The PDPC fined a Singapore HR software company SGD 17,500 in January 2026 after a breach exposed personal data belonging to 95,000 individuals — data that was being processed by a vendor with inadequate security controls. The affected organisation was responsible under the Personal Data Protection Act. The vendor chose the wrong controls. The fine and the reputational damage landed on both.
Your IT vendor has access to your systems, your data, and your infrastructure. If they respond slowly to a critical incident, your staff cannot work. If they handle personal data carelessly, your compliance exposure follows.
These 12 questions are designed to separate vendors who sound good in a proposal from vendors who will still be useful when the pressure is real.
1. What type of businesses do you usually support?
Good answer: The vendor can describe clients similar to your size, industry, compliance needs, and operating model. They understand SME realities: lean teams, tight budgets, mixed legacy systems, and the need for practical prioritisation.
Red flag: They only talk in generic enterprise language, or their examples are far removed from your business.
2. Who will actually handle our account after onboarding?
Good answer: You know the account owner, support lead, escalation contact, and how responsibilities are split. There is a named person accountable for continuity, not just a shared inbox.
Red flag: The sales team is clear, but the post-sale operating model is vague.
3. What are your support hours, response times, and SLA terms?
Good answer: The SLA defines support hours, ticket priorities, response times, escalation paths, and what happens outside office hours. For critical systems, the vendor explains how urgent incidents are handled.
Red flag: "We usually reply quickly" with no written commitment. Friendly is not the same as accountable.
4. How do you classify urgent issues?
Good answer: A server outage, internet failure, ransomware alert, or business-wide email disruption is treated differently from a single-user printer issue. Severity levels are based on business impact.
Red flag: Every ticket enters the same queue, regardless of operational risk.
5. Are you transparent about hardware, software, and warranty options?
Good answer: Quotes separate product cost, services, warranty terms, lead times, renewal dates, and alternatives. The vendor can explain why one model, licence, or warranty tier is recommended over another.
Red flag: Bundled pricing with unclear margins, vague product SKUs, or no explanation of warranty coverage.
6. How do you avoid overbuying or under-specifying equipment?
Good answer: The vendor sizes hardware against workload, user count, growth, support lifecycle, and total cost of ownership. They can recommend standard builds without forcing unnecessary premium specifications.
Red flag: Every recommendation is either the cheapest option or the most expensive option.
7. What vendor relationships and certifications do you hold?
Good answer: The vendor can show relevant partner relationships or reseller channels for the brands they recommend, and can explain how those relationships help with stock availability, warranty escalation, and technical pre-sales support. Certifications should be relevant to the services they actually deliver.
Red flag: They claim to support every brand but cannot show formal partner status with any of them. A vendor who lists 50 brand logos on their website but holds no certified relationship is a general reseller, not a solutions partner — and the difference matters when a warranty claim or technical escalation is urgent.
8. How do you handle PDPA and vendor risk?
Good answer: The vendor understands that outsourced IT can touch personal data. They can explain access controls, confidentiality, logging, breach escalation, data handling, and how they assess cloud or software suppliers.
Red flag: They treat PDPA as only a legal issue, or cannot say who can access your systems and data.
9. What security controls are included by default?
Good answer: Endpoint protection, patching, MFA, backups, access reviews, network hardening, and monitoring are discussed as core controls, not optional extras after an incident.
Red flag: Security only appears as an upsell, or the vendor cannot explain how they reduce ransomware, phishing, and account-takeover risk.
10. How do you document our environment?
Good answer: The vendor maintains an asset register, network diagrams, licence inventory, warranty records, admin access records, and renewal calendar. Documentation is updated as part of normal work.
Red flag: Knowledge sits with one engineer, and nothing is recorded unless you ask.
11. What happens if we outgrow the current setup?
Good answer: The vendor can support staged growth: device refresh, server upgrades, cloud migration, network redesign, cybersecurity improvements, and managed support. They can roadmap the next 12 to 24 months.
Red flag: They can fix laptops but cannot advise on infrastructure, cloud, security, or procurement planning.
12. Can you explain your recommendations in plain business terms?
Good answer: The vendor can connect technical choices to business outcomes: less downtime, clearer budgets, better security, faster onboarding, and reduced operational risk.
Red flag: They hide behind jargon, or make your team feel dependent instead of informed.
A simple scoring method
Give each vendor a score from 1 to 3 for every question:
- 1 means the answer is vague or risky.
- 2 means the answer is acceptable but needs clarification.
- 3 means the answer is clear, documented, and relevant to your business.
Any vendor scoring poorly on SLA, PDPA, security, or procurement transparency deserves extra scrutiny, even if the quote looks attractive.
The best vendor reduces uncertainty
A good IT vendor makes decisions easier. They document your environment, explain trade-offs, protect your data, manage suppliers, and give you a realistic path from today's setup to tomorrow's requirements.
That matters in Singapore, where SMEs need enterprise-grade reliability without enterprise-sized overhead. The right partner should help you buy better, support faster, and plan earlier.
Aggasys helps Singapore businesses choose, procure, deploy, and support the right IT stack across infrastructure, end-user devices, software, cybersecurity, and managed services. If you are comparing vendors or planning your next refresh, book a consult with Aggasys and we will help you turn the questions above into a clear vendor scorecard. Or call (+65) 6250 0045.