Your IT provider says everything is covered. You'd like to believe them, but the Cyber Essentials questionnaire asks for details you don't recognise. What should you actually ask for?
Start with a conversation about the work they do for your business. A support contract can cover some devices, some applications and certain hours. The word managed doesn't tell you which gaps remain your responsibility.
IASME's guide to working with an IT provider makes the central point clear: outsourcing the work doesn't transfer your responsibility for meeting the scheme requirements. Get information you can check before confirming the assessment answers.
Which parts of our IT do you look after?
Ask for a list of covered devices, services and locations. Compare it with your own understanding of the business, including subscriptions purchased directly by teams.
Then ask what is excluded from the contract. Perhaps the provider manages laptops but the telephone system belongs to another supplier. Perhaps a specialist application is maintained by its developer. Perhaps your provider supports the email service but doesn't administer every setting.
Give each remaining area an owner. If two suppliers both assume the other is responsible, ask them to settle the boundary in writing. Keep the explanation with the relevant contract or service record so it survives a change of contact.
The NCSC requirements include organisation-owned accounts used by support providers. Externally managed services still need controls that you can explain in your assessment answers.
What would you show us if we asked today?
Ask the provider to walk through a few current examples using the official self-assessment question set. Choose the version applicable to your assessment. As of September 2026, IASME directs purchases from 27 April 2026 to Danzell.
For a laptop, ask how they establish the installed software version and whether updates completed. For an account, ask how they establish which person uses it and what access it has. For a firewall rule, ask who can explain why it exists.
These are suggested conversation starters, not a new list of mandatory evidence files. You don't need an enormous monthly attachment to understand the answers. A short demonstration with a clear record of unresolved work may be more useful.
Keep sensitive configuration exports and account details in an agreed secure location. The aim is to understand the controls without spreading administrative information through ordinary email chains.
How do you handle the things that don't work?
Ask for a recent example of a failed update or a device that stopped reporting, with other customers' information removed. Follow the sequence from detection to completion.
Who received the warning? How did it become a support job? Who contacted the user? What happened if the laptop was switched off? What confirmed the repair had worked?
This tells you more than asking whether updates are automatic. It shows where your own staff may need to help, such as making a device available or agreeing a restart.
Ask what would prompt an urgent call to your business and who receives that call if the usual contact is absent. Decide how the provider should escalate work that needs spending approval. A delay waiting for an unanswered email can become a technical problem even when everyone intended to help.
Who can administer our systems?
Request an explanation of the provider's access to your services. Which individuals have access, how is it approved and what happens when one of their employees changes role or leaves?
Ask how they separate normal work from administration and how they protect sign-ins. The answer should describe the arrangement in your environment, rather than just list security products the provider sells.
Agree how access is removed if your contract ends. Include account ownership, documentation and the order of handover tasks. You should know how the business would regain control without relying on an informal favour from one technician.
These handover questions are practical contract planning. They aren't a claim that Cyber Essentials prescribes a particular exit document or support package.
Which decisions still need to come from us?
A provider may be able to install a replacement application but can't decide whether its reports are suitable for your finance team. It may identify an unsupported device but need you to approve the replacement cost.
Ask for an action list that separates those decisions from technical tasks. Each item should say what is needed, who decides, what it will affect and when an answer is required.
Imagine an office whose old scanner only works with a retiring computer. The provider can explain the support issue and test replacement options. Someone in the business still needs to confirm the scanning workflow and approve the purchase. Put both tasks on the list so neither disappears behind a general upgrade status.
What will we check before signing?
Arrange a final review of the actual answers and the unresolved items. Ask the provider to translate anything you can't confidently explain. Don't turn an unknown into a yes because the submission date is approaching.
IASME recommends having a contract and service-level agreement with the provider. Check that these reflect the work you expect, then agree how changes to the service will be recorded. Where an assessment interpretation remains uncertain, take the specific question to your Certification Body.
For a way to organise the wider preparation, use our Cyber Essentials self-assessment walkthrough. Bring the provider into that plan early, with enough time to fix a problem as well as describe it.