How to choose an IT company in Winnipeg: a checklist
How do you choose an IT company in Winnipeg?
Choose an IT company by comparing what each one commits to in writing: what is covered, how fast they respond, which security tools they run, what the total cost is, and how you leave if it is not working. Compare the scope first and the price second, so you are comparing like with like. The 12 points below apply to any provider you are considering, including the one this website may connect you with.
This website does not rank or review IT companies, and this page lists none. It is a checklist you can use with anyone.
The 12-point checklist
| # | Check | The question to ask | Why it matters |
|---|---|---|---|
| 1 | Written scope | “What is included line by line, and what is excluded?” | A quote that omits help desk, patching, endpoint protection, a device inventory, backup monitoring or reporting may be break-fix under another name. |
| 2 | Support hours and response times | “What is the response target for business down, one user blocked, and a routine request?” | Ask for targets in writing for each level of urgency, and for how “unlimited support” is defined. |
| 3 | After-hours | “Is a human response outside business hours included, or only alerts?” | After-hours help is often handled separately, so check before you need it. |
| 4 | Security tooling | “Which endpoint protection and backup platforms do you use, and who watches the alerts?” | Tools that are deployed but not watched do little on their own. |
| 5 | Baseline controls | “Do you enforce two-factor sign-in, patching, tested backups and an incident response plan?” | These are controls the Canadian Centre for Cyber Security recommends for organizations under 500 employees.[1] |
| 6 | Onboarding | “What happens in week one and by day 30?” | Onboarding is when devices are inventoried, patching is caught up and two-factor sign-in is turned on. A good provider has a written plan. |
| 7 | Pricing in full | “How is the quote built, what is excluded, and how are extra projects and out-of-scope work handled?” | You want to know the full cost for your scope. See the cost guide. |
| 8 | Extras and fees | “Which costs are separate: onboarding, licences, hardware, projects, on-site visits?” | Knowing the boundary of the quote avoids surprises later. |
| 9 | Admin access and documentation | “Who holds the administrator passwords, and who owns the documentation?” | Your business should hold the admin credentials and be able to take its documentation with it. |
| 10 | Contract and exit | “How long is the term, what are the early-termination terms, and how is handover handled?” | Terms vary, so read the exit clause before you sign. |
| 11 | Data location and privacy | “Where is our data stored, who can access it, how would you notify us of a breach, and what happens to our data when we leave?” | The Cyber Centre suggests weighing outsourced providers’ handling of your information, jurisdictions, and where their data centres and administrators are located.[1] |
| 12 | Who is accountable on your side | “Who in our business owns IT security?” | The Cyber Centre recommends naming someone in a leadership role who is responsible for IT security.[1] |
Manitoba and Canadian points to raise
PIPEDA and breaches. The Privacy Commissioner of Canada says an organization stays responsible for personal information it has transferred to a processor, and that it needs contractual arrangements with the processor that cover the breach provisions. Businesses must keep a record of every breach for two years.[2] Ask how quickly the provider would tell you about a breach and what records it would give you.
Health clinics and PHIA. Manitoba’s Personal Health Information Act requires a health care trustee that gives personal health information to an information manager, which includes a provider of IT services, to have a written agreement protecting that information.[3] Ask any provider whether it will sign one. Check the current Act or ask a lawyer how it applies to you.
Microsoft 365 location. If you use Microsoft 365, confirm your tenant is provisioned in Canada. Microsoft’s Product Terms commit to storing Exchange Online, SharePoint, OneDrive and Teams chat content at rest in that geography for Canadian tenants.[4]
Red flags worth noticing
- A quote with no written scope, or one that only says “unlimited support”.
- A price with no explanation of what is and is not included.
- A refusal to give you the administrator passwords or your documentation.
- No clear answer on who watches the security alerts.
- A long term with steep exit penalties and automatic annual increases.
Using this checklist with the callback
When you request a callback, you can put these questions to the provider directly. Ask for answers in writing, and compare them with any other quotes you collect. The decision is yours.
This page is general information, not legal advice.
Frequently asked questions
How do I choose an IT company in Winnipeg?
Ask each company for a written scope of work and compare it line by line. Check what is explicitly included, the response-time commitments for urgent, impaired and routine issues, the security tooling, the onboarding plan and the exit terms, then look at pricing against that scope.
What should be in a managed IT contract?
At minimum: a help desk with defined response times, patching, endpoint protection, a device inventory, backup monitoring and regular reporting. Also check exclusions, after-hours support, contract length and exit terms, and who holds the administrator passwords.
What should I ask an IT company about privacy?
Ask where your data is stored, how and how quickly they would tell you about a breach, and whether they will sign an agreement covering confidentiality. Under PIPEDA your business generally stays responsible for personal information it passes to a provider, and Manitoba health clinics must have a written agreement with an IT provider that handles personal health information.