How to choose an IT partner who protects you (and does not expose you)

Short answer: choose a partner who looks at the whole picture — network, access, backup, updates — and owns security, not just "making your application work". The cheapest option, or the vendor of a single program, rarely covers the whole, and the gaps between suppliers are where incidents happen.

Why is your software vendor not your security owner?

The vendor of a commercial or accounting program has one goal: to make their application run. To do it fast, they often open remote access, disable controls or leave default passwords — "make it work" settings that become huge security holes. Nobody checks whether the server is patched, whether there is a firewall, whether the backup is isolated. "It works" does not mean "it is secure".

What are the signs of the wrong partner?

• Shows up only when something breaks (break-fix), with no prevention or monitoring.
• Leaves remote access open and default passwords "for convenience".
• Does not document what was done — nobody knows how the system is set up.
• Backup "exists" but a restore was never tested, or it sits on the same network.
• Takes no responsibility for security — "I only do the program".
• Never mentions updates, MFA or an incident response plan.

Which questions should you ask before you hand it over?

• Who owns security across the whole, and how do they report it?
• How do you monitor the systems, and how fast do you respond to an incident?
• How is the backup set up? Is it isolated (offline/immutable) and when was a restore last tested?
• How do you manage remote access, passwords and MFA?
• What documentation do you deliver, and what do I see as management?
• Do you cover compliance (e.g. NIS2) or only technical operation?
• Is the price a fixed monthly fee, or are you charged every time something goes wrong?

What should a proper partner deliver?

• Proactive monitoring and updates, not just visits when something breaks.
• Proper 3-2-1 backup with an offline/immutable copy and regular restore tests.
• A real firewall, locked-down access, MFA and EDR instead of plain antivirus.
• Documentation, reporting to management and a clear owner for the whole.
• A fixed, predictable cost and alignment with obligations such as NIS2.

How do we do it?

At ITHACA we start with a holistic baseline (technology, security, cost and compliance together) and take on the whole with Managed IT: monitoring, updates, backup with tests, protection and reporting, at a fixed monthly price. That way you do not split security, compliance and technology across three suppliers, with the gaps forming between them.