Choose a managed IT provider in South Africa by comparing proof, not promises. Give two or three providers the same brief. Then ask each for a written scope, response targets for your working hours, a dated restore test, a POPIA operator agreement and a way to leave. Trust the provider whose answers you can check.
I have worked in IT and development since 1998, and Rizonetech provides managed IT, so this is the list I would want a client to hold us to. Under most questions I say how we answer it, limits included. Where our published terms do not settle a question, ask us for the answer in writing, as you would ask anyone else. Reviewed 13 October 2026 by Derick Payne.
How do you compare managed IT providers in South Africa fairly?
Give every provider the same written brief, so the quotes describe the same job. List your people, computers and sites, the hours your business works, what runs in Microsoft 365, where your files live, and what worries you most. A provider who quotes without asking about any of it is guessing.
Then ask the ten questions below, and ask for the proof behind each answer. A promise in a sales meeting is not a commitment until it is in the scope or the agreement. For what a scope should contain and how the fee is built, read what managed IT includes and what drives the cost.
1. What exactly is in the scope, and what costs extra?
“Managed IT” has no fixed meaning, so the scope is the product. Ask for it in writing: the users, devices and systems covered, the support hours, and each task the provider takes on. Then ask what is quoted separately, such as new computers, migrations, projects and recovery after an incident.
Proof to ask for: the draft scope itself, before you sign.
How we answer: we first review your computers, backups, sign-ins and security software. Then you get a written scope with the hours, the escalation and the cost, and you approve it before any work starts.
2. What response targets will you commit to, and in which hours?
There is no single right number. Agree a target for business-down incidents that fits the hours your business runs and what an hour of downtime costs you. Then check which clock the target measures: acknowledging a call, starting work and fixing the problem are different promises. Ask what happens outside the covered hours, and what it costs.
Proof to ask for: the targets per priority, in the agreement.
How we answer: we answer Monday to Friday, 09:00 to 16:30 SAST, and take critical issues after hours and on public holidays at twice the normal rate. We do not offer round-the-clock support. Response times outside those hours, and how urgent work is escalated, are agreed in each client’s scope.
3. When did you last restore one of these backups?
A backup proves itself only when something is restored from it. The US Cybersecurity and Infrastructure Security Agency’s ransomware guide says: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” Ask how often the provider tests a restore, what it restores (a file, a mailbox, a whole computer), and whether you see the result.
A restore that works can still be too slow or too old. Agree two numbers for each critical system: how much recent work you can afford to lose, and how long you can wait to get it back. Our backup and disaster recovery guide goes deeper.
Proof to ask for: a dated restore result for a system like yours, showing how old the backup was, what was recovered, how long it took, and whether it met your two numbers.
How we answer: backups are tested by restoring from them on a set schedule, and you get the result.
4. Which security controls are in the base price?
Ransomware is a real risk here. INTERPOL’s Africa Cyberthreat Assessment Report 2025 charts 12,281 ransomware detections in South Africa in 2024, second in Africa after Egypt. Those are one security company’s detections (Trend Micro’s), not a count of every attack.
Multifactor sign-in, monitored security software on every computer, email filtering and timely updates belong in the base scope, not in an upgrade sold after an incident. Our cybersecurity baseline lists the essentials.
Proof to ask for: the list of controls included, and who responds when one raises an alert.
How we answer: security software runs on every computer in the agreement, monitored so we can respond when it finds something. We name the products in your scope.
5. Who controls the admin accounts, the domain and the Microsoft 365 tenant?
You should. The provider gets access; you keep control. Microsoft recommends two cloud-only emergency access accounts with the Global Administrator role, and fewer than five people holding that role. Keep those accounts in your business’s hands.
A Microsoft partner should work through granular delegated admin privileges (GDAP): limited roles that you grant. A relationship lasts at most two years, but Microsoft’s GDAP FAQ says it can auto extend by six months at a time, and the partner can switch that on without asking you again (except for relationships that include Global Administrator). So the access does not always expire by itself. You can see and remove a partner’s access yourself on the Partner relationships page of the Microsoft 365 admin centre.
For your domain, check whose name is on the record. The .co.za registry’s published policies say “The Registrant will retain control of their domain name”. If the provider registered your domain in its own name, the registrant is the provider, not you. A domain that works in Microsoft 365 proves nothing about whose name is on the registration.
Check it yourself, signed in with an account your business controls:
- In the Microsoft Entra admin centre, open Entra ID, then Roles & admins, then All roles, and see who holds Global Administrator and the other admin roles.
- In the Microsoft 365 admin centre, open Settings, then Partner relationships, and check which partners have access, their roles, the end date and whether auto extend is on.
- Ask your domain’s registrar for the registrant record, and confirm you can sign in to the registrar account yourself.
Proof to ask for: the provider’s list of admin accounts, matched against what you found, and the registrant record.
How we answer: at handover you hold the admin access, the backups, the device list, the security settings and a setup record in plain words.
6. Will you sign a POPIA operator agreement?
Under POPIA, an IT provider that processes personal information for your business, under a contract and not under your direct authority, is an “operator”. Your business stays the responsible party. Three sections matter:
- Section 20: the operator may process the information only with your knowledge or authorisation, and must keep it confidential.
- Section 21: you must have a written contract that makes the operator keep the security measures section 19 requires. The operator “must notify the responsible party immediately” when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.
- Section 22: your business then notifies the Information Regulator and the people affected “as soon as reasonably possible”, subject to the section’s exceptions. Since 1 April 2025 the Regulator requires reports to it through its eServices portal, not by email. The people affected are told separately, in writing, in one of the ways section 22 allows.
Proof to ask for: the operator agreement, and the name of the person who will call you if something goes wrong.
7. How do you keep working when the power or the line goes down?
Load-shedding has paused: Eskom said South Africa had gone 504 consecutive days without it by early October 2026. Load reduction still affects some high-risk areas, and local outages happen for other reasons. A sudden power cut can still interrupt a backup or damage an open file. Ask how the provider protects equipment with a UPS and a safe shutdown, where backups are kept off-site, and how people keep working when the office line is down.
Proof to ask for: what their plan does for your office, in writing.
8. What will your monthly report show?
If you cannot see what was done, you cannot judge what you pay for. A useful report is short and in plain language: updates applied, threats found and handled, backups and restore tests, open issues, and the risks the provider wants you to decide on.
Proof to ask for: a sample report, labelled as a sample, before you sign.
9. Who does the work, and who covers when they are away?
Ask who owns the technical decisions about your systems, who handles day-to-day support, and how work is covered when that person is on leave or ill. Ask for the cover by name: who steps in, what access they have, and when they are available. A written record of your setup helps them pick up the work, but it is not cover by itself.
Proof to ask for: the cover arrangement in writing, with names, access and hours.
10. How do you leave, and what do you get back?
Ask about the exit before you sign. How much notice does the agreement need, and what does the provider hand over: admin access, backups, the device list, licences and documentation?
Read the notice clause closely. The Consumer Protection Act lets a consumer cancel a fixed-term agreement on 20 business days’ notice, but section 14 “does not apply to transactions between juristic persons”. If your business and the provider are both juristic persons, such as companies, the contract’s terms carry most of the weight, within the law that still applies. Where section 14 does apply, you still owe what was due up to the cancellation, and the supplier may charge a reasonable cancellation penalty. Either way, ask what leaving costs: cancellation charges, handover fees and any equipment or licences you must pay off.
Check the licences too. Annual Microsoft 365 subscriptions bought through a provider can move to a new partner mid-term, but only if both partners approve the transfer, and the term carries on. Our own NCE agreement needs 60 days’ written notice to stop a renewal.
Proof to ask for: the notice period, the costs of leaving, the handover list and the licence terms, in the agreement.
How we answer: nothing is locked behind our name, and the next provider starts from the same record we use.
What does a good answer look like?
| Question | A good answer | A warning sign |
|---|---|---|
| Scope | A written scope that names systems, tasks and exclusions | “We look after everything” |
| Response | Targets per priority, with the clock and the hours named | One number, with no hours or priority |
| Restores | A dated restore result, with its age and time against your targets | “The backups run every night” |
| Security | Named controls in the base price, monitored | Security sold after an incident |
| Control | Your own admin accounts, partner access you have checked, your name on the domain | The provider holds the only admin password |
| POPIA | A signed operator agreement with breach notice | “We don’t need that” |
| Power | A written plan for outages and off-site backups | No plan beyond “it’s rare now” |
| Report | A plain monthly report, with a sample shown | Only a ticket count, or nothing |
| People | A named contact, named cover with access, and a written setup record | Nobody can say who covers |
| Exit | Notice, exit costs, handover list and licence terms in writing | “You won’t want to leave” |
To compare your shortlist, copy this table and add a column for each provider. Mark each answer as supplied, missing or unclear, and get the missing proof on the rows that matter most to you before you choose.
FAQ
Should I choose a provider in my own town?
Only if you need people on-site often. Most support is remote, so a provider elsewhere can serve you well; for hands-on work, ask where their nearest technician is. Our own on-site support is in George; elsewhere in South Africa it is remote.
Is the cheapest per-user price a bad sign?
Not by itself. Compare what each price includes: security software, backups, hours and on-site visits. A low price that leaves those out is a different product.
Can I change provider in the middle of a contract?
Usually yes, but two things move separately. Ending the support contract follows its notice period and any exit charges. Microsoft 365 licences bought through the provider move to a new partner mid-term only if both partners approve, and their term carries on. Plan the handover so backups and protection keep running on the day you switch.
What should you do next?
Run the free IT health check before you talk to anyone: ten plain questions about backups, sign-ins and updates. Take its report and these questions to every provider you consider, including us. When you are ready, see how our managed IT support works. We will tell you plainly if we are not the right fit.
Published 16 June 2026. Last updated 13 October 2026.