IT Supplier Due Diligence Checklist for UK Businesses

Why IT Supplier Due Diligence Matters

IT supplier due diligence is the process of checking whether a provider is suitable, capable and commercially aligned before you rely on them to support your organisation.

It helps answer important questions such as:

• Can this supplier support our users and systems properly?
• Do they understand our business risks?
• Are their responsibilities clearly documented?
• Do they have a structured approach to security?
• Will their service scale as we grow?
• Are there hidden gaps in the contract?
• How will performance be reviewed?

Without a proper review, businesses can end up choosing a supplier based only on price, personality or speed of response during the sales process. That can lead to unclear service scope, weak accountability, poor reporting and avoidable disruption later.

Good due diligence reduces that risk.

1. Business Fit and Supplier Understanding

The first step is to check whether the supplier understands your business, not just your technology.

A good IT supplier should ask about your users, locations, systems, working patterns, existing pain points, security concerns and future plans. They should not jump straight into selling a package before understanding what your organisation actually needs.

Useful questions to ask include:

• What types of businesses do you usually support?
• Do you understand our sector and operating model?
• How do you assess our current IT environment?
• What information do you need before recommending a service?
• How do you identify business-critical systems and users?
• How do you handle organisations with limited internal IT resource?

A supplier that understands your business properly is more likely to recommend the right support model, rather than forcing your organisation into a generic package.

2. Service Scope and Operational Fit

Before choosing an IT supplier, you need to understand exactly what is included in the service.

This is where many supplier relationships become unclear. A business may assume support, monitoring, patching, backup checks or Microsoft 365 administration are included, only to find later that they are excluded, chargeable or handled reactively.

Review whether the supplier can support:

• user support and help desk requests
• device management
• Microsoft 365 and cloud platforms
• patching and updates
• backup monitoring
• cyber security oversight
• remote and hybrid working
• onboarding and offboarding users
• escalation routes
• regular service reviews
• reporting and recommendations

If your organisation needs ongoing support rather than occasional reactive fixes, review whether the supplier offers structured Managed IT Services that include monitoring, help desk support, patching, security oversight and long-term technology planning.

3. Technical Capability and Coverage

A supplier may be strong in one area but weak in another. Due diligence should check whether they have enough technical depth to support your environment properly.

Look at the systems and services you currently rely on. These may include:

• Microsoft 365
• Azure or cloud platforms
• endpoint protection
• backup and recovery tools
• networking
• firewalls
• servers
• laptops and desktops
• line-of-business applications
• VoIP systems
• remote access
• mobile device management

Ask the supplier which areas they support directly and where they rely on third parties. There is nothing wrong with a supplier using specialist partners, but responsibilities should be clear.

You should also ask how they document your environment. A supplier that does not maintain accurate documentation may struggle to support you consistently, especially when staff change or urgent issues occur.

4. Cyber Security and Risk Management

Cyber security should be part of supplier due diligence, not an afterthought.

Any IT supplier supporting your systems may have access to sensitive accounts, user data, infrastructure, cloud platforms or admin controls. That means their own processes and security maturity matter.

Ask questions such as:

• How do you protect administrative access?
• Do you use multi-factor authentication for support accounts?
• How are passwords and credentials stored?
• How do you manage privileged access?
• How do you support patch management?
• How do you monitor endpoint security?
• How do you respond to suspected security incidents?
• How do you help customers reduce cyber risk over time?

You should also ask whether the supplier can help with practical security improvements, such as user awareness, backup checks, endpoint protection, email security, vulnerability reduction and policy guidance.

A supplier does not need to overcomplicate cyber security, but they should be able to explain how they reduce risk in a clear and practical way.

5. Supplier Risk and Long-Term Fit

A supplier may be suitable today but not suitable in two years. Due diligence should therefore consider long-term fit.

Think about whether the provider can scale with your organisation. If you add more users, sites, systems or security requirements, will the supplier still be able to support you?

Key areas to review include:

• account management structure
• escalation process
• service review rhythm
• reporting quality
• strategic planning support
• cyber security maturity
• documentation standards
• response expectations
• supplier dependencies
• ability to support growth

If you want to compare providers more strategically, it can help to assess whether each supplier behaves like a risk-led IT support provider rather than simply a reactive help desk.

A risk-led provider should help you identify recurring issues, reduce weak points, improve visibility and plan technology decisions around business impact.

6. Contract, SLA and Commercial Review

Contracts are one of the most important parts of IT supplier due diligence.

A supplier may appear helpful during the sales process, but the contract defines what they are actually responsible for. Review the service agreement carefully before signing or renewing.

Check for:

• contract length
• notice period
• included services
• excluded services
• response targets
• escalation process
• support hours
• out-of-hours arrangements
• project work charges
• onboarding fees
• backup responsibilities
• cyber security responsibilities
• reporting commitments
• review meetings
• renewal terms
• termination process

Before agreeing to a service, use an IT support contract checklist to review scope, SLAs, exclusions, responsibilities and renewal terms properly.

The goal is not to create unnecessary delay. The goal is to avoid surprises after the agreement starts.

7. Reporting, Reviews and Accountability

A strong IT supplier should be able to show what is happening across your environment.

Without reporting, it can be difficult to know whether issues are being reduced, whether recurring problems are being addressed or whether the provider is only reacting to tickets.

Useful reporting areas include:

• ticket volumes
• recurring issues
• response times
• resolution times
• patching status
• backup status
• endpoint protection status
• security alerts
• device lifecycle risks
• upcoming renewals
• user trends
• service improvement recommendations

Ask how often service reviews take place and who attends them. A review should not simply be a sales meeting. It should help your business understand current risks, upcoming priorities and where the support model needs improvement.

8. Onboarding and Transition Planning

Moving to a new IT supplier can feel risky if the handover is poorly planned.

Good due diligence should include a clear discussion about onboarding. Ask how the supplier takes over support, what information they need, how they document systems and how they communicate the change to users.

A structured onboarding process may include:

• discovery of users, devices and systems
• admin access review
• documentation collection
• backup and security review
• supplier handover
• support contact setup
• user communication
• priority risk review
• first service review date

A supplier should be able to explain what happens in the first 30, 60 and 90 days. If they cannot explain the transition clearly, the handover may become harder than expected.

9. Commercial Value, Not Just Price

Price matters, but it should not be the only factor.

The cheapest IT supplier is not always the lowest-risk option. A lower monthly fee may exclude important services, provide limited visibility or rely on reactive support. Over time, recurring issues and downtime can become more expensive than a properly managed service.

When comparing suppliers, look at:

• what is included
• what is excluded
• how support is delivered
• how proactive the service is
• what reporting is provided
• how cyber security is handled
• how responsibilities are documented
• how the supplier supports growth
• how easily users can get help

A good supplier should be able to explain value clearly without hiding behind jargon or vague promises.

10. Final IT Supplier Due Diligence Checklist

Use this checklist before choosing, renewing or replacing an IT supplier.

Business fit

• Do they understand your organisation?
• Have they reviewed your users, systems and locations?
• Do they understand your main operational risks?
• Can they support your future growth?

Service scope

• Are included services clearly documented?
• Are exclusions clearly explained?
• Are support hours defined?
• Are escalation routes clear?
• Is proactive monitoring included?

Technical capability

• Can they support your core systems?
• Do they understand Microsoft 365 and cloud platforms?
• Can they support devices, networks and security tools?
• Do they maintain documentation?

Cyber security

• Do they protect admin access properly?
• Do they support MFA and privileged access control?
• Do they help with patching and endpoint protection?
• Can they support incident response planning?

Contract and SLA

• Are response expectations clear?
• Are renewal terms understood?
• Are project charges explained?
• Are backup and security responsibilities documented?
• Is there a clear termination process?

Reporting and reviews

• Do they provide regular reporting?
• Are recurring issues reviewed?
• Are risks and recommendations discussed?
• Are service reviews scheduled?

Onboarding

• Is there a clear transition plan?
• Are users told how to get support?
• Is documentation collected early?
• Are urgent risks reviewed during onboarding?