Most South African small businesses hand their IT to an outside provider: a one-person consultant, a local IT company or a managed service provider. That's usually a sensible decision. But many owners assume "IT is handled" means "security is handled", and the two aren't always the same thing.

Your IT provider may be excellent at keeping printers working and setting up laptops, while security quietly falls between the cracks. And under POPIA, the responsibility for protecting personal information stays with you, even when someone else runs your systems.

These ten questions will tell you a lot about where you stand. You don't need to understand the technical detail of every answer. What matters is whether the answers are clear, specific and backed by evidence.

1. Who has admin access to our systems, and how is it protected?

A good answer: a short, named list of people with admin rights, separate admin accounts, and multi-factor authentication (MFA) on every one of them.

Red flags: "We all use the same admin login." "The password is in a spreadsheet." Admin accounts without MFA. Former staff or previous IT providers who still have access.

2. How and when are security updates installed?

A good answer: updates for Windows, macOS, Microsoft 365 and key software are applied on a regular schedule, critical ones within days, and they can show you a report of which machines are up to date.

Red flags: "We do updates when we're on site." "That server is too old to update." No way of showing you the current status.

3. What backups do we have, and when did you last test a restore?

A good answer: important data is backed up automatically, at least one copy is offline or separate from your network so ransomware can't reach it, and a restore was tested recently, with a date to prove it.

Red flags: "It's all in the cloud, so it's backed up." "We back up to a drive that's always plugged in." Nobody can remember the last restore test.

4. If we're hit by ransomware tomorrow, what happens?

A good answer: a clear plan: who you call, how quickly they respond, how affected machines are isolated, how data is restored, and roughly how long it would take. Ideally, it's written down.

Red flags: "That won't happen to you." A plan that only exists in one person's head. No idea of response times or costs.

5. How would we know if something bad was happening?

This is the question many providers struggle with.

A good answer: your devices and accounts are monitored for suspicious activity, someone looks at alerts, including after hours, and you'd be told quickly in plain language.

Red flags: "The antivirus would pick it up." "We'd notice if things stopped working." Alerts that go to an inbox nobody reads.

6. What remote access tools do you use, and how are they secured?

IT providers use remote management tools to look after your machines without visiting. Attackers have targeted these tools, because breaking into one can give access to every client at once.

A good answer: they can name the tool, explain that access requires MFA, and tell you how access is logged and limited.

Red flags: shared logins for remote tools, no MFA, or several different remote tools installed "from before".

7. Do we have a written agreement that covers POPIA?

Under POPIA, an IT provider that processes personal information on your behalf is an operator. Section 21 requires a written contract obliging them to keep that information secure and to notify you immediately if they suspect a breach.

A good answer: yes, and they can show you the clause.

Red flags: no written agreement at all, or one that says nothing about security or breach notification.

8. Where is our data stored, and who on your side can see it?

A good answer: they know where your data lives (on-site servers, Microsoft 365, specific cloud services and backup locations) and can tell you which of their staff can access it, and why.

Red flags: vague answers, or "everyone in our team has access to everything".

9. If we stopped working together, what would we get back?

It's an uncomfortable question, but an important one.

A good answer: full admin access, documentation of your systems, a list of accounts and licences, and a clean handover, written into the agreement.

Red flags: "We'll sort that out when the time comes." Passwords or licences registered in the provider's name rather than yours.

10. What security reporting do we get, and how often?

A good answer: a regular report, monthly or quarterly, showing update status, backup results, security alerts and what was done about them. Something you could show your insurer, an auditor or the Information Regulator.

Red flags: no reports at all, or reports that only list support tickets closed.

How to use the answers

Don't treat this as an exam to catch your provider out. Most providers will welcome a business owner who takes security seriously, and some gaps simply mean that nobody asked for the work, or budgeted for it.

Score each answer roughly:

  • Clear and backed by evidence: you're in good shape on that point.
  • Clear, but no evidence: ask to see it, such as the report, the restore log or the contract clause.
  • Vague or "don't worry about it": that's a gap to fix, together.

If several answers fall into the last group, especially questions 3, 5 and 7, it's time for a serious conversation, and possibly a second opinion.

Trust, but verify

Even with a great IT provider, it helps to have your own view of what's happening on your devices, rather than relying entirely on someone else's word.

EZ Cyber Guard gives you exactly that: continuous monitoring of your laptops, desktops and servers, plain-language alerts, vulnerability tracking and regular reports. It works alongside your IT provider, not instead of them. You can invite them to your account so you both see the same alerts. To see where your business stands, take the free POPIA Security Readiness Check, or read our guide to what POPIA requires for IT security.