How do we know our IT provider is doing a good job on security?
Ask for evidence on a few points and check some of it yourself. Your contract should say what the provider monitors, who responds at night and at weekends, how quickly, and how incidents are reported to you. Then ask each quarter for the patch status of servers, the result of the last restore test, the accounts without multi-factor authentication, and the incidents and how they were handled. If the provider has wide remote access to your systems, ask how that access is protected, because attackers target providers to reach their clients. Independent visibility helps: alerts from your own monitoring show whether problems are found before you hear about them. From the Starter plan, NetSenX supports several users, so your provider and someone in your company can both see the alerts.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.