Your IT contract probably doesn’t say who looks after security. Ask before you need to know.

Ask the owner of almost any business who looks after their cyber security and you’ll hear the same answer: “Our IT company does that.” Then ask the IT company. Quite often the answer is a pause, followed by something about antivirus. The gap between those two answers is one of the most common problems I come across, and it’s rarely anyone’s fault. Nobody ever sat down and agreed who is responsible for cyber security, so each side quietly assumed it was the other.

What an IT contract usually covers

Most IT support agreements are built around keeping things running. A help desk with response times. New starters set up and leavers removed, when someone remembers to tell them. Microsoft 365 or Google Workspace licences. Updates, backups and antivirus, described in a line or two. A monthly fee per person.

That’s a perfectly good service, and a decent IT provider does a great deal for security just by doing those jobs well. But read the agreement and look for the sentences that describe security outcomes. Who checks that every account has multi-factor authentication switched on, and how often? Who reads the sign-in alerts? Who tests that a backup can be restored? Who decides that the ten-year-old server has to go? Who leads if there’s a cyber incident at 6pm on a Friday, and is that included or billed by the hour?

In a lot of contracts those sentences aren’t there. The work may still get done by a conscientious engineer. But if it isn’t written down, it isn’t anyone’s job, and things that are nobody’s job have a habit of being done last.

Support and security pull in different directions

This is the part that’s easy to miss from the outside. A help desk is measured on speed and on keeping people happy. Tickets closed, phones answered, the director’s laptop fixed before the meeting.

Security is often the opposite of that. It means saying “no, you can’t have admin rights”. It means making people enrol in multi-factor authentication when they’d rather not. It means telling a customer that the machine running the old accounts package needs replacing, which is an awkward conversation with someone who pays your invoice.

A provider can do both well, and many do. But it takes a deliberate effort, time set aside, and usually a different line on the contract. Where the fee only covers support, support is what you get, and the security work gets fitted in around it.

You can hand over the work. You can’t hand over the responsibility, and the law, your customers and your insurer all agree on that.

Ashley Adkins, fromIT

The responsibility stays with you

Suppose the worst happens and customer data is stolen through a weakness in a system your IT company manages. Under UK data protection law your business is still the controller of that data. The Information Commissioner’s Office will be writing to you. Your customers will be ringing you. Your insurer will be looking at the answers you gave on the proposal form, and “we thought the IT company did that” isn’t one of the options.

You may well have a claim against the provider afterwards, depending on the contract. That’s a slow and uncertain route, and it does nothing for you in the week you can’t trade.

The direction of travel is towards more accountability for providers too. The Cyber Security and Resilience Bill, which is working its way through Parliament, is set to bring medium and large managed service providers under regulation for the first time, with security duties and incident reporting. I think that’s overdue. But it won’t cover every provider, and it won’t write your contract for you.

Your provider is also a way in

There’s a second reason to have this conversation. Your IT company holds the keys: admin accounts for your email, remote access to every laptop, and usually the same tools across all their other customers. That makes them very attractive to criminals.

We’ve seen what that looks like at scale. In 2021 attackers used a flaw in Kaseya’s remote management software to push ransomware through IT providers and into up to 1,500 of their customers in one go. Last year’s attack on M&S reportedly began with someone talking their way past an outside service desk. And earlier this month Asos confirmed a breach that started with someone impersonating a trusted contact.

None of that is a reason to distrust your provider. It’s a reason to ask how their access to your systems is protected, because their weak spot is your weak spot.

The conversation to have this month

I’d ask for an hour with whoever manages your account, and I’d go through a short list. For each item you want a name, a frequency, and whether it’s included in what you pay.

1. Sign-in security. Who makes sure multi-factor authentication is on for every account, including shared mailboxes and admin accounts? If you want to see where you stand first, here’s my guide to turning it on.
2. Updates. Who installs them on laptops, servers, the firewall and the Wi-Fi, and who tells you when a device can no longer get them?
3. Backups. Who checks they ran, who tests a restore, and when was the last one?
4. Watching for trouble. Does anybody look at security alerts, and what happens to an alert at the weekend?
5. Admin access. Which of the provider’s people can get into your systems, and how are those accounts protected?
6. A bad day. If you have a cyber incident, what do they do in the first hour, what’s outside their scope, and who would you call for the rest?
7. Bad news travelling. If they have an incident themselves, how quickly would you hear?

Write the answers on one page. Three columns will do: the job, who does it, how you’d know it was done. Where the middle column is blank, you’ve found the gap, and you can decide whether to pay your provider to fill it, do it in-house, or bring in someone else.

What a good answer sounds like

A good IT provider will be pleased you asked. In my experience the decent ones have wanted this conversation for years and couldn’t find a way to start it without sounding as if they were selling something. They’ll tell you plainly what’s covered and what isn’t. Some will say “we don’t do incident response, you’d need a specialist”, and that’s a perfectly respectable answer. It’s far better to hear it now.

What I’d worry about is vagueness. “It’s all taken care of” isn’t an answer. Neither is a list of product names. If you ask who tests the backups and nobody can give you a date, you’ve learned something useful for the price of a slightly awkward meeting.

Security in a business needs an owner, and that owner is you, even when other people do nearly all of the work. Your job is to know who’s doing what and to see some evidence now and then. An hour and one sheet of paper gets you most of the way there. And if the answer to the bad day question turns out to be “we’re not sure”, that’s the gap fromIT fills.