IT provider in Casablanca: the 12 questions to ask before you sign

Casablanca has hundreds of IT service companies, from the solo repair technician to the national integrator. On paper, all of them offer “maintenance, security and cloud”. For an SMB owner or a finance director, the risk is choosing on the monthly price and the salesperson’s charm, then discovering at the first serious incident what the contract does not cover. The difference shows in the answers to twelve precise questions. Ask every candidate, including us, and make sure the important answers end up in the contract.

Break-fix or managed services: two different models

Before the questions, you need to know what you are buying. Both models exist side by side in Casablanca, and the same provider sometimes offers both.

Criterion	On-demand break-fix	Managed services
Trigger	You call when something stops working	The provider monitors and steps in before the failure
Patching and security	Rarely included	Included and scheduled
Monitoring	None	Monitoring console, alerts around the clock
Backups	Sometimes installed, rarely tested	Tracked and tested regularly
Documentation	In the technician’s head	Delivered and kept up to date
Written commitment	Weak or none	Written response times, reports
Provider’s economic interest	That you have failures	That you do not

Break-fix can be enough for a very small business with no server and no critical data. As soon as the business depends on email, an ERP, the phone system or customer data, managed services become the consistent model. The other option, hiring an in-house team, should be compared on the same criteria of coverage and continuity.

Questions about day-to-day service

1. What is your contractual response time?

Not the “usual” one, the written one. A blocking incident must have a written response time, a few hours at most, and be handled first. If the answer is “we do our best”, you do not have a contract, you have a promise.

A good answer distinguishes several severity levels (total outage, degraded service, simple request), states the hours covered and says what happens if the response time is missed.

2. Do you monitor our equipment around the clock?

A serious provider sees your servers, firewall, backups and endpoints in a monitoring console and gets an alert before you call. Ask to see that console, and ask what happens when an alert comes in at night: who receives it, who decides to act. We cover the metrics worth monitoring in a separate article.

3. Who owns the administrator credentials?

You do. Every password, licence and domain name must be in your company’s name, documented in a vault you can access. A provider who keeps the keys keeps you captive. Check in particular the Microsoft 365 or Google Workspace admin account, the domain name and firewall access: these are the accesses you cannot do without on the day you change providers.

4. How do you test backups?

A backup that has never been restored does not exist. Require a regular, documented restore test with measured time. Also ask whether one copy is offline or immutable, meaning ransomware cannot encrypt it. We describe our approach in the 3-2-1 immutable backup article.

5. What happens if ransomware hits on a Saturday night?

The answer must describe a procedure: isolation, analysis, restore from an immutable copy, communication. If it starts with “that never happens to our clients”, move on. A good answer also says who alerts you, who decides to cut the network and in what order services are brought back.

6. What reports will we get, and how often?

A monthly report with incidents, response times met, backup and patch status, and recommendations. That is what lets you judge the service without being an IT specialist. Ask for an anonymised example: an empty or purely automated report says a lot.

Questions about the contract

7. Does the contract cover patching and security, or only repairs?

An “unlimited break-fix” plan with no prevention makes money when you have problems. A managed services plan makes money when you do not. Have the scope listed in writing: patches for workstations and servers, firewall updates, antivirus or EDR, account management, user support.

8. Which vendors are you partnered and certified with?

Partnerships with Fortinet, 3CX, Microsoft or Veeam guarantee vendor support access and trained engineers. A generalist reseller depends on its supplier. Ask which technologies the provider actually masters, not just the ones it can resell.

9. Who actually shows up: an engineer or a subcontractor?

Ask who your named contact will be and how many engineers the team has. A three-person company cannot guarantee 24/7 on-call. If part of the service is subcontracted, the contract must say so and state who is accountable.

10. What does leaving the contract cost?

An honest contract includes reversibility: handover of documentation, credentials and backups, without punitive fees. A reasonable commitment is twelve months. Be wary of long automatic renewals and notice periods that are hard to meet.

11. How do you bill: per device, per hour, flat fee?

A monthly flat fee per device or per user is the most predictable. Check the exclusions: projects, hardware, travel outside Casablanca. We publish our ranges in our 2026 pricing guide.

12. Can you give us three references in our industry?

Then call them. Ask for the real response time during the last serious incident, not general satisfaction.

How to read the answers

To compare several candidates, classify each answer as solid or red flag. A provider that stays at “red flag” on questions 1, 3, 4 or 10 should not be selected, whatever its price.

Question	Solid answer	Red flag
Response time	In writing, by severity level	“We do our best”
Monitoring	Console shown, alerts described	No monitoring, or only “on request”
Credentials	In the client’s name, shared vault	Kept by the provider
Backups	Documented restore tests	“They run every night”
Ransomware	Written procedure	“That never happens to our clients”
Reports	Monthly, with recommendations	None, or a raw automated export
Reversibility	Written clause, no punitive fees	Penalties, data held back

The most common mistakes when choosing

The same mistakes often come up when choosing a provider:

• Comparing prices without comparing scope. A cheaper plan that excludes patching or backups costs more at the first incident.
• Signing without an assessment. Without an initial audit, the provider quotes blind and exclusions appear after signing.
• Leaving the credentials with the outgoing provider. Changing providers is then blocked or delayed.
• Forgetting secondary sites. Branches, warehouses or plants outside Casablanca must be explicitly covered, with travel terms.
• Never reading the reports. A monthly report is only useful if it leads to decisions.

Checklist before signing

• Get response times by severity level in writing.
• See the monitoring console and a sample monthly report.
• Check that all credentials, licences and domain names are in your company’s name.
• Require a written restore test procedure and a written ransomware procedure.
• Read the reversibility clause, the commitment period and the exclusions.
• Know your contact’s name and the real size of the team.
• Call at least one reference in your industry.
• Have an initial audit done before signing.

After the twelve questions

Have an initial audit done before signing. A good provider offers one, often free, because it needs it to quote accurately. Ours is described in IT audit for SMBs: where to start, and our service is detailed on the managed IT services page. You can request the audit online: an engineer calls you back within 24 business hours.