Short answer: Before signing with any Miami IT provider, ask whether they guarantee response times in writing, whether they understand your industry’s compliance rules (HIPAA, FTC Safeguards, or Florida Bar requirements), whether backups are immutable and tested, and exactly what is—and isn’t—included in the contract. The 21 questions below cover all of it, grouped so you can work through them in a single vendor call.
Most business owners evaluate IT companies on two things: monthly price and a vague promise of “fast support.” Both are misleading. There is no standard pricing in this industry, and “fast” means nothing without a written guarantee behind it. For a Miami clinic, CPA firm, or law office handling regulated data, the wrong choice isn’t just frustrating—it can mean a compliance violation, a denied insurance claim, or a breach you have to report to regulators.
The fix is to stop asking “what do you charge?” and start asking “what will I actually get?” Here are the 21 questions we recommend you ask any provider you’re evaluating—including us.
Customer service: will you actually be able to reach them?
1. How do you request support? You should be able to reach a live person by phone, email, or a client portal—without being forced to file an online ticket first. If your internet is down, a ticket form is useless.
2. Do they guarantee response times in writing? A real Service Level Agreement (SLA) commits to specific response windows—for example, one hour for critical issues—and reports on performance so you can hold the provider accountable. “We’ll get to it as soon as we can” is not an SLA.
3. Do they explain things in plain language? Good technicians teach rather than talk down. If you feel uninformed for asking a question during the sales process, it won’t improve after you sign.
4. Do they build an IT roadmap and meet with you regularly? Strong providers hold quarterly reviews covering security, compliance status, projects, and budget—not just reactive ticket-fixing.
5. Do they bill clearly? Invoices should explain every service and charge. Surprise line items are a warning sign.
6. Do they carry adequate insurance? Look for both cyber liability and errors & omissions (E&O) coverage, and ask for proof. A provider with access to your systems should be insured against mistakes that affect you.
7. Do you get a dedicated account manager? A named point of contact who owns your roadmap and reviews beats hunting for whoever picks up the phone.
Cybersecurity and compliance: do they understand your industry?
This is where generalist IT companies fall short—and where the financial stakes are highest. The questions below separate providers who understand regulated industries from those who don’t.
8. Does their security meet the rules that apply to you? CPA firms and many medical billing operations fall under the FTC Safeguards Rule. According to compliance guidance for CPA firms, penalties can reach $100,000 per violation, plus $43,000 per day for ongoing violations. Your provider’s security baseline should be built to meet FTC Safeguards, HIPAA, and cyber insurance requirements—not retrofitted later.
9. Do they provide regular security and compliance reports? Expect a recurring report showing patches, updates, compliance status, and outstanding risks—reassessed every quarter, not once at signup.
10. Do they give you written network documentation? You should receive complete documentation: hardware inventory, software licenses, securely stored credentials, and network diagrams. Without it, you’re held hostage if you ever want to change providers.
11. Do they understand your industry’s regulations specifically? HIPAA for clinics, FTC Safeguards and IRS Publication 4557 for CPA firms, and Florida Bar Rule 4-1.6(e) for law offices all impose different obligations. A provider should be able to speak to the one that governs you in detail. (We cover these on our health clinics, CPA firms, and law offices pages.)
12. Will they review your cyber insurance application? Many businesses unknowingly fail to meet the security requirements they attested to on their policy—which can mean a denied claim after a breach. A good provider checks for those gaps before they bite you.
Backups and disaster recovery: could you actually recover?
13. Are your backups immutable? Immutable backups cannot be encrypted or corrupted by ransomware. Many cyber insurers now require them before they’ll cover a ransomware event. This should be non-negotiable.
14. Do they perform regular test restores? A backup you’ve never restored is a guess, not a safeguard. Look for routine “fire drill” test restores—monthly is a good standard.
15. Do they back up before every project or upgrade? A current backup should exist before any significant change to your environment. This should be standard procedure, not something you have to request.
16. Is there a written disaster recovery plan? You should have a documented plan for how your network and data would be restored after a fire, ransomware attack, or other disaster—reviewed at least annually.
Technical expertise and service: who’s actually doing the work?
17. Is the help desk U.S.-based? For HIPAA-covered clinics especially, where your support is staffed matters for both service quality and data security. Ask directly whether support is handled in-house or outsourced overseas.
18. Do their technicians hold current certifications? The security and compliance tools that protect you change constantly. Ask whether engineers maintain current certifications in the tools they support.
19. Do they conduct themselves professionally? The people who show up at your office or join your calls represent your provider. Polite, communication-trained technicians are a reasonable expectation, not a luxury.
20. Are they familiar with your line-of-business applications? For clinics, that means EHR and medical billing systems. For CPA firms, that means tax software like Drake, Lacerte, CCH Axcess, UltraTax, and QuickBooks. A provider should own issues with these applications, not shrug them off as “the vendor’s problem.”
21. When something breaks with your internet, phones, or printers, do they own the problem? You should make one call. A good provider coordinates with your ISP, phone carrier, and other vendors so you’re never stuck playing middleman.
The bottom line for Miami business owners
The cheapest proposal is rarely the cheapest provider. The true cost shows up in what’s left out—inadequate security, carve-outs for after-hours support, no immutable backups, or a compliance gap that surfaces during an audit or insurance claim. Use these 21 questions to compare what’s actually included, line by line, before you sign anything.
If you’d like a second opinion on your current setup—or on a proposal you’re weighing—we offer a free IT & compliance assessment for Miami clinics, CPA firms, law offices, and non-profits. Book your free assessment or call (305) 629-5925.
Sources: FTC Safeguards Rule penalty figures via VC3, “Guide to the FTC Safeguards Rule for CPA Firms.” Industry pricing and contract guidance adapted from ITva Technologies’ Miami Business Owner’s Guide to I.T. Support Services and Fees.
