Many agency principals choose IT support on price or a referral, then find the gaps later. They usually show up when an agent leaves, an email account is compromised or a file cannot be restored.
How your provider works affects client data, settlement payments and the records your agency holds for anti-money laundering and counter-terrorism financing (AML/CTF) obligations. For context, ASD’s ACSC reports that the average self-reported cost per cybercrime report for a small business was $56,600 in 2024-25.
This guide sets out the questions to ask a managed IT provider before you sign and what a good answer sounds like. Catalyst Computers works with Sydney agencies through its real estate IT support and these are the questions we would expect you to put to any real estate IT provider, including us.
Does a Real Estate IT Provider Understand How Your Agency Works?
Start with fit. A provider that does not understand agency life will struggle to support it, however strong its security looks on paper.
1. Do you understand how agencies operate day to day? Sales and property management run on different rhythms and your agents spend much of the week at inspections, appraisals and auctions. Many agencies also run more than one office and rely on a mix of cloud and desktop applications.
Real estate IT specialists will ask about those workflows before they quote. A good answer sounds like questions back to you: who works where, which systems are critical and what slows your team down now.
2. How will you support agents in the field, new starters and people who leave? Your agents need secure access to email, files and applications from their phones and laptops, wherever they are working. New starters need accounts and devices ready on their first day.
Just as important is removing access promptly when someone leaves, including email, shared files and any devices they used. An IT company for real estate agencies should be able to show you a documented joiner and leaver process, not ddscribe one on the spot.
How Will They Protect Client Data and Settlement Payments?
Your agency holds personal information on buyers, sellers, landlords and tenants and handles emails that lead to large payments. These are the two areas to probe hardest.
3. How will you protect our client data and reduce breach exposure? The OAIC received 1,205 data breach notifications in 2025 and 716 of them were attributed to malicious or criminal activity. Those figures cover all sectors, not real estate alone, but every agency holding client records faces the same pressure.
A good answer names specific controls rather than “we’re secure”. Expect to hear about multi-factor authentication (MFA), limiting each person’s access to what their role needs and keeping devices managed and updated. You can see how Catalyst Computers approaches this through its IT security services.
4. What email filtering and anti-impersonation controls will you set up? Business email compromise fraud resulting in financial loss made up 15% of the cybercrimes businesses reported to ASD’s ACSC in 2024-25. For an agency, the risk is a fake or hijacked email that redirects a deposit or settlement payment.
Ask how an IT provider reduces payment redirection risk in practice. A good answer covers MFA on every mailbox, SPF, DKIM and DMARC records on your domain, email filtering and regular staff awareness.
It should also support a call-back check whenever bank details change. Together, these layers can help reduce the risk, though no single control removes it.
How Will They Handle AML/CTF Records and Their Own Access?
Two risks are easy to overlook when comparing providers: the extra records your agency now keeps and the access the provider itself holds.
5. How will you help us store and secure AML/CTF records?Since 1 July 2026, AML/CTF obligations have applied to real estate professionals who provide designated services, including brokering the purchase, sale or transfer of real estate. AUSTRAC’s guidance says records must be kept for a specific period, usually 7 years and stored and managed securely.
Since 1 July 2026, AML/CTF obligations have applied to real estate professionals who provide designated services, including brokering the purchase, sale or transfer of real estate.That makes AML/CTF records and agency IT a data storage question. Ask where these records will live, who can access them, how long they are retained and how they are backed up.
An IT provider supports secure data handling, but compliance itself sits with your agency and its advisers. Be cautious of any provider that claims it can make you compliant.
6. How do you secure your own access to our systems? Your provider will usually hold privileged access to your systems, often remotely. ASD’s ACSC guidance, Questions to ask managed service providers, notes that this access needs to be managed securely.
The ACSC suggests asking whether a provider implements the Essential Eight, securely administers its systems, monitors activity, regularly assesses its systems for vulnerabilities and is prepared to respond to cyber security incidents.
Asking how an IT provider secures its own access to your systems is a fair test. A provider that explains it plainly is showing you how it will treat your data and vague answers are a warning sign.
What Happens When Things Go Wrong and Who Is Responsible for What?
Before you sign, find out how recovery works and where the provider’s responsibility ends.
7. What does backup and recovery look like and when was a restore last tested? Your backups should cover both cloud and local data and be kept apart from everyday systems. The ACSC notes that backups which are easily accessible can be encrypted or deleted by ransomware and recommends testing restoration regularly and whenever your IT setup changes.
A good answer includes a recent restore test date and a written recovery plan that sets priorities for your critical systems.
8. What is in scope for you and what isn’t? Ask for a written agreement covering support hours, response targets, escalation contacts and charges for work outside the agreement. Confirm what support is available when your agents work evenings or weekends and how the provider reports on the service. Knowing what is in scope for an IT provider avoids confusion at the worst possible moment.
An IT provider for real estate agencies typically manages devices, user accounts, security, backup and your network. Website, portal and CRM integrations are a different job and usually sit with your software vendor or web developer.
A good real estate IT provider tells you this upfront rather than promising to fix everything.
Speak With Catalyst Computers About Choosing a Real Estate IT Provider
Clear answers to these eight questions point to a provider that supports continuity, helps protect client data and keeps your records secure.
Contact Catalyst Computers for a free IT assessment, or call 02 9698 4050 to speak with our team about IT support for your agency.
This article provides general IT information only and is not legal, financial or compliance advice.
