09/01/2026
Managed IT has almost no barriers to entry. From the outside, a three-person shop and a 40-person team with specialists, an on-call schedule, documented procedures, and a third-party audit can look like the same company.
The difference shows up the moment you ask for evidence.
Multifactor enforcement. Patch compliance. Asset inventory. A provider actually doing this work can export the proof in minutes, because the tools generate it on their own. If the proof takes weeks or never arrives, it is reasonable to assume the work is not happening.
The same test applies to internal IT. Whoever owns technology should be able to put a report in front of leadership on a regular basis showing these controls are in place, tested, and still being discussed.
Before you sign anything, ask for the last report they gave a client.