A managed service provider (MSP) looks after some or all of your IT for a regular fee: the helpdesk your staff call, the monitoring that catches a failing disk before it fails, patching, backups, and the licences and devices you buy. For a business with five to a hundred staff and no IT department, it’s usually the cheapest way to get competent IT.
The trouble is that “managed IT” covers everything from a one-person operation to a national firm with a 24-hour security operations centre. Here’s how to compare them.
Start with what you need, not what they sell
Before you call anyone, write down:
- How many people and devices you have, and where they work (one office, several, home).
- What you can’t run without: your accounting system, practice management software, email, a line-of-business app.
- What has gone wrong in the last year, and how long it took to fix.
- Any obligations you have: client contracts that mention security, insurance requirements, industry rules.
That list is what you hand to each provider. A good one will ask more questions; a weak one will quote straight off a price list.
Questions worth asking
What’s included, and what costs extra? Most MSPs charge per user or per device per month. Ask for the exclusions in writing: projects, after-hours work, new staff setups, on-site visits and third-party software support are common extras.
What are your response times, and how do you measure them? “Four-hour response” can mean someone acknowledged the ticket, not that they fixed it. Ask for last quarter’s actual numbers.
Who will I deal with? Find out whether you get a named account manager or engineer, where the helpdesk is based, and what happens when your usual person is on leave.
How do you handle security? Ask how they protect their own systems. Attackers target MSPs precisely because one breach gives them access to every client. Multi-factor authentication on all admin access is the bare minimum; ask whether they assess clients against a recognised baseline such as Australia’s Essential Eight, the UK’s Cyber Essentials or the CIS Controls.
How are backups tested? A backup nobody has restored from isn’t a backup. Ask how often they run test restores and whether you’ll see the results.
Can I talk to two current clients of a similar size? Any established provider can arrange this.
Contract terms to read twice
- Term and exit. Twelve months is common; be wary of long terms with automatic renewal. Check the notice period.
- Offboarding. The contract should say the provider will hand over all passwords, admin accounts, documentation and data when you leave, and what that costs.
- Who owns the accounts. Your Microsoft 365 tenancy, domain names and software licences should be registered to your business, not the provider.
- Liability and insurance. Ask whether they hold professional indemnity and cyber insurance, and for how much.
Red flags
- Reluctance to put pricing or exclusions in writing.
- Admin passwords they won’t share with you.
- No documented process for onboarding or offboarding.
- Pressure to sign before you’ve seen the contract.
Next step
Shortlist three providers, send them the same list of needs, and compare the answers side by side. You can browse managed IT providers by state in the directory.
