Start with the working environment
List the people, locations, devices and applications that need support. Include remote workers, shared devices and systems owned by another vendor. For each important system, identify who administers it today. This gives providers a common starting point and exposes gaps between desktop support, application support and infrastructure operations.
Turn service language into questions
Ask how requests enter the service, how urgency is assigned and who escalates an unresolved issue. Compare support hours with your actual operating hours. Record what happens outside the included service and how additional work is approved. A response commitment and a restoration commitment answer different questions; make both understandable before comparing fees.
Look beyond everyday tickets
Security access, incident coordination and recovery deserve their own discussion. Ask which accounts the provider uses, how privileged access is controlled and what records your organisation receives. Identify the owner of each recovery decision. A support agreement should help your team understand who acts when normal operation is interrupted.
Plan the relationship after onboarding
Agree the asset inventory, documentation and reporting you expect to receive. Identify the internal person who reviews service issues and approves changes. Include an exit conversation before signing: account transfer, current configuration records and cooperation with a replacement provider should have clear owners. BlueBlocks helps organise these questions into a requirement and compare the responses.
Turn the guidance into your brief.
Record the outcome, scope, assumptions and outstanding decisions in a shared requirement. Ask every invited provider to respond to the same version, and keep missing information visible rather than treating silence as agreement.
BlueBlocks helps structure that conversation. Specialist discovery that requires substantial work can be quoted as its own project before implementation is commissioned.
Take these questions into the conversation.
- What systems are excluded from the monthly service?
- Who controls administrator accounts and access removal?
- What information will we receive when the service ends?
Explore the work behind this question.
When the next step needs specialist expertise, start with a focused requirement. Explore the service, then talk to BlueBlocks about what fits your organisation.
Research & references Reviewed 2 November 2026
These primary sources inform the context and questions on this page. Procurement recommendations are BlueBlocks editorial guidance. A cited organisation does not endorse BlueBlocks; applicability depends on your systems and obligations.
- Cyber security considerations for consumers of managed services ↗Canadian Centre for Cyber Security · ITSM.50.030, October 2020; checked November 2026
- Communicating cybersecurity supplier requirements ↗NIST · SP 1305, October 2024; checked November 2026