How to Choose an IT Provider: Questions, Red Flags, and a Scoring Checklist

Choosing a managed IT provider (MSP) is one of the few vendor decisions that touches every person, device, and file in your business. Get it right and technology fades into the background. Get it wrong and you spend the next three years fighting your contract, chasing tickets, and wondering who actually has the admin passwords.

We’ve been on both sides of this decision since 2005, as the provider being evaluated and as the team cleaning up after a poor fit. This guide covers what we’d want any business owner to know before signing.

Start with what you actually need

Before you talk to a single provider, write down what problem you’re solving. “We need IT support” is too vague to evaluate anyone against. Get specific:

• Who needs support? Number of users, locations, and remote staff.
• What do you run? Line-of-business applications, cloud platforms, on-premises servers, phones, printers, cameras, and network gear.
• What rules apply to you? HIPAA, the FTC Safeguards Rule, CMMC, PCI DSS, or cyber insurance requirements all change what “good” looks like.
• What’s broken today? Slow response, no documentation, recurring outages, security gaps, or simply no one owning the problem.
• Where are you going? Growth, new offices, an acquisition, or a move to the cloud in the next few years.

This one-page summary becomes the yardstick. Every provider should be able to respond to it directly.

Questions to ask every MSP

About service and response

1. How do users request help, and what happens next? Ask them to walk through a real ticket from submission to close.
2. What are your response and resolution targets by priority? Get the definitions in writing. “Response” often means an automated acknowledgment, not a technician working the issue.
3. Who will we actually talk to? Is there a named account manager or a dedicated team, or does every call go into a general queue?
4. What’s included in the monthly fee, and what’s billed separately? Projects, after-hours work, onsite visits, new user setups, and vendor coordination are common gray areas.
5. How do you handle after-hours emergencies?

About security

1. What security controls are included by default? Look for multi-factor authentication, endpoint detection and response (EDR), patch management, email filtering, and backup monitoring.
2. How do you secure your own access to our systems? Your MSP’s remote tools are a high-value target. Ask about MFA on their tools, least-privilege access, and how they log technician activity.
3. Do you test backups by actually restoring them? How often, and do we get a report?
4. What happens if we have a security incident? Do they have an incident response process, and is it included or billed hourly?

About strategy and reporting

1. How often will we meet to review our environment? Quarterly business reviews are common; ask what’s covered.
2. Do you provide a technology roadmap and budget forecast?
3. What reports will we receive, and what do they measure?
4. How do you document our environment, and who owns that documentation?

What “proactive” really means

Nearly every MSP describes itself as proactive. The word is meaningless unless it’s backed by specific, repeatable activities. Ask the provider to show you evidence of each:

• Monitoring with action. Alerts on disk space, failed backups, offline devices, and security events, plus a defined process for who responds and how fast.
• Patch management with reporting. A schedule for operating system and third-party application updates, with a report showing what’s patched and what isn’t.
• Lifecycle planning. Tracking warranty and end-of-support dates so hardware and software are replaced on a plan, not after they fail.
• Recurring reviews. Scheduled walk-throughs of user accounts, admin rights, firewall rules, and backup coverage.
• Root-cause follow-up. When the same issue shows up repeatedly, someone fixes the underlying cause instead of closing the same ticket again.

If a provider can’t show you a sample report or a sample review agenda, “proactive” is probably a marketing term.

Red flags

Watch for these during the sales process. Any one of them deserves a direct follow-up question.

• Vague scope. “Unlimited support” without a written definition of what’s covered.
• No documentation handoff. Reluctance to commit to giving you admin credentials, network diagrams, and configuration records if you leave.
• Long auto-renewing terms with steep exit penalties. Multi-year terms aren’t automatically bad, but a provider confident in its service usually doesn’t need to trap you.
• Shared admin accounts. Technicians logging in with one generic account means no accountability for who did what.
• No questions about your business. A provider that quotes a price without asking about your compliance obligations, applications, or growth plans isn’t planning to understand them later.
• Security as an upsell only. Basic controls like MFA and patching should be part of the baseline, not a premium add-on.
• Pressure to decide quickly. Good providers expect you to check references and compare options.

Contract terms to read carefully

Have someone read the master services agreement and statement of work line by line. Focus on:

• Term and renewal. Length of the initial term, whether it auto-renews, and how much notice you need to give.
• Termination rights. Can you exit for cause if service levels aren’t met? What does termination cost?
• Service level agreements. Response and resolution commitments by priority, how they’re measured, and what remedy you get if they’re missed.
• Scope definitions. What’s covered, what’s excluded, and how out-of-scope work is quoted and approved.
• Pricing changes. How and when the provider can raise rates, and how per-user or per-device counts are adjusted.
• Data and credential ownership. Explicit language that your data, documentation, passwords, and licenses belong to you.
• Offboarding obligations. What the provider must deliver, and how quickly, when the relationship ends.
• Liability and insurance. Limits of liability and whether the provider carries cyber and errors-and-omissions coverage.
• Subcontractors. Whether any work is outsourced, and to whom.

What good onboarding looks like

The first 30 to 90 days tell you a lot about the next few years. A well-run onboarding typically includes:

1. Discovery. Inventory of users, devices, applications, network equipment, licenses, and vendors.
2. Credential takeover. Collecting and securing admin access, rotating shared passwords, and removing accounts belonging to the previous provider.
3. Baseline security deployment. Monitoring agents, EDR, patching policies, and backup verification.
4. Documentation. Network diagrams, asset lists, and standard procedures written into a system you can access.
5. Findings report. A written summary of risks and recommended fixes, prioritized, with the provider’s honest view of what’s urgent.
6. Introduction to your team. Users should know how to request help and what to expect.

Expect some friction. Onboarding uncovers old problems. What matters is whether the provider communicates clearly and tells you what it found.

Scoring checklist

Use this checklist to compare providers side by side. Score each item 0 (no or unclear), 1 (partial), or 2 (yes, with evidence). Weight the sections that matter most to your business.

A few additional yes-or-no checks before you sign:

• We’ve spoken with at least two references the provider didn’t hand-pick at random
• We have a written list of everything included in the monthly fee
• The contract states we own our data, documentation, and credentials
• We understand exactly how to exit and what it costs
• We’ve met the people who will actually support us, not just the sales team

How we can help

We’ve helped businesses evaluate, switch, and onboard IT providers since 2005, and we’re happy to answer these same questions about ourselves. If you’re comparing options or unhappy with your current support, tell us a little about your environment and we’ll give you a straight assessment.