Most conversations we have with organisations already working with a provider follow the same shape. Things seem fine, but nobody can say for certain whether they are. These five questions tend to settle it.

1. When did we last restore from backup, and how long did it take?

Not whether backups are running. Whether a restore has actually been performed, recently, and how long it took. A provider doing this well will have a date and a duration. If the answer is vague, that is your answer.

2. What are the three biggest risks in our environment right now?

Every environment has them. A provider who knows yours will name them without preparation and tell you what it would take to address each one. A provider who cannot is not looking.

3. What percentage of our systems are fully patched?

Patching is unglamorous and it is how most breaches are prevented. There should be a number, it should be measured rather than estimated, and there should be a plan for whatever is not covered.

4. What does our environment need to look like in eighteen months?

This distinguishes a provider who is managing your technology from one who is only responding to it. Ageing hardware, licences approaching end of support and capacity limits are all foreseeable. They should appear on a roadmap with dates and costs, not as emergencies.

5. What happens in the first hour of a serious incident?

Who is called, who decides, who communicates, and how you reach each other if the usual systems are down. If the plan exists only in someone's head, it does not exist.

What good answers look like

You are not testing technical depth here; you are testing whether someone is actively managing the environment or simply reacting to it. Specific answers with dates and numbers indicate the former. Reassurance without detail indicates the latter, and the gap between them only becomes visible when something has already gone wrong.