mismatched Relationship

Technically competent, but every conversation is transactional. They never ask about your goals. They fix computers — they don't think strategically. Never make the leap from vendor to partner.

06Price vs. Value Drift

Costs creep, the experience flatlines, invoices feel like surprise parties. You stop being able to say what's included, what's extra, or whether the price is fair anymore.

Six Warning Signs13
Feature Three · The Playbook
03The Handoff

How to switch without the smoke.

A clean handoff is the difference between a quiet Tuesday and a week-long crisis.

Photograph · Unsplash · Page 14
The PlaybookThe Five-Step SequencePage 15
The Playbook

The five-step sequence.

The single most common transition mistake: giving notice to your old provider before the new one is fully ready. Sequence saves you.

1Choose your new provider. Fully vetted, contract reviewed, references called.

2Schedule onboarding and the documentation transfer.

3Only then, give notice to your current provider.

4Set a transition window. Two to four weeks of overlap is normal.

5Deactivate old credentials only after full testing — never before.

A good provider's first quote will include some cleanup labor. That's not a red flag — it's a sign they're doing it right.

The Playbook15
12
The Centerfold · Feature Five

The 12 Questions Every
Owner Must Ask.

Tape this to your wall. The answers an IT provider gives to these twelve questions tell you whether you're hiring a partner — or a problem you'll be replacing in eighteen months.

1
2
3
4
5
6
7
8
9
10
11
12
"In the moment of decision, the best thing you can do is the right thing. The worst thing you can do is nothing." — Theodore Roosevelt
All Twelve · At a Glance

The Checklist.

01
Do they ask smart questions about your business?

A real partner is curious before they're confident.

02
Can they explain it in plain English?

Clarity is not optional. Confusion is the answer.

03
Sample agreement before commitment?

Surprises belong at birthday parties.

04
Recent, relevant references?

A real client is worth more than every review.

05
A clear onboarding plan?

"We'll figure it out" is the plan for every week after.

06
Audit before quoting?

A doctor with a prescription before you've spoken is malpractice.

07
Prevention, not just fixing?

Heroes celebrate fires. Pros prevent them.

08
What's included — and what's not?

The difference between peace and surprise invoices.

09
Communication & support?

Response times in writing or it didn't happen.

10
Your tools — or theirs forced?

"Our standard stack" is sometimes a tax.

11
A real process, or winging it?

Process is consistency when the principal isn't on the call.

12
Partner — not just provider?

The intangible. If this is wrong, none of it lasts.

01
Checkpoint OneSmart questionsPage 18
Checkpoint · 01

Do they ask smart questions about your business?

Ten minutes of curiosity tells you more than ten pages of marketing.

A good partner won't kick things off with "our packages." They'll be genuinely curious — how your team works, what tools you rely on, where things break down. The weird workflow that only Lisa in accounting understands? They'll want to know about it.

Your business isn't "just like every other business." A provider who treats you like a template will deliver template results. If they're proactive in their first conversation, they'll be proactive throughout the partnership. If they aren't, they won't.

Red Flags
  • "Our standard plan fits all."
  • Rushes straight to pricing.
  • Talks only about tech specs.
  • No detailed workflow questions.
  • Pushes for quick commitment.
Green Flags
  • Asks about team workflows.
  • Probes real frustrations.
  • Asks future-focused questions.
  • Curious about critical software.
  • Asks questions that make you think.
Checkpoint 0118
02
Checkpoint TwoPlain EnglishPage 19
Checkpoint · 02

Can they explain what they do in plain English?

You shouldn't need a CS degree to understand your IT provider.

Nobody has time (or willpower) to decode tech jargon. A good provider knows this. They use everyday language — they don't rattle off buzzwords to sound smart. If you leave a meeting feeling confused or like you've been nodding along to avoid looking out of your depth, you're talking to the wrong person.

Clarity is not optional in IT. Decisions involve your data, your money, and your team's ability to do their job. Those decisions need to be easy to understand — otherwise your business is at risk, which is the exact opposite of what should happen when you bring in someone to help.

Red Flags
  • Heavy jargon.
  • Talks down or patronizes.
  • "It's complicated — trust us."
  • Leaves you feeling lost.
  • Confusion after meetings.
Green Flags
  • Simple, clear explanations.
  • Makes you feel comfortable.
  • Relatable, everyday language.
  • Visuals that simplify, not confuse.
  • Patient with your questions.
Checkpoint 0219
03
Checkpoint ThreeSample agreementPage 20
Checkpoint · 03

Will they show you a sample agreement before you commit?

Surprises belong at birthday parties. Not in contracts.

A trustworthy provider offers to walk you through the agreement before anything is official. Not "email it over and hope you don't ask questions" — actually sit down and go through what's included, what's not, how long it lasts, and how you exit if things sour.

Reviewing the agreement together also reveals how they handle the unglamorous stuff: response times, after-hours rates, weekend coverage, cancellation. If any of that has to be inferred, that's the answer.

Red Flags
  • Contract shown last-minute.
  • "It's all standard."
  • Hidden clauses or vague terms.
  • No clear exit strategy.
  • Pushes for quick signing.
Green Flags
  • Insists on reviewing it together.
  • Highlights critical clauses.
  • Transparent on pricing.
  • Simple cancellation terms.
  • Welcomes specifics.
Checkpoint 0320
04
Checkpoint FourReferencesPage 21
Checkpoint · 04

Can they provide recent, relevant references?

Anyone can stage a five-star review. A real client on a real call is worth more.

You should be able to talk to a real client — not a cherry-picked testimonial from five years ago, not a wall of vague reviews. Ideally a business owner or manager running a similar-sized business with similar problems, who worked with them recently.

"We don't really do references" or vague privacy excuses usually mean nobody's willing to vouch. You're not buying a product off a shelf — you're choosing someone who'll be inside your systems, touching your data, and helping keep your business running. A good provider won't flinch when you ask.

Red Flags
  • Vague privacy excuses.
  • Only outdated testimonials.
  • Reviews sound generic.
  • No direct client contact.
  • References sound rehearsed.
Green Flags
  • Provides relevant contacts readily.
  • Recent client conversations.
  • Similar-sized clients.
  • Open about past challenges.
  • Authentic, balanced feedback.
Checkpoint 0421
05
Checkpoint FiveOnboarding planPage 22
Checkpoint · 05

Do they walk you through a clear onboarding plan?

If their plan for week one is "we'll figure it out," that's the plan for every week after.

You should never agree to anything until you know exactly what happens after the contract is signed. A good IT provider explains onboarding step by step: how they take over support, what systems they audit, who on their team talks to whom on yours, what to expect in week one and beyond.

The more clarity upfront, the more likely they've done this before — and done it well. They'll have a checklist and a timeline. If they wave off your questions with "we'll figure that out once the paperwork's in," they're improvising the start. Which doesn't inspire confidence about the rest.

Red Flags
  • "We'll figure it out later."
  • Unclear first-week expectations.
  • Vague about audits.
  • Appears unprepared.
  • No defined roles.
Green Flags
  • Step-by-step plan.
  • Clear team roles.
  • Defined schedule.
  • Proven onboarding checklist.
  • Confident communication.
Checkpoint 0522
06
Checkpoint SixAudit firstPage 23
Checkpoint · 06

Do they audit your IT and security before quoting?

A doctor with a prescription before you've spoken is malpractice. Same rule here.

If a provider sends a quote before reviewing how your business actually runs, they're guessing. In IT, guessing leads to problems. Every business has its quirks: aging hardware, untested backups, a team that clicks phishing emails like it's a sport. A one-size-fits-all plan can't address any of it.

A proper provider starts with discovery — access to systems, scans, conversations with your team, and an honest look at what's working, what's not, and what's putting you at risk. The audit is the only way to know what support you actually need.

Red Flags
  • Quotes without auditing.
  • Assumes all clients are the same.
  • Generic advice.
  • Rushed to sell.
  • Heavy guesswork.
Green Flags
  • Conducts discovery sessions.
  • Provides security assessment.
  • Bases quote on real data.
  • Identifies risks.
  • Tailors recommendations.
Checkpoint 0623
07
Checkpoint SevenPrevention vs. fixingPage 24
Checkpoint · 07

Do they prevent — or just fix?

Heroes celebrate fires. Professionals make sure fewer fires start.

Some providers love playing hero — they swoop in, save the day, collect praise. But if you're always paying for damage control, you're paying for the wrong thing. Good IT is rarely about putting out fires. It's about ensuring fewer fires start.

That means 24/7 monitoring, security patches applied on schedule, software kept current, anomalies caught before anyone calls support. Most of it happens behind the scenes — and if done right, you barely notice. Ask: how do you minimize disruptions? Do you track patterns? Do I get prevention reports? Or do you wait for the next outage?

Red Flags
  • Waits for problems.
  • Celebrates fixing repeats.
  • Ignores patterns.
  • Reactive comms only.
  • No prevention plan.
Green Flags
  • 24/7 monitoring baseline.
  • Regular preventive maintenance.
  • Proactive patching.
  • Reports on prevention.
  • Breaks repeat issues.
Checkpoint 0724
08
Checkpoint EightWhat's includedPage 25
Checkpoint · 08

What's included — and what's not?

"Unlimited" rarely means what you think it means.

A good provider makes it crystal clear what you're paying for monthly — and what's not included. A clean breakdown so there's no confusion when something needs fixing, upgrading, or replacing. If a project comes up, you should know in advance whether it's part of your plan or considered extra.

Same for on-site visits, after-hours support, and hardware installs. Watch for "unlimited" with footnotes — it rarely means what you think. A transparent provider walks you through what's included, where the line is, and how anything outside the plan gets handled.

Red Flags
  • "Unlimited" with exceptions.
  • Surprise charges.
  • Dodges specifics.
  • Vague about on-site fees.
  • Hidden footnotes.
Green Flags
  • Crystal-clear breakdown.
  • Transparent on extras.
  • Clarifies "unlimited."
  • Defined billing structure.
  • Welcomes billing questions.
Checkpoint 0825
09
Checkpoint NineCommunicationPage 26
Checkpoint · 09

How do they handle communication?

Things break exactly when you need them most. Speed matters.

Before you sign with any provider, ask what support looks like on a normal day. How do you submit a request? Is there a ticketing system? Do you call, email, or chat — and who actually responds, how fast? You're paying for tech support, but you're also paying for responsiveness, structure, and peace of mind.

The best providers have a clear process: where to go, who's responsible, how long it usually takes. Some share reports of average response and resolution times — accountability in writing. "Just shoot us an email and we'll get to it" sounds casual; it usually means there's no system behind the scenes.

Red Flags
  • "Email us and wait."
  • No clarity on responder.
  • No response times.
  • Hard to reach in emergencies.
  • Inconsistent comms.
Green Flags
  • Defined ticketing system.
  • Named point of contact.
  • Tracks & shares metrics.
  • Step-by-step workflow.
  • Prioritized urgent help.
Checkpoint 0926
10
Checkpoint TenYour toolsPage 27
Checkpoint · 10

Your tools — or theirs forced?

"Our standard stack" is sometimes a feature. Sometimes it's a tax.

Some providers walk in and immediately plan to replace everything — new software, new systems, all chosen based on what they prefer using, not what's right for your business. Sometimes a switch makes sense (outdated, unsupported, constantly breaking systems) — but a good provider explains the risks clearly.

If their only reason is "this is what we use with all our clients," start asking questions. Your business runs on certain tools. Your team knows them. Your workflows are built around them. A provider who respects that will at least try to work with what you have first — and if they suggest a switch, walk you through pros, cons, and a transition plan.

Red Flags
  • "We'll move you to our stack."
  • One-size-fits-all software.
  • Pushes changes without reason.
  • Ignores team familiarity.
  • No transition plan.
Green Flags
  • Open to your tools.
  • Recommends per your setup.
  • Explains pros & cons.
  • Respects workflows.
  • Collaborative upgrades.
Checkpoint 1027
11
Checkpoint ElevenA real processPage 28
Checkpoint · 11

Do they have a process — or are they winging it?

Without structure, things go wrong more often. And your business takes the hit.

An IT provider who runs on gut feeling instead of systems can turn your tech infrastructure into a bowl of spaghetti. They react to whatever breaks, cross their fingers, and have no checklist or way to track progress. Whether it's a one-person show or a team of fifty, a good provider has documented processes for tickets, updates, maintenance, and security checks.

You don't need to know all the details. But you need to see they have a system. Ask about routines: regular maintenance? How are tickets handled? Do they schedule reviews or check-ins? "It depends" or "I just go with the flow" is a warning.

Red Flags
  • "I fix things as they come."
  • No defined ticket process.
  • No schedule for reviews.
  • Nothing documented.
  • Unclear roles.
Green Flags
  • Documented support process.
  • Real ticketing system.
  • Proactive review schedule.
  • Onboarding steps shared.
  • Tracks recurring problems.
Checkpoint 1128
12
Checkpoint TwelvePartner, not providerPage 29
Checkpoint · 12

Partner — not just a provider?

The intangible one. The hardest to measure. The one that determines if you're still working together in five years.

By the time you're in sales conversations, you've seen the website, the materials, maybe the proposal. None of that tells you what it's actually like to work with them. The real clues come from how they handle early interactions: tone of emails, questions they ask, how they respond when you raise an issue.

A true partner shows you they want long-term. Responsive, transparent, says "I don't know" when they don't know, follows up when they say they will. If they seem rushed, pushy, or too eager to close, that's a sign. Trust your gut — it's underrated.

Red Flags
  • Pushy or rushed.
  • Overpromises.
  • Vague responses.
  • Doesn't ask about goals.
  • "Just sign and we'll handle it."
Green Flags
  • Consultative, low pressure.
  • Tailored recommendations.
  • Direct communication.
  • Asks thoughtful questions.
  • Earns trust.
Checkpoint 1229
Workshop · Self-Diagnostic
04Your Setup

What kind of IT setup do you actually need?

Three honest profiles. Find yours, and what to do about it.

Photograph · Unsplash · Page 30
Workshop · Profile 01Basic Needs · Low RiskPage 31
Profile 01 · Basic Needs · Low Risk

The Solo or Small Shop.

Few users, no sensitive data, can survive a tech hiccup.

You're here if
  • You have 1–5 employees.
  • Everyone uses basic tools (email, office docs, browser).
  • You don't store sensitive data (health, finance, legal).
  • Your business can survive a tech issue for a few hours or even a day.
Common signs
  • "We only call someone when something breaks."
  • "Our guy is cheap and gets the job done — eventually."
  • "We don't think about IT unless something goes wrong."
What you need
  • Ad-hoc / Break-Fix support.
  • A better go-to expert for emergencies.
  • At minimum: documented passwords, verified backups, antivirus.
Profile · Basic31
Workshop · Profile 02Growing · Moderate RiskPage 32
Profile 02 · Growing · Moderate Risk

The Growing Business.

Real operations, real downtime cost, real risk if no one's watching.

You're here if
  • You have 5–250 employees.
  • You use industry-specific tools or cloud platforms.
  • You can't afford downtime longer than an hour or two.
  • You've grown past "we'll deal with it later."
Common signs
  • "We've had the same issue three times this month."
  • "I think we're paying for three different cloud storage vendors."
  • "We have a backup system, but I'm not 100% sure it's working."
What you need
  • Managed IT Services (MSP).
  • 24/7 monitoring.
  • Fast helpdesk support.
  • Updates, security, backups, and vendor management.
Profile · Growing32
Workshop · Profile 03Mission-Critical · High RiskPage 33
Profile 03 · Mission-Critical · High Risk

The Enterprise-Grade Operation.

If IT stops, the business stops. Compliance is on the table.

You're here if
  • You have 50+ employees, or you have an internal IT team.
  • Your business stops if IT stops.
  • You handle sensitive data with compliance (HIPAA, GDPR, CMMC, etc.).
  • You're planning growth, M&A, or digital transformation.
Common signs
  • "Our internal IT team is overwhelmed."
  • "We need to standardize and document everything."
  • "We've had an audit or insurance scare."
What you need
  • Co-Managed IT.
  • In-house team + MSP backup & support.
  • Documentation and planning.
  • Budget forecasting and risk mitigation.
Profile · Mission-Critical33
Reference · The Decoder
05Tech Jargon, Decoded

Plain English. Finally.

A short, honest dictionary for the words an IT provider should never make you Google in secret.

Photograph · Unsplash · Page 34
Decoder · A–GIT terms in plain EnglishPage 35
Plain-English Decoder · Part 1

A through G.

Active Directory / Entra ID
Where all your user logins and access rules live.
Admin Rights
Accounts with full system access. Everyday users should never have them — too many doors for mistakes or malware.
Antivirus
Basic software that blocks known threats. A must-have, but not bulletproof.
Backup
Copies of important files. If it's never been tested, it's a wish — not a backup.
Bandwidth
How much data your internet can handle at once. More = faster.
BCDR
Business Continuity & Disaster Recovery. The plan that keeps you online when something serious goes wrong.
BYOD
Bring Your Own Device. Handy, but risky if not managed.
Cloud
Your stuff (emails, files, systems) stored securely online. Someone else's computer, basically.
Cloud-to-Cloud Backup
Backups of cloud data (mail, Drive) — because the cloud isn't a backup by itself.
Compliance
Following industry rules (HIPAA, GDPR, CMMC). Ongoing posture, not a checkbox.
Disaster Recovery
The plan for "what if everything goes boom?" Backups, spares, failovers.
DNS
The internet's address book. If it breaks, sites stop loading even if your internet works.
Downtime
When systems stop and business hits the brakes.
EDR
Endpoint Detection & Response. Smart antivirus that watches behavior, not just signatures.
Email Filtering
Blocks malicious mail before it reaches the inbox.
Encryption
Locking data so only authorized people can read it.
Encryption at Rest
Data scrambled even when stored — safe if a drive is stolen.
Endpoint
Any device on your network: laptop, desktop, tablet, phone. Where most attacks land.
Firewall
The bouncer at the door of your network.
Firewall Rules
What traffic gets in or out.
Decoder · A–G35
Decoder · H–PIT terms in plain EnglishPage 36
Plain-English Decoder · Part 2

H through P.

Helpdesk SLAs
Response time promises from your provider.
Helpdesk Ticket
A formal way to log an IT issue — so nothing gets lost.
IT Audit
A full review of systems, risks, licenses, and weak spots.
Lifecycle Management
Tracking tech so it's replaced before it slows you down or breaks.
Log File
A behind-the-scenes diary of what your system has been doing.
MFA Fatigue Attack
Hackers spam login requests hoping you click "Approve" to make it stop.
MDM
Mobile Device Management. Secures phones & tablets; can wipe lost devices.
MFA
Multi-Factor Authentication. Extra step to log in (SMS, app, key). Cuts takeover risk by orders of magnitude.
MSP
Managed Service Provider. Outsourced IT on a monthly fee, proactively managing your environment.
MSSP
Managed Security Service Provider. An MSP whose practice is built around cybersecurity.
Onboarding / Offboarding
Getting new staff set up (or removing access cleanly when they leave).
Patch / Patching
Software updates that fix bugs and security holes.
Patch Management
The system that keeps every device updated and secure on a schedule.
Password Manager
An app that remembers your passwords so you don't have to use "123456."
Pen Test
Hired ethical hackers try to break in to find weaknesses before the bad guys do.
Phishing
Trick emails designed to steal logins, money, or data. Now AI-assisted.
Phishing Simulation
Safe fake scam emails sent to staff to test how prepared they are.
Decoder · H–P36
Decoder · R–ZIT terms in plain EnglishPage 37
Plain-English Decoder · Part 3

R through Z.

Ransomware
Malware that locks files and demands payment to unlock them. Backups + segmentation are your real insurance.
Remote Desktop
Accessing your work computer from another location.
RMM
Remote Monitoring & Management. Software that lets your IT provider watch your systems 24/7 and fix problems remotely.
Root Cause Analysis
Figuring out why something broke so it stops happening.
SaaS
Subscription apps you access online (QuickBooks, Canva, etc.).
Sandboxing
Testing suspicious files in a safe, sealed-off digital bubble.
Shadow IT
When staff install their own apps without telling anyone.
SIEM
Security Information & Event Management. Collects logs from everywhere and makes sense of them.
SLA
Service Level Agreement. A written promise about response & resolution times. If it's not in writing, it isn't a promise.
SOC
Security Operations Center. The 24/7 team watching the alerts.
SSO
Single Sign-On. One login for everything. Convenient — must be secured properly.
Uptime
The percentage of time your systems are working.
User Permissions
What each person can access, edit, or delete. Set wisely.
Version Control
Tracks changes to documents/code so nothing important gets lost.
VPN
Virtual Private Network. Secure tunnel for remote access. Increasingly replaced by Zero Trust models.
Whitelist / Blacklist
What's allowed in (whitelist) vs. blocked (blacklist).
XDR
Extended Detection & Response. Correlates signals across endpoint, network, identity, cloud.
Zero-Day
A new security hole hackers know about, but no one has patched yet.
Zero Trust
"Never trust, always verify." Assumes the network is hostile and authenticates every request.
Decoder · R–Z37
Toolkit · The Sales-Call Detective
06Smart Questions

The questions that make providers sit up.

Print this. Keep it on your second monitor. Stay in control of the conversation.

Photograph · Unsplash · Page 38
Sales-Call DetectiveTheir Business · Their ServicePage 39
About Their Business
Who will actually be supporting us day-to-day?
You're checking that they're a real business with real depth.
Green
"Dedicated helpdesk team. Your main contact will be Sarah — you'll meet her at onboarding."
Red
"That'd be me. I'll get back to you when I can."
How many clients do you support — and how many like us?
Checking for experience and capacity.
Green
"42 businesses, mostly 5–50 employees. Six are in your industry."
Red
"All kinds of businesses... in the past."
About Their Service Model
What's included in the monthly fee — and what's not?
Checking for sneaky exclusions.
Green
A clear, written breakdown with no ambiguity.
Red
"It's all unlimited" — but they can't show you what that includes.
How do you handle after-hours emergencies?
Checking for true 24/7 support.
Green
On-call rotation, guaranteed response times.
Red
"We'll get back to you the next day."
Sales-Call Detective39
Sales-Call DetectiveYour Business · ReportingPage 40
About Your Business
What would your onboarding plan look like for us?
Checking for structure and thoughtfulness.
Green
"Full audit, document your environment, meet your staff, lay out a 30-60-90 day roadmap."
Red
"Once you sign, we'll figure it out."
Do you do a tech or security audit before quoting?
Checking due diligence.
Green
"Absolutely. Risk assessment and discovery first."
Red
"All clients are on the same plan, so no need."
About Results & Reporting
What kind of reports will we get, and how often?
Checking transparency and accountability.
Green
"Monthly reports — tickets, response times, updates, risks."
Red
"We don't do reports unless you ask."
How do you measure your own performance?
Checking whether they hold themselves to real metrics.
Green
"SLA adherence, CSAT, ticket resolution times."
Red
"We just make sure things get done."
Sales-Call Detective40
Sales-Call DetectiveSecurity · StrategyPage 41
About Security & Compliance
What's your process for handling a security incident?
Checking for a real incident-response plan.
Green
"Formal IR process, immediate notification, full documentation, post-incident debrief."
Red
"We'll fix it and let you know if it's serious."
How do you help us stay compliant?
Checking whether they understand your obligations.
Green
"Aligned with HIPAA/GDPR/insurance requirements; we provide documentation."
Red
"That's on your legal team, not us."
About Their Thinking & Strategy
What threats are you watching for clients right now?
Checking if they're proactive and informed.
Green
"AI-driven phishing, Microsoft licensing changes, upcoming compliance shifts."
Red
"We deal with issues as they come up."
A recent example of helping a client improve through tech?
Checking for business impact, not just keeping the lights on.
Green
"We automated 4 hours/day of manual work for a logistics firm by restructuring their SharePoint."
Red
"We mostly just keep systems running."
Sales-Call Detective41
Sales-Call DetectiveFit · AgreementPage 42
About Fit & Honesty
When would you not be the right fit?
Checking self-awareness.
Green
"Not ideal for occasional help or anyone who doesn't value long-term strategy."
Red
"We work with anyone."
What would make you fire a client?
Checking values and boundaries.
Green
"Ignoring security best practices, mistreating our team, refusing to invest in basics."
Red
"We'd never do that." (Translation: no boundaries.)
About the Agreement
Walk me through the agreement — now, not after.
Checking transparency.
Green
"Of course. I'll highlight response times, cancellation, and scope."
Red
"You'll see all that in the contract once you're ready."
If we leave, how do you handle offboarding?
Checking how they treat clients at the end.
Green
"Documentation, access transfer, assistance to your next provider for a clean exit."
Red
"We'll figure that out if it comes up."
Sales-Call Detective42
Field Manual · Service Agreements
07The Contract

How to read a contract without falling asleep.

Nine clauses. What to look for. What to watch out for. How to ask the smart question.

Photograph · Unsplash · Page 43
Service Agreements · 1–3Scope · SLAs · TerminationPage 44
Clauses · 1 to 3
01
Scope of Services
Look for
  • Detailed service list (helpdesk, monitoring, backup).
  • Specific systems & technologies covered.
  • What "maintenance" or "support" actually means.
Watch out for
  • "General IT support" or "standard maintenance."
  • Exclusions buried elsewhere.
  • Limitations (e.g., no mobile devices).
"If my laptop dies, what happens under this agreement?" Make them walk a real example.
02
Service Level Agreements (SLAs)
Look for
  • Defined response & resolution times.
  • Priority levels explained (P1 = outage, P2 = slow email).
  • Business hours vs. after-hours SLAs.
Watch out for
  • "Best effort" language.
  • SLAs that apply only to certain services.
  • No financial penalty for SLA breaches.
If they breach the SLA, do they refund part of the monthly? They should have skin in the game.
03
Term & Termination
Look for
  • Clear term length (e.g., 12 months).
  • Notice period (e.g., 30 days).
  • Documented exit / offboarding process.
Watch out for
  • Auto-renewals in the fine print.
  • Long lock-ins with no early exit.
  • Cancellation fees that aren't stated.
Ask for a summary of offboarding before you sign. If they squirm, that's the answer.
Clauses 01–0344
Service Agreements · 4–6Billing · Out-of-Scope · LiabilityPage 45
Clauses · 4 to 6
04
Billing & Payment Terms
Look for
  • Monthly fee spelled out.
  • What's monthly vs. billed separately.
  • Due dates, late fees, overage charges.
Watch out for
  • "Out-of-scope hourly support" with no definition.
  • "Unlimited" with contradictory fine print.
  • "Miscellaneous fees."
Ask for a one-pager in plain English. If it's not in writing, assume it's not included.
05
Out-of-Scope Work
Look for
  • Clear hourly / project rates for extras.
  • Examples of typical out-of-scope scenarios.
  • Approval process before extra work starts.
Watch out for
  • "To be determined" pricing.
  • "At provider's discretion."
  • "As needed" with no cost specifics.
This section often reveals more about real cost than the pricing page does.
06
Liability & Insurance
Look for
  • Liability limits in clear language.
  • Statement about their insurance (E&O, cyber).
  • Liability caps that match real risk.
Watch out for
  • No insurance mentioned at all.
  • "Indirect / consequential damages" excluded without clarification.
Ask for a Certificate of Insurance. A legitimate MSP shares it without hesitation.
Clauses 04–0645
Service Agreements · 7–9Data · Confidentiality · Project WorkPage 46
Clauses · 7 to 9
07
Data Ownership & Access
Look for
  • Clear statement that you own all your data.
  • Right to retrieve in readable formats.
  • Data deletion policy upon termination.
Watch out for
  • "Data in our systems remains our property."
  • Limits to your access during disputes.
  • No timeline for data return.
Ask exactly what you get back at the end — and how fast.
08
Confidentiality & Privacy
Look for
  • NDA / confidentiality covering data, credentials, comms.
  • Who has access (subcontractors, offshore).
  • Compliance with privacy laws.
Watch out for
  • Loopholes letting them share with "affiliates."
  • No subcontractor controls.
  • "May use data to improve our services."
Ask if their staff have signed NDAs. Many haven't.
09
Scope Changes & Project Work
Look for
  • Quoting & approval process for out-of-scope.
  • Clear day-to-day vs. paid project line.
  • Hourly / project rates documented.
Watch out for
  • "Any task not listed is billable at provider's discretion."
  • No approvals required before extra charges.
Ask for examples of what wouldn't be covered. Listen for confidence vs. shrugs.
Clauses 07–0946
The Pull-OutQuick-Compare WorksheetPage 47
Bonus · The Pull-Out Worksheet

Three providers. One honest call.

Print this page. Mark each provider 1–5. Consistency beats one perfect column.

Form 12-Q · Provider ComparisonSide-by-SideVol. I
The QuestionProvider AProvider BProvider C
01 · Smart questions about my business
02 · Plain-English explanations
03 · Sample agreement upfront
04 · Recent, relevant references
05 · Clear onboarding plan
06 · Audit before quoting
07 · Prevention-led, not just reactive
08 · Clear inclusions & extras
09 · Communication & support
10 · Works with my tools
11 · Has a real process
12 · Feels like a partner
Total / 60
The Pull-Out47
One Last Thing · From the Author

If you've read this far,
you're already ahead.

Most owners sign the first contract that sounds decent and hope for the best. You've now got a clear picture of what to look for — and what to avoid.

You might be expecting a sales pitch right about now. I promised at the start I wouldn't. Instead, I'm offering a free advisory call: a second opinion on a quote, a look at your setup, or clarity on whatever's been keeping you up at night.

Reach me directly
[email protected]
(845) 999-4370
meetings.intelamation.net/schedule

MCSP Badge Intelligent Automation Managed Cybersecurity · MCSP
© 2026 Intelligent Automation, LLC · All rights reserved · Vol. I · Issue 01
Designed for the small-business owner who reads the fine print.
1 · 48
Secured by IA