Free tools Windows power users keep installed
One-click scans. No signup required.
Audit your IT support before comparing providers: define the business outcomes you need, document what support covers now, and measure service performance and cost. Then set requirements for coverage, security, continuity, and accountability so you can compare internal, co-managed, and outsourced options against the same baseline.
Start with business needs, not a provider’s checklist
Support is adequate when it enables the work your organization depends on at an acceptable level of risk and cost. A generic list of services cannot tell you whether your current arrangement—or a prospective provider—fits your business.
As an Amazon Associate I earn from qualifying purchases.
Ask business leaders which outcomes IT must support: dependable customer-facing services, employee productivity, secure access, compliance obligations, rapid recovery, or predictable costs. Identify critical workflows and what disruption would mean for customers, staff, revenue, or obligations. Turn each priority into a requirement you can evaluate, such as hours of coverage, supported locations and systems, escalation paths, security responsibilities, or recovery expectations.
Assessment should reflect the size, type, complexity, cost, and criticality of your organization’s services. Federal Reserve supervisory guidance also identifies service fit, user assistance, capacity and performance monitoring, security, contingency planning, privacy, and service-level performance as relevant assessment dimensions (Federal Reserve guidance).
#1 Best Overall
Document what support covers today
Build a practical inventory of the environment and the people who support it. This worksheet is a way to make the current state visible; it is not a specific inventory mandated by NIST.
- People and places: users, sites, remote work arrangements, and internal IT roles.
- Technology: devices, networks, business applications, cloud services, and external vendors.
- Responsibilities: who handles help-desk requests, endpoint management, access administration, backups, security monitoring, projects, vendor coordination, and after-hours events.
- Unowned or informal work: systems with no clear owner, recurring tasks handled by whoever is available, and support that depends on undocumented knowledge.
For each service, note who performs it, which users or systems it covers, when it is available, and where responsibility is unclear. NIST’s service-selection guidance emphasizes assessing the current environment and defining requirements; CISA likewise recommends clear boundaries between operational IT and security services (NIST SP 800-35; CISA MSP guidance).
Measure current service and cost
Use service desk records and operational reports to establish a baseline. NIST SP 800-35 specifically describes using metrics and total cost of ownership to assess current service level and cost. Collect what is available, record the period covered, and note gaps or inconsistent definitions.
Recommended Free Tools
- Ticket volumes by category and severity
- Acknowledgment and resolution times
- Open-ticket backlog, repeat incidents, and escalations
- After-hours demand and outages
- Backup and restore performance, where recorded
- User feedback and recurring service complaints
- Current costs, including staff time, contracts, tools, and relevant overhead
Compare the evidence with the business outcomes identified earlier. Averages can conceal problems, so inspect high-impact incidents and recurring issues as well as overall trends. Record what the data cannot show—for example, undocumented work or missing timestamps—and avoid treating an incomplete log as proof that a service is unnecessary.
There is no universal response-time target or support budget that fits every organization. Set thresholds according to business criticality, work patterns, risk, and contractual needs. NIST’s guidance provides assessment dimensions rather than a one-size-fits-all acceptability threshold (NIST SP 800-35 PDF).
Define the scope and coverage you need
Write down which services belong in scope and which do not. Depending on your environment, consider help desk, device and network administration, identity and access, cloud and application support, vendor coordination, backup and recovery, security monitoring, onsite work, and after-hours support.
Rank #3
For each service, specify the covered users, systems, and locations; service hours; severity definitions; response targets; escalation and communication expectations; and who owns resolution. Distinguish acknowledgment from resolution: a provider may be able to confirm receipt quickly without being able to restore a complex service within the same period.
CISA recommends specific, performance-related service levels and a clear distinction between operational IT services and security services. A proposal that says “24/7 support” is not comparable to another until you know which services are covered, what counts as an incident, and what response or escalation is promised (CISA MSP guidance).
Set security, privacy, and continuity requirements
Before sharing system access or sensitive information with a provider, document what protection and visibility your organization needs. Base the requirements on your risk, the information involved, and applicable sector obligations.
- Which systems and information the provider may access, and at what privilege level
- How access is approved, reviewed, and removed
- Incident notification and coordination expectations
- Customer access to relevant security logs or telemetry
- Data handling, separation, retention, and deletion expectations
- Use and oversight of subcontractors
- Backup ownership, recovery responsibilities, and continuity if the provider has an outage
- What evidence of security controls or independent assessments you need
CISA’s MSP guidance calls for clarity about incident management, outage support, remediation acceptance, and customer access to security logging or telemetry. Outsourcing a task does not transfer away your organization’s responsibility to protect its business and customer information; record which duties the provider performs and which remain yours (CISA MSP guidance; NIST small-business guidance).
For covered entities and business associates handling protected health information, HHS explains that HIPAA requires satisfactory assurances through a business associate agreement. In the cloud-service-provider FAQ context, HHS says HIPAA does not expressly require the provider to supply security-practice documentation or permit audits; customers may seek additional assurances by agreement based on risk analysis and other compliance activities. Identify the rules that apply to your own sector and geography rather than treating this example as universal (HHS HIPAA FAQ).
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Compare internal, co-managed, and outsourced support
Use the same requirements to compare delivery models. Outsourcing is not automatically an upgrade: an external provider may add coverage or specialist capability, while an internal team may know the business context better. A co-managed arrangement can divide duties, but only if the boundary and escalation process are explicit.
| Delivery model | Questions to test against your requirements |
|---|---|
| Internal team | Can current staffing cover the required hours, specialist skills, resilience, and workload? What are the costs of staffing, tools, and retained expertise? |
| Co-managed support | Which tasks stay internal and which go to the provider? Are handoffs, permissions, escalation, and accountability clear enough to avoid gaps or duplicated work? |
| Outsourced support | Does the provider cover the needed systems, locations, and hours? How will it preserve business context, provide visibility, and support continuity and exit? |
Compare total cost of ownership, not only the quoted recurring fee. Include transition and exit costs, retained internal oversight, software or pass-through charges, and after-hours coverage where relevant. NIST frames provider selection as assessing the current environment and business case for viable alternatives; its small-business guidance notes that outsourcing is common for cybersecurity while emphasizing clear outcomes and provider fit (NIST SP 800-35; NIST small-business guidance).
Evaluate proposals against the same criteria
Write evaluation criteria before requesting quotes. Give each proposal the same scope and requirements, then identify assumptions, exclusions, and areas where the vendor has not made a commitment. NIST SP 800-35 advises organizations to set criteria, solicit proposals, and assess providers against those criteria (NIST SP 800-35 PDF).
- Relevant industry experience and work with organizations of similar size
- Staffing, technical coverage, escalation, and support locations
- Services and systems covered, including explicit exclusions
- Security practices, incident handling, continuity, and subcontractor use
- Reporting, customer visibility, references, and how requirements will be met
- Full recurring and transition costs, scalability, and exit arrangements
Compare equivalent scopes rather than headline prices. If one proposal excludes after-hours incidents, security monitoring, or backup recovery while another includes them, those offers are not equivalent. A low price by itself does not establish that a provider meets your requirements.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsPut the audit into the agreement
Convert the accepted requirements into a service description and measurable commitments. Before signing, make sure the agreement explains:
- Services, users, systems, locations, coverage hours, and service-level measures
- Roles and responsibilities, including security and customer-retained duties
- Incident reporting, escalation, communication, and remediation expectations
- Support during provider outages and continuity arrangements
- Reporting and customer access to relevant logs or telemetry
- Data handling, subcontractor responsibilities, and any required evidence of controls
- Transition arrangements, access revocation, and return or deletion of data at exit
Have legal and procurement reviewers assess the terms for your circumstances. CISA recommends a shared-responsibility model and detailed pre-contract information; exact contract provisions depend on the organization and its obligations (CISA MSP guidance).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
