Why good IT looks boring — it’s a sign of reliability

Good IT looks boring because it focuses on routine controls, clear processes and repeatable recovery so nothing breaks suddenly; that steadiness helps you meet rules like the ICO’s 72-hour breach reporting and delivers benefits across people and systems in as few as 3 months for many firms.

How quickly can services be restored?

When evaluating IT, measure how long a supplier takes to restore core services after an incident. What matters to a business is recovery time (how fast people are back working) rather than feature lists. Ask for an example incident timeline and a single clear number for target downtime: an honest provider will quote an RTO (recovery time objective) or show incident records. If a supplier dodges that question, it usually means their setup hasn’t been hardened.

Practical checks you can make while comparing offers:

  • Demand a documented incident runbook for a lost server or email outage.
  • Check whether backups are regularly tested — a backup that hasn’t been restored is a false promise.
  • Confirm who has authority to act out-of-hours and what the escalation times actually are.

In procurement terms, prefer predictable, testable recovery commitments over marketing about new features. Fast, repeatable recovery is a better commercial hedge than flashy technology that increases complexity.

Can someone unfamiliar with your estate take over?

Boring IT is readable IT. If your systems are well documented, an administrator you’ve never met can follow a clear sequence to patch, restore or replace a service. That lowers risk when staff move on or when you change supplier. Ask your current provider (or a prospective one) for an asset inventory, runbooks and a small change log — these are simple proofs of maturity.

Key items to request during evaluation:

  • Up-to-date asset register showing owners and warranty dates.
  • Runbooks for common problems (lost email, failed backup, AD account lockout).
  • Clear handover notes that match the scope of the SLA.

Readable systems mean you are not captive to a single person or firm, and they reduce time spent on escalations that cost you productive hours.

Does the approach make audits and compliance straightforward?

Boring controls — MFA enabled, segmented networks, logging retained sensibly — simplify audits and reduce the chance of regulatory fines. Practical compliance examples to test: is Multi-Factor Authentication applied to admin accounts? Is logging retained for a reasonable period? How quickly can the supplier produce evidence of patch levels or access controls?

For data breaches the legal requirement is specific: organisations should report personal data breaches to the ICO within 72 hours where feasible; having simple controls and an incident response plan makes that realistic. When speaking to suppliers, ask for the evidence they will supply during an audit and whether they have been through any third-party assessments (for instance, Cyber Essentials).

How predictable are costs and lifecycle plans?

Predictability is the commercial benefit of dull IT. Replacement cycles, licencing, monitoring and backups should be planned and budgeted; surprise capital projects and emergency recoveries are signs the estate hasn’t been managed. When comparing options, insist on a clear renewal and refresh schedule and transparency on what triggers extra charges.

Use these quick budget checks:

  • Ask for a three-year replacement plan for servers, endpoints and licences.
  • Confirm which activities are included in the monthly fee and which are charged separately.
  • Request examples of historic invoices for emergency work — frequent out-of-plan charges are a red flag.

Predictable costs allow accurate financial planning and reduce the need to cut corners on security when budgets tighten.

Putting the criteria together when comparing options

When you shortlist suppliers, score them against the four criteria above: recovery capability, documentation/readability, audit-readiness and cost predictability. Use a simple matrix (1–5) for each item and weight the ones that matter most to your business — for many this will be recovery and audit evidence. Ask for one small live proof: a documented restoration of a backup or a runbook walk-through.

Practical selection steps:

  1. Request one-page evidence packs covering the four criteria.
  2. Score suppliers and hold a 30-minute technical call to clarify any gaps.
  3. Choose the supplier with the best combined score, not the most dazzling demo.

Choosing the quieter option usually buys you fewer incidents, more predictable spend and easier compliance. If you want a quick next step, ask shortlisted suppliers for a 30-day remediation plan that lists three measurable actions they will take in the first month — that shows whether their “boring” work is actually being done.

Related reading

FAQ

How long before I see fewer outages after switching to a steady IT approach?

Most organisations see measurable reductions in user-impact incidents within 3–6 months after stabilising backups, patching and monitoring, because the common causes of downtime are routine controls.

Can a small UK firm reach Cyber Essentials with a conservative IT setup?

Yes. Cyber Essentials targets a small set of controls (boundary firewalls, secure configuration, access control, malware protection and patching) and many firms can implement them in 4–8 weeks depending on estate size.

How soon must I report a data breach to the ICO?

If personal data is involved you should notify the ICO within 72 hours where feasible; having an incident response plan and basic logging in place makes meeting that deadline realistic.