Choose a managed IT services provider by defining what your business needs protected and supported, then comparing each provider’s scope, service commitments, security practices, total costs, and exit terms. Do not assume that “managed IT” includes every system or security task: get the responsibilities and exclusions in writing before signing.
What does a managed IT services provider do?
A managed service provider (MSP) commonly monitors and manages IT infrastructure and end-user systems. The Canadian Centre for Cyber Security describes typical features such as monitoring, proactive maintenance, help-desk or network-operations support, and predictable billing. These are common characteristics, not a standard package. Your agreement should identify the specific systems, users, locations, and tasks covered.
As an Amazon Associate I earn from qualifying purchases.
Start by deciding what you need the provider to do—not by treating a proposal checklist as a substitute for your own requirements. As the UK National Cyber Security Centre (NCSC) puts it, “A reputable MSP should clearly articulate the services, policies, and responsibilities they offer.”
What should you define before requesting proposals?
Write down the operational needs and risks a provider must address. Security requirements should reflect the sensitivity and potential impact of your data; a provider cannot determine your business priorities on your behalf.
#1 Best Overall
- Critical operations: Which services, applications, and devices must remain available? What downtime can each tolerate?
- Data and recovery: What sensitive data do you hold, where is it stored, and how much data loss could you tolerate after an incident?
- Environment: List endpoints, networks, cloud services, identity systems, backups, third-party applications, locations, and user groups.
- Responsibilities: Which tasks will your staff retain, and which do you expect the MSP to perform? Identify other vendors the MSP may need to coordinate with.
- Obligations: Note applicable regulatory requirements, contractual commitments, and customer expectations. The details depend on your jurisdiction and industry.
This inventory gives each bidder the same starting point and makes it easier to spot gaps or assumptions.
How can you compare proposals on the same basis?
Ask every provider to answer the same questions in writing. Make unclear wording—such as “support included” or “backups managed”—specific before comparing offers.
| Area | Questions to ask |
|---|---|
| Scope | Which users, locations, devices, networks, cloud services, and applications are covered? What is explicitly excluded? |
| Technical and security tasks | Are patching, identity administration, backup monitoring, security monitoring, and incident response included? Which third-party applications are supported? |
| Availability | What hours and locations are covered? How do after-hours requests and on-site visits work? |
| Performance | How are requests prioritized? What are the response, investigation, and resolution commitments? What reporting and escalation are provided? |
| Ownership | Who performs each task, supplies required information, approves changes, and coordinates with other vendors? |
| Charges | What is included in the recurring fee, and what costs extra—including onboarding, remediation, extra users, overages, hardware or software, and exit support? |
| Fit | What relevant experience and references can the provider share? How will it adapt to your environment and communicate with your team? |
For example, GOV.UK’s guide for adult social-care providers in England flags after-hours and on-site work, added users, and work beyond a monthly allowance as possible extras. These are prompts to check, not universal MSP pricing rules.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What should an MSP service-level agreement promise?
An SLA should describe measurable commitments, not just use words such as “prompt” or “high priority.” Separate the time to acknowledge a request or start investigating it from the time to resolve the underlying problem or provide a workaround. A guaranteed fix time may be difficult because the work required can be unpredictable; a response commitment is more common.
The NCSC offers illustrative starting points: a response within one business day for general requests or minor issues, under one hour for urgent issues, and resolution within two to three business days for routine medium-priority issues. These are guidance examples, not industry averages, mandatory standards, or a guarantee that a particular provider can meet them. The NCSC also cautions that faster response can affect contract costs.
For each service commitment, agree on:
- Severity levels and the criteria for assigning them.
- When the clock starts and stops, including how customer delays or dependencies affect measurement.
- Covered service hours, escalation routes, and who receives status updates.
- Reporting cadence and the measures used to assess performance.
- Any service credits or other remedies, plus the circumstances that exclude a commitment.
How should you assess security and privacy?
An MSP may need administrative access to your systems and data. That access—and the consequences if the provider is compromised—should be treated as a material risk in your selection and contract. Ask how provider personnel authenticate, how credentials are protected, and how access is limited, logged, and reviewed.
- How does the provider apply least privilege and two-step verification to administrative access?
- How are credentials stored, rotated, and removed when personnel or the relationship changes?
- How does it separate, retain, protect, and ultimately delete customer data?
- Which subcontractors can access systems or data, and how are they managed?
- How and when will the provider notify you about a suspected or confirmed security incident?
- What evidence of security practices, assurance, and relevant references can it provide?
Certifications or other assurance evidence can inform your assessment, but they do not establish that the specific service will be configured safely for your environment. Ask how the stated controls apply to the access and services you are buying. The NCSC recommends least privilege and two-step verification for MSP access.
Who is responsible during an incident?
Outsourcing operational work does not remove your organization’s accountability for incident response. The Canadian Centre for Cyber Security says, “Your organization and the MSP both have roles when it comes to protecting systems and data.” Document those roles before an incident occurs.
Your incident plan should identify:
- What counts as an incident and who leads the response.
- Who contacts whom, by which route, and what initial facts should be shared.
- Expected notification and response timing, escalation paths, and coordination with other vendors.
- Who handles containment, recovery, communications, and post-incident reporting.
- Whether the MSP will participate in exercises or simulations.
Define backup and disaster-recovery duties separately from routine help-desk support. Agree on recovery priorities and tolerable downtime and data loss; the phrase “backups included” alone does not establish that complete recovery is covered or tested.
What should the contract cover before you sign?
Review the service description and commercial terms together. Make sure responsibilities, exclusions, and charges align across the proposal, SLA, security terms, and contract.
- Term and renewal: Record the contract duration, renewal process, renegotiation points, notice periods, and termination rights.
- Costs: Identify recurring fees and charges for onboarding, remediation, after-hours or on-site work, additional users, overages, software or hardware, and transition assistance.
- Data and records: Specify what documentation and logs you can access, how your data will be returned or deleted, and how deletion will be confirmed if required.
- Liability and assurance: Review responsibility for security, incident handling, subcontractors, liability, and insurance in light of your own requirements.
- Exit and continuity: Define transition cooperation, access revocation, handover materials, and whether an overlap with a replacement provider is needed.
For readers in the UK, the NCSC provides general MSP selection guidance, while GOV.UK’s concrete examples on terms and charges are specifically aimed at adult social-care providers in England. Check the rules and obligations that apply to your own location and sector rather than treating that sector-specific guide as universal legal advice.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow should onboarding and handover work?
Agree on the onboarding plan, named owners, sequence, and cost before the provider starts. Common onboarding actions include removing the previous MSP’s access, installing support tools, documenting systems, changing passwords, assessing security, and contacting other suppliers. Decide who performs each action and whether any remediation will be charged separately.
Best Value
Build the exit process at the same time. Specify how the MSP will cooperate with a replacement, provide documentation and logs, return or delete data, revoke its own access, and support any required transition overlap. A workable handover plan reduces the risk of losing operational knowledge when the relationship ends.
How do you make the final decision?
Compare providers against your documented priorities rather than choosing on headline price or a broad service label. A proposal that is cheaper on paper may leave important systems, security tasks, or after-hours needs outside scope.
Quick Recap
- Use one inventory and requirements document for every bidder.
- Mark each service as included, excluded, conditional, or unclear; resolve unclear items in writing.
- Compare SLA definitions, security controls, incident responsibilities, and reporting against your risk tolerance.
- Calculate the expected total cost using the recurring fee plus likely onboarding, extra-work, and exit charges.
- Check references and relevant experience, then verify that the proposed contract supports a practical handover.
- Do not sign until scope, ownership, incident notification, data handling, and termination arrangements are clear.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
