Why it’s hard to choose

Service is visible. Security is invisible.

You see the service every day. You can’t see the security, so you end up taking it on trust.

What you see

  • Tickets raised and closed
  • A helpdesk that answers
  • Service level (SLA) reports
  • An account manager

What you don’t

How would you know if your IT provider had stopped patching?

  • Whether multi-factor sign-in (MFA) is on everywhere
  • Whether security updates (patching) are applied
  • Whether your backups would restore
  • Who has admin access to your systems

A real case

Four months without patching. Nobody noticed.

A business changed IT provider. The new team found no patching for four months, and backups that didn’t work.

Seen first hand by Assurix’s founder, on the board of a UK IT provider that took the client on.

Why it matters

They hold the keys to your business.

Nobody in your business has more access than your IT provider. Your solicitor had to meet a standard to use the title. Your IT provider didn’t. Most do a good job, but from the outside you can’t tell which.

Your IT provider has access to everything in your business: email, devices, data and accounts.
  • EmailFull admin access to every mailbox.
  • DevicesRemote control of every laptop and server.
  • DataFiles, drives, cloud storage and backups.
  • AccountsThe power to create, change and delete your users.

Three steps to a provider you can check.

  1. Search the Trustmark Directory for providers near you.

  2. Ask each one for its Trust Portal link, or for the evidence behind its answers.

  3. Compare quotes against the same standard.

Seven questions to ask any IT provider.

Pick what worries you. A good provider can show you the answer. For an Assurix Trusted MSP, Assurix checks it for you.

Ask any IT provider

“How quickly do you respond to urgent problems, and can you show me last month’s figures?”

Good answer: SLA response figures, and an escalation path.

What an Assurix Trusted MSP’s Trust Portal shows

  • Response SLA complianceLive95%
  • Resolution SLA complianceLive92%
  • EscalationControlMet

Figures from a demo provider’s Trust Portal

Ask any IT provider

“Which problems keep coming back, and what do you do about them?”

Good answer: Repeat problems, each with a root cause and an owner.

What an Assurix Trusted MSP’s Trust Portal shows

  • Repeat problemsControlMet

Figures from a demo provider’s Trust Portal

Ask any IT provider

“When something goes wrong, who owns it, and how will we hear?”

Good answer: Service reports, satisfaction scores, matching invoices.

What an Assurix Trusted MSP’s Trust Portal shows

  • Client satisfaction, last 90 daysLiveOn the portal
  • ReportingControlMet
  • BillingControlMet

Figures from a demo provider’s Trust Portal

Ask any IT provider

“What did you fix last quarter before a client noticed?”

Good answer: Problems found first, and alerts to a named person.

What an Assurix Trusted MSP’s Trust Portal shows

  • Catching problems firstControlMet
  • Monitoring and alertingControlMet

Figures from a demo provider’s Trust Portal

Ask any IT provider

“How often will you review our IT with us, and will we get a written plan?”

Good answer: Reviews on a set cycle, and a written roadmap.

What an Assurix Trusted MSP’s Trust Portal shows

  • Linking technology to your goalsControlMet
  • Quarterly reviewsControlMet

Figures from a demo provider’s Trust Portal

Ask any IT provider

“How many critical security updates do you apply on time, and when did you last test a restore?”

Good answer: On-time critical patching and recorded restore tests.

What an Assurix Trusted MSP’s Trust Portal shows

  • Critical patchingLive100%
  • Finding and fixing weaknessesControlMet
  • BackupsControlMet

Figures from a demo provider’s Trust Portal

Ask any IT provider

“Who at your company can get into our systems, and how is that removed when someone leaves?”

Good answer: MFA, named admins, access removed the day staff leave.

What an Assurix Trusted MSP’s Trust Portal shows

  • Administrator accountsControlMet
  • The provider's own management toolsControlMet

Figures from a demo provider’s Trust Portal

Live: measured from the provider’s connected tools every six hours. Control: reviewed by Assurix on a set cycle.

See it for yourself

Every Assurix Trusted MSP has a live Trust Portal. Ask any provider for theirs.

  • Today’s status. Where the provider stands now.
  • They can’t change a single result. The results come from Assurix.
  • 40/40 cyber security. 19/19 service. The 40 are aligned to the NCSC Cyber Assessment Framework. The 19 cover quick responses, problems fixed for good and no surprise bills. All 59 must pass.
Open a demo provider’s live results

From our demo environment. Not a real provider.

What each status means in the Trustmark Directory

  • Assurix Trusted MSP

    Independently assessed by Assurix on 59 controls across security and service. It passes all of them, with live evidence from its own tools. A failure left unfixed for 30 days suspends the Trustmark publicly.

  • On the Journey

    This provider is on the journey to becoming an Assurix Trusted MSP. It has connected its tools, and Assurix is collecting evidence against the 59 controls. It doesn’t hold the Trustmark yet. Worth asking what’s left to complete and when they expect to finish.

  • Committed

    Signed up to work towards the Assurix Trustmark, with a start date booked. It doesn’t hold the Trustmark yet. Ask when they expect to earn it and what they can show you today.

  • Not yet verified

    Listed, but Assurix hasn’t assessed it. Ask what evidence it can show you. It doesn’t mean they do a poor job.

Check it yourself

Anyone can put a badge on a website. Check ours.

A certificate is a good start. It shows a check passed on one date, so ask what has been checked since.

A certificate proves a date. Assurix proves today.

Check a certificate

  • Cyber EssentialsSearch by company name. It shows certificates issued in the last 12 months.IASME certificate search
  • ISO 27001Check certificates from UKAS-accredited bodies on UKAS CertCheck.UKAS CertCheck

Check an Assurix Trustmark

What the NCSC tells businesses to check.

The National Cyber Security Centre’s guide lists what to check before you choose an IT provider. Here is what the Assurix Trustmark already covers, and what to ask yourself.

CheckWhat the NCSC saysWhat the Assurix Trustmark covers
PatchingSoftware patched within 14 days of an update being released.Checked by AssurixAssurix measures patching live from the provider’s own tools.
BackupsWhat is backed up, how often, where it is stored, and how often restores are tested.Partly checkedAssurix checks the provider can restore its own backups. Ask how yours are tested.
Access2-step verification, admin accounts only for people who need them, and how the provider connects into your systems.Checked by AssurixAssurix checks sign-in, admin accounts and the tools that reach into your systems.
ContractWhat is included, how incidents are reported, response times, and what happens if you leave.Partly checkedAssurix checks service commitments are in the contract and that leaving is handled properly. Read the terms yourself.
ReferencesReferences, testimonials or case studies from other small businesses.Ask the providerNot part of the Trustmark. Ask for references from businesses like yours.

Source: NCSC, Choosing a managed service provider (MSP).

Questions from businesses

How do I check my IT provider is secure?

Ask for their Trust Portal link, or search for them in the Trustmark Directory, which shows whether they hold the Assurix Trustmark and their current status. If they aren’t assessed, ask the questions in the NCSC’s guide to choosing a managed service provider and check any certificate they claim on the IASME or UKAS search.

What should I ask an IT provider about security?

Ask how quickly they apply critical security updates, whether backups are restore-tested, who has admin access to your systems, whether multi-factor sign-in is on everywhere, and what the contract says about incidents and leaving. These are the points in the NCSC’s guide to choosing a managed service provider. Ask to see the evidence.

Does it cost anything?

No. Searching the Trustmark Directory and viewing a provider’s results is free.

Do you replace my IT provider?

No. Assurix isn’t an IT provider. We independently check IT providers so you can make an informed choice about who looks after your technology.

Is this the same as Cyber Essentials or ISO 27001?

No. A certificate is a good start, and the NCSC recommends providers with recognised certifications such as Cyber Essentials Plus. A certificate is assessed at a point in time. Assurix checks continuously, using evidence from the provider’s own tools, and covers how they run their service as well as security.

Our insurer or a big customer asked how we vetted our IT provider. What can we send?

Your provider’s Trust Portal link. It answers supplier questionnaires with evidence, not a promise.

Will an Assurix Trusted MSP cost more?

Prices vary. Ask every provider you’re comparing what evidence they can show you, then compare quotes against the same standard.

Who pays Assurix, and can a provider influence its result?

IT providers pay Assurix a subscription, and none of them can change a result. An Assurix assessor signs off every Trustmark. A failed control left unfixed for 30 days suspends the provider’s Trustmark publicly in the Trustmark Directory.

Who’s behind Assurix?

Assurix was founded by Mit Patel, who spent two decades building Netstar, a UK IT provider, to around 60 staff before selling it in 2021. He knows what an IT provider can show a client, and what it usually doesn’t.

Check, so you don’t switch again in a year.

Choose a provider whose security you can see, not just its service. Then check it again any day you like.

A 22-user pharma company, let down by its last IT provider, had three others lined up. It chose Little Big Tech, an Assurix Trusted MSP, and signed the day after one meeting.Read the story

Choosing a new provider?

Search by location or sector, then check each provider’s status.

Search the Trustmark DirectoryNot sure where to start? Get matched in three questions

Already have an IT provider?

Ask them for their Assurix Trust Portal link. If they don’t have one, ask what evidence they can show you instead.

Look up your provider

Are you an MSP? See how to earn the Assurix Trustmark