An IT service provider should not be judged by its sales brochure. The most reliable way to assess one is to review the contract from a technical perspective, verify the actual scope of its certifications, and determine whether the provider can document its security commitments in light of the client’s regulatory obligations.
Certification scope: what an IT service provider’s certificate actually covers
An ISO 27001 certification or SecNumCloud qualification displayed by a hosting provider says nothing about the managed services provider that administers the system day to day. Each certificate covers a specific scope: entities, sites and services. If the provider outsources hosting to a certified third party but handles administration itself, the third party’s certification does not extend to the provider’s own practices.
Before signing, ask for the original certificate and review its scope annex. Check that the services listed in the quote match those covered by the certificate. A reputable provider will supply this information without hesitation.
Providers such as ProInfo Services build their offering around this transparency, detailing the technical components covered by their own qualifications and those of their hosting partners.
Questions to ask about certifications
- Which sites and services are included in the audited scope of your certification?
- Is hosting operated in-house or outsourced? If outsourced, is the subcontractor certified for the same scope?
- How often is the renewal audit conducted, and can we review the latest report?
NIS2 and GDPR obligations: outsourcing does not transfer responsibility
Outsourcing IT does not shift the client’s legal responsibility. Under the GDPR, the company remains responsible for processing personal data, even when the service provider handles it technically. In the event of a breach, it is the client that must notify the CNIL within the required timeframe.
The data processing agreement must therefore set out the notification chain. The provider must agree to notify the client of any breach within a specified timeframe and provide enough detail for the client to meet its own notification obligations.
How the NIS2 Directive affects your choice of provider
An IT service provider may be indirectly affected by NIS2. If the client company is subject to the directive, it must obtain assurances from its suppliers regarding the management of administrative access, activity logging, vulnerability management and incident reporting.
In practice, ask the prospective provider about three things: its policy for logging privileged access, its vulnerability management process (scan frequency and remediation timelines), and its incident notification process. A provider unable to answer these questions is not ready to support a company subject to sector-specific cybersecurity requirements.
SLAs and service commitments: look beyond the uptime percentage in your managed services contract
The stated uptime percentage tells you very little unless it is accompanied by three details: the calculation method, exclusions and actual penalties.
- Calculation method: Is scheduled maintenance excluded from the calculation? If so, a provider could report a high uptime percentage while scheduling frequent downtime windows.
- Exclusions: Are incidents involving a third-party supplier (telecom operator, software vendor) counted under the SLA or excluded?
- Penalties: a credit of a few percent on the monthly invoice does not make up for lost business. Check whether the contract provides for compensation proportionate to the actual impact.
- GTI (guaranteed response time) and GTR (guaranteed recovery time): these are separate metrics. The first measures how long it takes a technician to take ownership of a ticket; the second measures how long it takes to resolve the issue. A short GTI paired with a vague GTR has no operational value.
We find that the strongest contracts clearly distinguish between severity levels (P1 to P4), with different GTIs and GTRs for each level and escalating penalties.
Reversibility and technical dependency: plan your exit from the outset
The reversibility clause determines your freedom to change providers. A managed services contract without a detailed exit plan creates technical dependency that can prove costly if the relationship ends.
Reversibility covers three areas. First, data must be returned in a usable format—not a proprietary export that only the outgoing provider can read. Second, it covers technical documentation: network diagrams, configuration inventories and operating procedures. Third, it covers the transition period, during which the outgoing provider cooperates with the new provider to ensure continuity of service.
What to look out for in a reversibility clause
Check that the contract specifies the data return format, the maximum transfer period and any fees for the reversibility service. Some providers charge for reversibility based on time spent, with no cap, which can become a source of leverage in the event of a dispute.
A reliable IT service provider includes reversibility as a standard contractual commitment, not as an option to negotiate at the end of discussions. Negotiate the exit plan before signing, while both parties still have equal bargaining power.
Choosing an IT service provider to support a company day to day depends less on the promises in its marketing materials than on a careful review of the contract, a thorough check of certification scope and the provider’s ability to meet the client’s regulatory requirements. A good provider documents its commitments, is transparent about its limitations and plans for an orderly exit from day one.
