Managed IT and cyber security for regulated firms in Dubai & Abu Dhabi
Managed IT and cyber security for regulated firms in Dubai & Abu Dhabi
Ask every IT company the same 10 questions: who answers at 2am and what the SLA says, who has admin access, when they last tested a backup restore, whether they are independently certified, whether they understand your regulations, who covers holidays, what costs extra, how you can see their performance, what they would change first, and how you would leave. A good provider answers without flinching. A bad one suddenly needs to “check with the team”.
From the outside, every IT company looks the same: a logo, a stock photo of a server room and the words “end-to-end solutions”. We should know. We’re one of them.
So here’s the honest version. These are the 10 questions we’d ask if we were hiring an IT company ourselves. A good provider will answer them without flinching. A bad one will suddenly need to “check with the team”.
Every proposal says “24/7 support”. Ask what that means. Is it a person, a ticket that waits until Monday, or a voicemail in a time zone you’ve never heard of? Ask for the name of the team and where they’re based.
Good answer: a named team, an emergency number that isn’t someone’s personal mobile, and a proper SLA (service level agreement).
An SLA is the bit of the contract that turns “we’ll get back to you ASAP” into an actual number. It should set out how quickly they’ll respond and how quickly they’ll fix things, by priority. For example, a critical issue (nobody can work) gets a response within 15 minutes, while a request for a new mouse can wait until after lunch. Ask what happens when they miss it. If the answer is “we never miss it”, ask to see the figures.
If they’re taking over from another provider, they should want to find this out on day one. Ex-employees, old suppliers and that one freelancer from 2019 often still hold the keys. If your new IT company doesn’t ask, they’re not going to check.
Not “do you do backups”. Everyone says yes. The question is whether anyone has actually restored one and watched it work. A backup that’s never been tested is less of a backup and more of a hope.
Good answer: a date, what was restored and how long it took. More on this in our page on data backup and recovery.
Anyone can write “secure” on a website. Certifications such as ISO 27001 (information security) and ISO 9001 (quality) mean an outside auditor has checked how the company actually works. It’s not a guarantee, but it does mean someone other than their marketing team has looked.
A retailer in Al Quoz and a wealth manager in DIFC have very different obligations. If you’re in a free zone or a regulated industry, ask whether they’ve worked with firms like yours and which regulations they deal with. If the answer is “we’re very flexible”, that’s a no.
Regulated in DIFC or ADGM? See our guide to IT vendor management for DFSA and FSRA firms.
Smaller providers often rely on one person who knows everything. That’s fine until they’re on a beach with no signal. Ask how knowledge is documented and who covers your account when the usual person is away.
The monthly fee looks lovely until the first invoice for “out of scope works”. Ask for a plain list: what’s covered (support hours, number of users, devices, site visits), and what’s billed on top (projects, new starters, hardware, after-hours call-outs).
Our guide to managed IT services costs in Dubai goes through the usual inclusions and extras in detail.
Ask what they’ll report and how often, and whether you can see it yourself without having to ask.
The best providers give you a customer portal where you can log tickets, see who’s working on them, and check in real time whether they’re hitting their SLAs. You should be able to see open and closed tickets, response and fix times against the SLA, and recurring problems that keep coming back. It’s the difference between “trust us, it’s fine” and “here’s the dashboard”.
On top of that, expect a regular review covering security updates applied and risks they’ve spotted. If the only report you get is the invoice, you’ll only hear from them when something breaks.
Ask them to look at your set-up before you sign and tell you the three things that worry them most. A good IT company will find something. One that says everything looks perfect either hasn’t looked or wants to keep you happy until the contract is signed.
Nobody likes talking about the break-up on the first date, but you should. Ask who owns your accounts, passwords and documentation, and how handover works. If leaving sounds difficult, staying will be too.
Cre8 IT has supported businesses in the UAE since 2012, with engineers in Dubai, Riyadh and the UK. We’re ISO 27001 and ISO 9001 certified, and every client gets a baseline level of cyber security whether they asked for it or not. Some of them grumbled. None of them have asked us to remove it.
If you’d like us to answer these 10 questions about your business, book a free 30-minute consultation. We’ll tell you what we’d change first, even if you don’t hire us.
Last reviewed 7 October 2026. This guide is general information, not legal or contractual advice.
A service level agreement is the part of your IT contract that sets out, in numbers, how quickly the provider will respond to and fix issues at each priority level, and what happens if they miss those targets.
It depends on the support level you pay for. What matters is that response and fix times are written into the SLA for each priority, with critical issues handled fastest, and that you can see how they perform against it.
Yes, ideally. A portal lets you log tickets, track progress and see SLA performance without chasing anyone, which makes it much easier to judge whether you are getting what you pay for.
Plan the handover. Ask your current provider for documentation, admin passwords and licence details, check you own your accounts, and give the new provider time to review your set-up before the old contract ends.