You sent your IT provider a request. Nobody has answered.

Write down the silence

Start a log today, in one document, with dates. Five lines per request is enough.

1. When and how: the date and time you sent it, and the channel: phone, email, ticket portal, or text.
2. What you asked: the exact words, and what you need back, such as a restore, a new account, or an answer about a report.
3. Who acknowledged it: any ticket or reference number, and the name of whoever replied, if anyone did.
4. What the wait is costing now: how many people can’t work, which customer is waiting, which date is coming.
5. The last comparable request: when you made it and how long the answer took. That gives you a normal to measure this against.

Try a second door, in writing

The person who usually answers you may be away, which is a common reason and a different problem from the one on this page. If the log shows more than one request to the same person, the next message goes to someone else.

1. Look in the agreement and on your last invoice for a second contact: a main office line, an account manager, or an escalation address.
2. Send one short message to that person. State the request in one sentence, give the date of the first attempt, and copy the original contact.
3. Ask for two things back: a confirmation that the message arrived, and the name of the person who owns the request.
4. Name a date you need an answer by. A date you chose is a fact you can point to later.

What the agreement says about response

CISA’s guidance for customers of managed service providers lists what a contract should spell out. Check yours for each line, because a request outside the written scope can sit unanswered while everyone assumes someone else has it.

• How and when you are notified. CISA says contracts should detail how and when the provider tells you about an incident affecting your environment.
• Who owns what. CISA asks that each contract specify whether the provider or the customer owns responsibilities such as hardening, detection, and incident response.
• What the services include. CISA tells customers to understand the security services in the contract and to address any requirement that falls outside its scope.

What you should already be holding

Whatever the provider does, some records belong in your files, not theirs. Check that you can put your hand on each one today. If a line is missing, write “not held” and the date. That is a result, and it tells you what to ask for first.

• The signed agreement and every amendment.
• A list of the computers, servers, and software on your network. Keep it where more than one person can find it. CISA’s Cyber Essentials points leaders to inventories of hardware and software.
• A list of outside connections: accounts, vendors, and partners that touch your systems.
• The most recent backup and update reports as they were sent to you, with dates.
• The name of a second person at your company who can approve work when you are away.

When to ask for a second set of eyes

A second look doesn’t replace your provider. It reads what exists today and writes it down, so the next conversation starts from the same facts.

• The request can’t wait: someone is locked out, a customer’s questionnaire is due, or an alert has come in.
• The date you set has passed with no answer from either contact.
• An answer arrives and doesn’t match what you can see on your own screen.

What a second look can and can’t show

We look at the administrator roles, the records, and the reports with you, and tell you what we found and what we didn’t, with dates. A person reads the result. We can only read what someone at your company can open, so if nobody here can sign in as an administrator, that is the first finding.

A clean result covers what we examined on the day we examined it. It doesn’t explain the silence, and it doesn’t judge anyone.

A request with a date, a name, and a second person on it is harder to lose.

Related

• When Your IT Person Is Away: Where Alerts and Access Go
• Who Holds Your Administrator Passwords: Six Places to Look
• What a Second Opinion on Your Security Covers
• Leaving an IT Provider Without Losing Access

Sources

• CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)
• CISA: Cyber Essentials