Selecting the right technology partner is a critical decision for any
organization. To choose a managed service provider (MSP), first define
which IT responsibilities you need the provider to own. Then compare the
candidates on their service scope, team depth, and references, paying
attention to specific criteria like support and escalation, cybersecurity,
business continuity, onboarding, pricing, contract terms, and reporting.
Finally, always verify as much as possible: Ask for evidence behind each
claim.
While most MSPs offer similar technology stacks, the true differentiator
lies in how they structure their operations and take accountability for
your environment. Whether your organization needs support for your
internal IT team or comprehensive outsourced managed IT services, a
rigorous MSP evaluation requires a standardized approach.
To navigate this process objectively and secure your ideal strategic
partner, apply this practical evaluation framework:
MSP selection in 5 steps
- Define what you need:
Document your current infrastructure gaps, security requirements, and
operational objectives. - Compare service models:
Determine whether your organization needs co-managed IT or fully
outsourced management. - Evaluate providers against the same criteria:
Standardize your baseline requirements for response times, scalability,
and proactive strategy. - Verify claims:
Request documented procedures, compliance certifications, and proof of
technical methodologies. - Review the agreement and references:
Thoroughly analyze the service level agreement (SLA) and consult current
client references.
Start by deciding what you need the MSP to own
To define what you will actually hand over to an MSP, it is crucial to map out specific operational responsibilities. To establish this clear baseline for your evaluations, inventory your organization’s current technology needs across these four core functional areas:
Once you have inventoried these responsibilities, you can accurately determine the service model your business requires. Do you need a provider to assume full ownership through a fully managed IT plan? Do you have an internal IT team needing targeted assistance through co-managed IT? Or do you simply need project-only IT consulting? Defining these boundaries upfront helps ensure a precise MSP partnership fit.
How to evaluate a managed service provider: 10 criteria
When comparing providers, it’s essential to judge each candidate by the same standards. The following 10 MSP evaluation criteria will help you accurately assess your shortlisted technology partners.
1. Service scope and accountability
The first step in evaluating an MSP is establishing exactly what they will do for your organization. You need clarity on what is included in your monthly fee versus what gets billed separately. For instance, define how routine recurring services are separated from complex implementations or hardware projects.
Accountability is equally critical: determine who takes responsibility for recurring network problems, who handles communication with third-party vendors, and who communicates technology strategy to your leadership. Clarify whether the MSP is taking full, end-to-end responsibility for operational outcomes or partial responsibility alongside your internal team.
Beware of providers who repeatedly promise we can do that
to every question without providing a written, itemized scope of work detailing exactly how those services are delivered.
2. Support coverage, response, and escalation
When systems fail, you need to know exactly when and how your MSP will respond. They need to explain their internal escalation process for problems that the help desk cannot solve. Define their standard business hours and their protocol for after-hours emergencies or critical incidents. Ask when they resolve issues remotely versus when they dispatch someone on site.
It is essential to understand their differing response types: An automated acknowledgment merely means a ticket was created; a human response means a technician has reviewed the issue and reached out; and resolution means the problem has been fixed. Be skeptical of sweeping response-time claims (guaranteed 15-minute response
) that lack clear definitions of acknowledgment versus actual technical resolution.
3. Team depth and continuity
An MSP’s capability is directly tied to the personnel they employ. Ask about the total number and types of technicians on staff, and what specialists they have for networking, cloud infrastructure, and cybersecurity. Clarify whether they rely solely on remote support or if they have dedicated on-site resources when physical intervention is required.
Staff turnover at your MSP can severely impact their service quality, so ask about their employee retention rates. When a primary engineer is unavailable, robust internal documentation and backup coverage are necessary so a new technician isn’t starting from scratch. Finally, confirm whether they use a 100% in-house team or a contractor model, which can sometimes degrade service consistency.
4. Cybersecurity and the MSP’s own security
Your IT provider holds the keys to your entire network, making their internal security posture just as important as yours. Ask how they manage privileged access to your systems and whether they enforce multifactor authentication (MFA) across all administrative tools. They should apply secure remote administration practices, active endpoint protection, security monitoring, and comprehensive logging internally.
Check if they have designated security roles on staff or relevant industry certifications. Furthermore, ask about their incident communication protocol if their own systems experience a breach.
Note: The Cybersecurity and Infrastructure Security Agency (CISA) treats MSP security as shared provider/customer risk and recommends contractually addressing controls including MFA, monitoring, and secure access.
5. Backup, disaster recovery, and continuity
A robust backup system not only prevents data loss but also helps ensure your organization can continue to operate after a technical failure or cyberattack. Be wary if a provider claims we back up everything,
or that your data is protected by cloud storage providers like Microsoft or Amazon, as your data may not be recoverable when you actually need it.
Do not just ask a candidate MSP if they run backups; ask who actively monitors them and how frequently they perform restore testing. Defining recovery responsibility is vital: If a server crashes, who rebuilds it?
Discuss their strategies for ransomware resilience and what specifically will happen during a widespread infrastructure outage. If applicable, establish clear recovery time objectives (RTOs) so you know how long it will take your business to return to operations.
6. Onboarding and documentation
The transition to a new MSP should be a highly structured process with well-established SOPs. Onboarding should begin with thorough technical discovery, hardware inventory, and the secure gathering of all administrative credentials. The MSP should create extensive environment documentation and establish a clear security baseline before taking over daily management.
This phase should also include user communication and training, so your staff knows how to submit requests, followed by remediation of pre-existing issues and a formal handoff meeting.
7. Pricing, exclusions, and contract terms
Pricing transparency is essential for a successful long-term IT service partnership. Determine if the MSP’s fee structure is based on a per-user, per-device, or per-site model, and how it will impact your IT budget and ROI. Review exactly what is included in the monthly rate and what constitutes an out-of-scope project charge or an additional on-site fee.
Ask if there are monthly billing minimums or contractual provisions for unexpected price changes. Scrutinize the contract’s term length, the terms for automatic renewal, and the cancellation clauses. Crucially, verify what transition assistance they provide if you decide to end the partnership.
For a detailed breakdown of budget expectations, review our small business IT support pricing guide or go directly to our Pricing Calculator.
8. Reporting and ongoing accountability
A true technology partner proves their value continuously, not just when called upon to fix something when it breaks. You should expect transparent reporting on proactive security, asset life cycle management, and collaborative budget planning for future technology investments. Ask what metrics they include in their regular service reports and how they identify and permanently resolve recurring issues (rather than applying temporary fixes). Also, ask if they conduct quarterly or semi-annual business reviews, and how action items and ownership are tracked from those meetings.
9. Industry and operational fit
Every sector has unique technology demands, and your MSP needs to know your operational environment. Evaluate their familiarity with your industry-specific software platforms, databases, and security or compliance frameworks. They need a deep understanding of your internal workflows to support you effectively. For example, if you are a nonprofit, they should understand budget constraints and technology discount programs; if you are in manufacturing, they should appreciate the cost of unexpected downtime on the production line.
Industry specialization matters more in some environments than others. Ask the candidate to provide examples of how they accommodate the unique workflows, regulatory constraints, and operational speeds of businesses similar to yours.
10. References, evidence, and proof
Finally, never skip the verification stage. Request a list of recent reference clients, specifically asking for organizations of a similar size or industry and using a similar support model. Review the MSP’s published case studies, check their average customer and employee tenure to gauge long-term satisfaction, and look for independent reviews.
When you contact their references, move past generic praise and ask these three specific questions:
- What happens when something goes wrong or a major incident occurs?
- Has service quality or responsiveness changed since you initially signed the contract?
- What does the MSP do proactively, beyond just resolving help desk tickets?
MSP evaluation checklist: Questions to ask every provider before you sign
After defining your internal requirements and familiarizing yourself with the
standard evaluation criteria, it is time to interview your shortlisted
candidates. The following interview questions are categorized according to
the 10 criteria established above.
Use this checklist to bypass sales rhetoric and uncover how each candidate
MSP really functions. Click here for a downloadable version.
1. Service scope and accountability
- ☐ What exactly will your team own, and what isn’t included? Can we see an example itemized service plan or SOW?
- ☐ Do you provide virtual CIO consulting to help us align our IT budget with our business goals?
- ☐ Please describe your processes for Microsoft 365 administration and how you can help us use it more effectively.
2. Support coverage, response, and escalation
- ☐ How do you measure first response, escalation, and resolution? Can we see an anonymized example SLA?
- ☐ How do you determine when an issue requires an on-site engineer, and is that dispatch included in our flat rate?
- ☐ Who owns the communication and escalation process with third-party software vendors?
3. Team depth and continuity
- ☐ Are your support technicians in-house, or do you outsource to a third party?
- ☐ What engineers do you have on staff dedicated to cloud infrastructure and network architecture?
- ☐ Who else is familiar with our environment if our primary contact becomes unavailable?
4. Cybersecurity and the MSP’s own security
- ☐ Do you have dedicated security personnel on staff holding relevant industry certifications, or is security handled by the general help desk?
- ☐ What mandatory security controls (such as MFA) do you require of your team before they can access our network?
- ☐ If your company suffers a cyberattack, what is your disclosure and containment protocol for your clients?
5. Backup, disaster recovery, and continuity
- ☐ How frequently do you conduct full server restoration tests to prove our data is recoverable? Can we see recent example restore-test evidence?
- ☐ In the event of a server crash, who is responsible for rebuilding it?
- ☐ Describe your strategies for protecting our data and operations from a ransomware attack.
6. Onboarding and documentation
- ☐ What specific milestones define your onboarding process? Do you schedule technical discovery, credential handoffs, and staff training?
- ☐ Can we see your sample onboarding SOW and/or questionnaire documents?
- ☐ What is your procedure for securely onboarding and offboarding employees?
7. Pricing, exclusions, and contract terms
- ☐ Is your fee structure based on a per-user, per-device, or per-site model?
- ☐ Please state any minimums for billing or contract term length and any requirements for automatic renewal.
- ☐ If we choose to terminate this partnership, what documented transition assistance will you provide to our next IT team?
8. Reporting and ongoing accountability
- ☐ How will we know six months from now whether you are performing well? What reporting will we receive? Can we see an anonymized example?
- ☐ Can you give an example of how you identify the root cause of a recurring network issue rather than just resetting the device?
- ☐ Describe your protocols for our hardware and other asset life cycle management.
9. Industry and operational fit
- ☐ What experience do you have in our industry? Can you provide examples of digital tools and workflows for businesses similar to ours?
- ☐ What proactive measures do you take to ensure our systems comply with the specific regulatory frameworks required by our industry?
- ☐ Can you provide a client case study and reference from our industry?
10. References and proof
- ☐ When speaking to your references, how will they answer when I ask what happens during a major IT crisis?
- ☐ How will they describe what you do proactively beyond just resolving help desk tickets?
- ☐ What industry awards or accreditations for service quality has your MSP received?
Now you have a list of questions to identify high-quality MSPs. To make your
selection process even easier, the next section covers how to identify
low-quality MSPs and their common shortcomings.
Managed service provider red flags
MSP sales presentations can obscure fundamental operational flaws, and
these may not be obvious to nontechnical decision-makers.
As you evaluate proposals and interview candidates, pay close attention to
what a provider avoids answering or refuses to document in writing. Any of
the following indications should prompt you to disqualify a potential
technology partner.
Warning signs of a bad-fit MSP:
|
|
Does your MSP need to be local?
While remote support tools have advanced significantly, a local presence remains critical if your operations rely on physical infrastructure. If your organization maintains on-premises servers and other physical devices, you need an MSP capable of rapid, in-person troubleshooting. Local providers also offer distinct advantages for hands-on requirements such as office moves, network cabling, physical security, and recurring on-site work.
Even organizations with cloud-based environments still face complex administration across serverless infrastructure and SaaS applications. If your MSP isn’t local, these challenges can become more difficult with geographical separation or time zone differences. And employee desktops, laptops, and other devices still require management, which is problematic or impossible from afar.
Beyond pure technical capabilities, a local partner also offers a level of personal, face-to-face accountability that out-of-state or offshore providers simply cannot replicate. If a local partnership matters to you, here are some additional questions to ask a potential MSP candidate:
- Where are your on-site technicians based?
- Are they employees or subcontractors?
- What geographical areas do they cover?
- Is on-site support included in our plan?
- What is your dispatch process?
Evaluating MSPs in Seattle? Apply the same criteria to Fidelis.
Fidelis recommends asking all the same questions when evaluating us. Check out our fully managed or co-managed IT services and online pricing calculator to get an idea of how we can help your business or nonprofit, then use the link below to book a call and put our claims to the test.
Serving the Seattle region since 2008
Fully managed + co-managed plans
Local on-site + remote support
28-member Renton-based team
Average employee tenure: 8 years
Frequently asked questions about choosing an MSP
How many managed service providers should I compare?
Should I choose a large MSP or a smaller local provider?
The right choice depends on your organization’s operational complexity and cultural preferences.
Large, national MSPs typically offer deep engineering benches, highly specialized talent, and true 24/7/365 support, but their service can sometimes feel rigid, heavily ticket-driven, or impersonal. Smaller, one-person or small-team providers excel at delivering personalized, highly responsive service and strong local accountability, often functioning as a seamless extension of your internal team.
For most businesses, a mid-sized MSP offers the optimal balance: engineering depth to handle complex infrastructure and security, combined with the personalized, face-to-face service of a local partner.
What should be included in an MSP contract?
A managed services agreement has to clearly define the operational and financial boundaries of your partnership. Essential inclusions are:
- A detailed SLA: Clearly defined metrics for guaranteed response and resolution times based on issue severity
- An explicit scope of work (SOW): A precise breakdown of included flat-rate monthly services versus separately billable projects
- Security and compliance baselines: Contractual commitments regarding how the MSP secures your and their own access to your network
- Data and credential ownership: Clauses guaranteeing that your business retains absolute legal ownership of all data, network documentation, and administrative passwords.
- Offboarding terms: A defined transition plan and timeline detailing how the provider will assist your next IT team if the contract is terminated
What is the difference between fully managed and co-managed IT?
These two service models dictate the exact division of labor between the provider and your organization. In a fully managed IT arrangement, the MSP acts as your complete, outsourced IT department, taking end-to-end ownership of everything from daily help desk tickets to strategic technology planning and cybersecurity.
Co-managed IT is designed to augment an organization’s existing internal IT staff. The MSP typically assumes responsibility for heavy-lifting tasks, such as complex infrastructure maintenance, data backups, and 24/7 security monitoring. This frees up your internal IT team to focus on daily user support, proprietary business applications, and internal workflow improvements.
