21 Oct How to Evaluate Managed IT Providers: A Practical Guide
Table of Contents
- Start With a Managed IT Services Checklist
- Build Your Managed Service Provider Evaluation Criteria
- Questions to Ask a Managed Service Provider Before You Sign
- Check the MSP Service-Level Agreement Line by Line
- Security Due Diligence in Operational Detail
- Measure Ongoing MSP Performance
- Plan the Transition and Onboarding
- Frequently Asked Questions
Last Updated: October 20, 2026
Start With a Managed IT Services Checklist
Most businesses start evaluating managed IT providers by comparing price. That is the wrong first move. Price means nothing until you know what you are actually buying, and a cheap monthly fee that excludes backup, security or onsite visits is not cheap at all.
A managed IT services checklist is a simple written list of everything you expect a provider to cover before you request a single quote. At PCFIXIT, we have used this approach with professional services firms, and it consistently separates real managed service providers from resellers who simply forward support tickets.
What Belongs on the Checklist
Your checklist should cover six areas:
- Help desk and response times – hours of cover, how to log a job, expected first response
- Proactive monitoring – what gets watched, how often, and who acts on alerts
- Backup and recovery – what is backed up, how often, and how fast it can be restored
- Cybersecurity – endpoint protection, patching, email security and staff awareness training
Write your checklist before you speak to anyone. It keeps the conversation on your terms.
Ask every provider to mark each checklist item as “included”, “extra cost” or “not offered”. The gaps tell you more than the sales pitch ever will.
Build Your Managed Service Provider Evaluation Criteria
Scoring providers on gut feel is how businesses end up switching again two years later. Managed service provider evaluation criteria need to be written down, weighted and scored the same way for every provider you shortlist.
The four broad areas worth assessing are technical capability, security maturity, business fit and commercial terms. Weight them according to what actually matters to your firm.
A Weighted Scoring Rubric You Can Copy
Score each provider from 1 to 5 on each row, multiply by the weight, then add the totals. The highest score wins, and the reasoning stays visible.
| Criteria | Weight | What a 5 Looks Like |
|---|---|---|
| Service scope and SLA clarity | 25% | Written scope, defined response and resolution times |
| Cybersecurity capability | 25% | Essential Eight alignment, documented incident response |
| Technical expertise and certifications | 20% | Certified engineers, current vendor partnerships |
| Industry and size experience | 15% | Existing clients of similar size and sector |
| Communication and reporting | 10% | Regular service reports, named account contact |
| Value and total cost of ownership | 5% | Full cost disclosed, no hidden extras |
The weighting matters more than the scores. A firm handling sensitive client data should push cybersecurity and scope higher. A business with remote staff should weight communication and responsiveness more heavily.
Questions to Ask a Managed Service Provider Before You Sign
The best questions to ask a managed service provider are the ones that force specific answers rather than reassurances. “We’re very responsive” is not an answer.
Work through these in the meeting:
- What exactly is included in the monthly fee, and what costs extra?
- What are your response and resolution targets, and how do you report against them?
- How do you handle after-hours emergencies?
- What happens if we need someone onsite?
- Which security frameworks do you follow, and can you show us how?
- Can we speak to two clients of a similar size and industry?
- What is your onboarding process, and how long does it take?
- How do we exit if the relationship does not work?
Question six matters more than most. A provider who hesitates to give references is telling you something. Ask those references how quickly issues were resolved, not whether they like the provider.
Check the MSP Service-Level Agreement Line by Line
An MSP service-level agreement is the document that decides what happens when things go wrong. Read it before you sign, not after.
Treat the SLA as four separate contracts stacked together: the service targets, the exclusions, the commercial terms, and the exit terms. Providers often negotiate hard on the first and leave the other three untouched, which is where the risk sits.
Read the Service Targets Properly
Response time and resolution time are different promises and must be measured separately. Response time is how fast someone acknowledges the job. Resolution time is how fast it is fixed.
For each target, check four things:
- The clock start point, does it begin when you log the ticket, when it is triaged, or when an engineer is assigned? A target that starts at assignment can hide hours of queue time.
- The coverage window, is the target measured during business hours only, or 24/7? A 15-minute response target that only applies 9am to 5pm is a very different promise from one that applies around the clock.
- The priority definitions, who decides whether an issue is P1 or P3, and can you challenge the classification? Vague priority matrices let providers downgrade inconvenient tickets.
- The measurement and reporting, is performance reported against the target monthly, and do you have the right to audit the underlying ticket data?
A common pattern is a headline response target that looks strong, paired with a resolution target measured only from the point an engineer is assigned and excluding time waiting on you or a third-party vendor.
Interrogate the Exclusions
Exclusions are where quotes become incomparable. The monthly fee is only meaningful once you know what sits outside it. Look specifically for:
- Backup, disaster recovery and restore testing listed as project work
- Cybersecurity tooling, licences or incident response charged separately
- Onsite attendance, after-hours cover and travel
- Major projects, migrations and new-starter setups
Ask the provider to mark every exclusion with an indicative cost or a rate card. An exclusion with no price attached is a future dispute.
Request Your IT & Security Review →
Check the Commercial Terms
- Price increase clauses, is there a cap, an index, or an open-ended right to increase on notice? Uncapped annual uplifts compound quietly.
- Auto-renewal, what is the notice period to stop renewal, and is it measured in weeks or months? Long notice periods paired with auto-renewal are a lock-in mechanism.
- Liability, is liability capped at fees paid, and are consequential losses excluded? Understand what you are accepting before you sign.
- Termination rights, can you terminate for cause, for repeated SLA misses, or for convenience, and what notice applies?
Nail Down Exit and Ownership
Exit terms are the most commonly skipped and most expensive to discover late. The contract should state, in writing:
- That all accounts, licences, domains and data remain in your name and under your control
- That admin credentials and documentation are handed over on termination within a defined period
- That the provider will cooperate with a transition to a new provider or internal team
- What happens to tooling the provider supplies, is it removed, transferred, or bought out?
If the contract does not state who owns your Microsoft 365 tenant and admin credentials, assume you do not. Insist on written confirmation that all accounts, licences and data stay in your name, and that handover of documentation and access is a defined obligation, not a favour.
Security Due Diligence in Operational Detail
Security claims are easy to make and hard to verify. Ask for operational detail, not marketing language.
The difference between a mature provider and a confident one is evidence. For every claim, ask a follow-up question that can only be answered with a document, a screenshot, a log or a demonstration. If the answer is another reassurance, note it and move on.
Translate Claims into Verifiable Checks
Work through each area and ask for the artefact, not the assurance:
- Patching, ask for the patch policy with defined timeframes by severity, and a sample compliance report showing endpoints behind schedule. A provider that cannot produce a compliance report is not measuring patching.
- Multi-factor authentication, ask which systems enforce MFA, whether it is enforced on all admin accounts, and how exceptions are approved and reviewed. Ask to see the conditional access or MFA policy configuration.
- Access controls, ask how admin rights are granted, whether day-to-day accounts are separate from admin accounts, and how access is removed when staff leave. Request the joiner-mover-leaver process.
- Email security, ask how filtering is configured, whether DMARC is enforced, and how phishing simulation results are reported to you.
Read the Gaps, Not Just the Answers
A provider that answers most questions well and is honest about one gap is usually stronger than one that claims everything is covered. Common honest gaps include restore testing that is scheduled but not yet performed, or a phishing program that is in rollout. Common red flags include:
- Security reporting that is a dashboard screenshot with no interpretation
- No named person accountable for security
- Incident response described only as “we would escalate to the vendor”
- Backup described as “in the cloud” with no restore testing evidence
Ask each shortlisted provider to walk you through one real (anonymised) security incident: what happened, how it was detected, who was notified, and what changed afterwards. The quality of that story tells you more than any certification list.
A provider that cannot answer these in plain English, or produce evidence for the operational ones, is either not doing the work or not tracking it. Either answer is a problem.
Measure Ongoing MSP Performance
Selection is not the finish line. Track performance monthly using the same metrics the SLA promises. Ask for a service report covering tickets logged, average response time, average resolution time, uptime, and any security incidents.
Set a review meeting every quarter. Bring two questions: what broke, and what changed to stop it breaking again. Providers who cannot answer both are coasting.
Track these numbers:
- Tickets logged versus resolved within SLA
- Repeat issues on the same device or user
- Backup success rate
- Patching compliance across endpoints
If the numbers drift for two quarters, escalate. Do not wait for the annual review.
Plan the Transition and Onboarding
A poor handover is the most common reason a new provider relationship starts badly. Plan it before you sign.
The plan should cover:
- Discovery of all devices, accounts and software
- Transfer of admin access and licence ownership
- Documentation of your network and key systems
- A defined stabilisation period with extra support
- A first review meeting within the first month
Expect the transition to take a few weeks for a small business. Anyone promising a same-day switch is either oversimplifying or planning to skip discovery.
The strongest signal of a good provider is not the sales meeting. It is whether they arrive with a written onboarding plan before you have signed anything.
Choosing an IT partner is a decision about risk, not just cost. Get the checklist, rubric and contract right, and the rest follows.
Frequently Asked Questions
What should a small business look for in a managed IT provider?
Look for a provider that can explain its service scope in plain English, shows documented response and resolution targets, and can evidence security practices such as multi-factor authentication, endpoint management and tested backups. Ask about experience with businesses your size and industry, and request references you can actually call. A managed IT services checklist covering scope, security, reporting and exit terms will help you compare managed IT providers on the same basis rather than on sales presentation quality.
What questions should you ask a managed service provider before hiring them?
Ask what is included in the monthly fee and what is billed separately, how tickets are logged and escalated, and what the guaranteed response time is for critical outages. Ask who owns the administrator accounts and how access is handed back if you leave. Also ask how they report on performance, how they handle patching and backup testing, and whether they align with frameworks such as the ASD Essential Eight or SMB1001. Their answers should be specific and written into the contract.
How can you assess an MSP’s cybersecurity capabilities?
Ask for operational detail rather than certifications alone. Find out how multi-factor authentication is enforced across Microsoft 365, how endpoints are patched and how quickly, how backups are tested and how long recovery takes, and what happens during an incident. Confirm how they align with the ASD Essential Eight and whether they follow SMB1001 guidance. A provider that can walk you through a real incident response scenario is generally safer than one that only lists badges on a website.
What should an MSP service-level agreement include?
An MSP service-level agreement should define the services covered, response and resolution targets by severity level, support hours, escalation paths, reporting frequency and the remedies available if targets are missed. It should also cover data ownership, exit and handover obligations, and how changes to scope are priced. Read the exclusions carefully: vague terms like reasonable efforts, unlimited support or best endeavours weaken accountability and are worth challenging before you sign.
No Comments