IT provider in Rabat: the criteria for choosing the right one

The short answer: a good IT provider in Rabat is judged by what they put in writing, not by where their office is. Require written response times, both remote and on site, 24/7 monitoring of your systems, backups whose restores are tested, ownership of all your credentials and a reversibility clause. Then check their security and compliance skills, and have an initial audit carried out before you sign.

This guide sets out the criteria we recommend applying, including to us. An important point: ALLSAFE SOLUTIONS does not have an office in Rabat. Our team is based in Casablanca, and we support Rabat organisations remotely and on site. That is precisely why we wanted to spell out what to check, wherever the provider is located.

What characterises IT needs in Rabat

Rabat is home to head offices, law and consulting firms, professional associations, schools and healthcare providers, as well as many companies working with the public sector. These organisations share several expectations:

• Confidentiality of files, personal data and communications.
• Traceability: knowing who accesses what, and being able to prove it.
• Service continuity, especially for email, telephony and business applications.
• Clean documentation: inventory, network diagrams, procedures, accounts and access rights.
• Clear commitments, often required by a finance director or a board.

An IT provider suited to Rabat must therefore do more than fix things. They must secure, document and report.

A provider based in Rabat or a team based in Casablanca?

This is often the first question. Both options can work; it all depends on what the contract says.

Criterion	Provider based in Rabat	Team based in Casablanca
Day-to-day remote support	Same: phone, email, portal, remote control	Same
Monitoring of servers, firewalls and backups	Depends on tooling, not on the city	Depends on tooling, not on the city
Unplanned on-site visit	Short trip	Trip to be scheduled, framed by the contract
Projects (installation, cabling, migration)	Scheduled	Scheduled, with the same quality if the team is well organised
Team size and depth	Varies: from a freelance technician to a national integrator	Varies as well
What to check first	Ability to deliver 24/7 monitoring and security	Written conditions for on-site visits in Rabat

Proximity matters mostly for hardware: a computer that will not boot, a switch to replace, a cable to redo. For everything else, the quality of the organisation and its tools weighs more than distance. Our advice: choose on written commitments, then check how the provider actually handles site visits.

8 criteria for choosing an IT provider in Rabat

1. Written response times, remote and on site

Ask for a severity table: total outage, degraded service, simple request. For each level, the contract should state the response time, the hours covered and how the issue is handled. For Rabat, add a specific line: when an on-site visit is triggered, how quickly, and whether it is included or billed separately. We cover these clauses in managed IT contract: the key SLA clauses.

2. Genuine 24/7 monitoring

A serious provider sees your servers, firewall, backups and endpoints in a console, and gets alerts before your users complain. Ask for a demo of that console, and ask who receives an alert at night or at the weekend. The indicators worth tracking are set out in IT monitoring: the KPIs to track.

3. Security built into the contract, not sold as an extra

For a Rabat organisation handling sensitive files, baseline security must be part of the service: MFA on accounts, EDR on endpoints, a properly configured and updated firewall, patching, separate admin accounts. Have these listed in black and white. Our business cybersecurity offering describes this baseline.

4. Compliance know-how: law 09-08 and, if relevant, law 05-20

Any organisation processing personal data in Morocco is subject to law 09-08, overseen by the CNDP. Your provider should be able to document access, secure backups and help you keep your records; see Moroccan data protection law 09-08.

If your organisation falls under cybersecurity law 05-20 (government administrations, local authorities, public establishments and companies, critical infrastructure), the provider must also know the DGSSI directives and implementing decree 2-21-406. We summarise these obligations in Morocco cybersecurity law 05-20 and the DGSSI.

5. Verifiable vendor partnerships

A provider partnered with the vendors they install has access to vendor support, training and the right licensing channels. Ask which partnerships are real and verifiable on the vendor’s website. For us, they include Fortinet, Microsoft, WatchGuard, Veeam, Proxmox, Google Workspace, Kaspersky, 3CX, Yeastar and Grandstream. Be wary of logos displayed with no way to check them.

6. Ownership of your credentials and reversibility

Admin passwords, the domain name, Microsoft 365 or Google Workspace licences and firewall access must be in your organisation’s name, documented in a vault you can access. The contract should provide for the handover of documentation, credentials and backups at the end of the contract, without deterrent fees. This is the clause that protects you if the relationship goes wrong.

7. Tested backups and a ransomware procedure

A backup that has never been restored proves nothing. Require regular, documented restore tests, and at least one offline or immutable copy, following the rule described in 3-2-1 immutable backup. Also ask for the written ransomware procedure: isolation, analysis, restore, communication.

8. Reports management can understand

A monthly report should show incidents, response times met, backup and update status, and recommendations. This is what allows a finance director to steer the service without being an IT specialist. Ask for an anonymised sample.

Scoring grid for candidates

Rate each answer: solid or red flag. A candidate who stays on a red flag for response times, credentials or backups should not be selected.

Criterion	Solid answer	Red flag
Response times	Written per severity level, on-site conditions for Rabat stated	“We do our best”, “we’ll come when we can”
Monitoring	Console shown, alert chain described	No monitoring, or only on request
Security	MFA, EDR, firewall and patching included	Security sold case by case
Compliance	Knows law 09-08, and law 05-20 if needed	No knowledge of Moroccan regulations
Credentials	In the client’s name, shared vault	Kept by the provider
Backups	Restores tested and documented	“They run every night”
Reversibility	Written clause, no deterrent penalty	Data or credentials withheld
Reports	Monthly, with recommendations	None, or a raw export

Questions specific to a Rabat organisation

On top of the standard questions, detailed in IT provider in Casablanca: 12 questions to ask, ask these:

• Who travels, and how is it organised? A named engineer who knows your environment, or the first available technician?
• Is travel to Rabat included, and in which cases? Get it in writing, along with the rule for any sites you have in Salé, Témara or elsewhere.
• What is done remotely before travelling? A good provider diagnoses remotely first and arrives with the right part.
• How do you handle visits to access-controlled premises? Badges, escorts, time slots: plan for these at head offices and public bodies.
• Have you supported a comparable organisation? Ask to call a reference, without demanding names if the provider protects its clients’ confidentiality.

Common mistakes when choosing

• Choosing on address or price alone, without comparing the scope covered.
• Signing without an assessment: without an audit, exclusions appear after signature.
• Confusing break-fix and managed services: the first repairs, the second prevents, monitors and reports. The difference is explained in managed services vs in-house IT.
• Leaving credentials with the outgoing provider, which blocks or delays the switch.
• Forgetting telephony and networking: phone system, Wi-Fi and cabling must be covered or explicitly excluded.

Checklist before signing

• Severity table with written response times, remote and on site in Rabat.
• Demo of the monitoring console and a sample monthly report.
• Written list of included security items: MFA, EDR, firewall, patching.
• Written procedures for restore testing and ransomware response.
• Credentials, licences and domain name in your organisation’s name.
• Reversibility clause, commitment period and exclusions reviewed.
• Vendor partnerships verified.
• Initial audit carried out before signing.

How we work with Rabat organisations

Our model is simple and stated openly: a team based in Casablanca, remote support with a response within 24 business hours, 24/7 monitoring of servers, firewalls and backups, and critical incidents handled in under 15 minutes. Our engineers travel to Rabat for installations, audits, network projects and hardware failures, after a remote diagnosis. Travel conditions are written into the contract.

Find out more about our managed IT in Rabat and our managed IT services in Morocco. For a first assessment, read IT audit for SMBs: where to start, then request your free initial audit: we reply within 24 business hours.