Having touched on certifying equipment in previous comments, here's a suggestion answering some points made about businesses providing support services.
Require services to be certified. If, as in a previous comment, ACLs weren't in place, the service provider loses its certification and must pass its contracts over to another provider.
And I don't mean simple ISO 9000 box ticking. The service actually being provided gets unannounced spot checks to see what the reality is.
Biting the hand that feeds IT
