The Actually Brief
The questions worth asking about your technology.
Independent guidance on IT provider reports, cybersecurity evidence and the decisions that sit with business leadership.
Making a provider decision? Start with the Checks.
Browse earlier briefingsLatest
Recent briefings.
How do I check our security tools are installed, reporting and monitored?
Ask your IT provider for a device-by-device record of endpoint security coverage, recent check-ins and who reviews alerts, then record what each reply establishes.
Ask ActuallyBill 194 and EDSTA: does Ontario's cyber regulation apply to my organisation?
Check whether O. Reg. 51/26 under EDSTA lists your organisation, then ask your IT provider what contact, assessment and incident records it can supply.
Ask ActuallyHow to answer a client security questionnaire when your IT provider holds the answers
Sort each answer in a customer security questionnaire into what your IT provider reports, what records you hold and what is unknown, then word exceptions honestly.
From the archive
Earlier briefings.
How do I check a former employee's access was removed?
A plain request for offboarding records from your IT provider, how to record each reply, what those records can and cannot establish, and what to decide next.
Who reports a breach when your IT provider caused it?
After an incident on provider-managed systems, ask for a written timeline, confirm who handles breach reporting, and record what the provider states and supplies.
How to chair your own quarterly review with your IT provider
Set the agenda for a quarterly review with your managed IT provider: what evidence to request first, how to record replies, and what each record can and cannot establish.
What Evidence Cyber Insurers Ask For
Review examples of evidence for a cyber insurance questionnaire: MFA, backups, endpoints and training. Match requests to your actual insurer's requirements.
What Your MSP Monthly Report Should Show
An MSP monthly report should compare the agreed service with evidence of delivery: what changed, what is at risk, which actions are open, what needs a decision.
How Often Should Backups Be Tested?
How to choose a backup testing schedule, read a restore report and identify what remains untested. Practical questions for your IT provider.
Who Owns Your Microsoft 365 Tenant?
An admin role does not make your IT provider the owner of your Microsoft 365 tenant. How to check who can act for your business, and what to put in writing.
Content categories
What the Brief covers.
Ask Actually
Direct answers to the technology questions executives actually ask.
What it covers- How do I know whether my MSP is doing a good job?
- Should my business have a fractional CIO?
- How often should backups be tested?
- What should an IT report tell the owner?
- What should I ask before renewing an MSP contract?
Actually Explained
Plain-language explanations of technology and cybersecurity issues.
What it covers- Backed up and recoverable are not the same thing
- What multi-factor authentication can and cannot prevent
- Why administrator access matters
- What a cybersecurity risk register is
- What happens during an independent IT review
Ten questions to ask your IT provider
A free checklist, and the one thing on this page you can read today.
Available now- Backups, access, patching and alerting
- Provider performance and technology spending
- The document, date or number that settles each one
A monthly executive newsletter
One clear briefing a month.
Fewer surprises start with better questions.
Keep reading
Where to go next.
Questions about your IT provider, answered
Eleven plain language pages on the situations that make a business doubt its provider.
The checklistTen questions to ask your IT provider
The document to bring to the next quarterly meeting, with what a real answer to each looks like.
The firmWho is behind actually.
Founded after three decades in business technology, on the observation that nobody was checking the people who run it.