How to Choose an MSP

How to choose an MSP: the criteria that matter

Choose an MSP on fit, security and exit terms first, and price second. A cheap provider that cannot support your software or lets you leave only on painful terms costs more over three years than a fair one.

Weigh providers on these MSP evaluation criteria:

• Fit. Do they support firms your size, in your industry, on your core software (EHR, tax, practice management, ERP)? Ask how many current clients look like you.
• Scope. A written list of what the monthly fee covers and what is billed extra: projects, after-hours work, on-site visits, new user setup, hardware.
• Security of the provider itself. An MSP holds admin access to everything you run. In the 2026 Verizon DBIR, third parties were involved in 48% of breaches ⁴. Ask how they protect their own tools.
• Support model. Who answers, during which hours, how tickets escalate and how you see ticket history.
• Planning. Regular reviews and a budget roadmap, sometimes sold as virtual CIO service.
• Documentation. Inventory, network diagram, passwords and configurations kept in a form you own.
• Contract terms. Length, renewal, price changes and exit. See the contract section below.
• Price. Compare like for like. Published provider guides put fully managed IT at about $100 to $250 per user per month ¹; in Kaseya's 2023 survey the most common per-user band was $50 to $100 ². See managed IT pricing.

If you are not sure what an MSP should cover, start with what an MSP is.

Questions to ask an MSP

Ask every provider the same questions in writing so you can compare answers side by side. These cover the gaps that cause most disputes later:

Service 1. What exactly does the monthly fee include, and what will you bill separately? 2. Who answers when we call, during which hours, and what happens after hours? 3. How do you prioritize tickets, and what response time will you commit to in the contract? 4. Will we have a named contact who knows our business?

Security 5. Do you use MFA on your remote management tools and on every technician account? 6. How do you limit technician access to our systems, and do you log it? 7. What would you change first in our setup, and why? 8. How do you test our backups, and will you show us restore results?

Compliance and insurance 9. Will you sign a business associate agreement (for HIPAA) or contract terms that meet the FTC Safeguards Rule? 10. Can you help us answer our cyber insurance application accurately?

Exit 11. If we leave, what do you hand over, how fast, and at what cost? 12. Who owns the documentation, passwords, domain names and licenses?

Write down the answers, not just the impressions. A provider that hedges on question 11 is telling you something.

MSP red flags

Walk away, or press hard, if a provider shows any of these MSP red flags:

• No written scope. "We handle everything" is not a scope.
• It keeps your admin passwords and domain registration in its own name with no plan to hand them over.
• Long auto-renewing terms with a short cancellation window, or termination fees with no offboarding help in return.
• Weak security on its own side: no MFA on remote tools, shared technician logins, or vague answers about how it protects client access.
• Backups nobody has restored. A green dashboard is not a test.
• Contract price increases with no cap or notice. Syncro's 2023 survey found 63% of MSPs had raised prices in the prior 12 months ³. Increases happen; surprises should not.
• Pressure to replace everything at once before it has assessed what you have.
• Claims it cannot back up, such as being "HIPAA certified." The HIPAA Security Rule sets duties for covered entities and business associates; it does not create a vendor certification ⁶.
• Reluctance to give references at firms your size, or only offering a reference from years ago.

Signs of bad IT support with your current provider are similar: tickets that sit for days, the same problems recurring, technicians who cannot explain what they changed, and no review meetings. If your IT provider is not responding at all, see the switching section below.

Contracts and termination terms

Read the agreement for exit terms as carefully as for price. We have not found a neutral survey of standard MSP notice periods or SLA response times, so judge each contract on its own terms rather than against a claimed "industry standard." Check these clauses:

• Term and renewal. How long, whether it auto-renews, and the window to give notice.
• Termination for cause. Your right to leave if the provider misses commitments, after a written notice and a cure period.
• Termination for convenience. Whether you can leave without cause, and what it costs.
• Offboarding assistance. A written duty to hand over documentation, passwords, configurations and backups, and to cooperate with the next provider, with any fee stated in advance.
• Ownership. You own your data, documentation, domains, licenses and accounts, in your company's name.
• Price changes. How much notice and any cap on increases.
• Response commitments. Specific times by priority level, and what happens if they are missed.
• Security duties and incident notice. How quickly the provider must tell you about a security incident affecting your systems.
• Regulatory terms. If you handle health data, HIPAA requires a written business associate agreement with any provider that handles ePHI ⁶. If you are covered by the FTC Safeguards Rule, you must select capable providers, require safeguards by contract and periodically assess them ⁵. See HIPAA compliance services and written information security plans.

Have counsel review the agreement before signing; this is a summary, not legal advice.

MSP RFP questions and a simple process

For most firms under 100 staff, a short, structured request beats a long formal RFP. A practical process:

1. Write a one-page brief. Headcount, locations, key software, current pain points, compliance needs, and what you want in scope.
2. Share an inventory if you have one. Devices, servers, cloud services and internet circuits. Accurate counts produce comparable quotes.
3. Send the same questions from the list above to three providers.
4. Ask for a fixed-format quote: monthly fee, onboarding fee, what is excluded, and hourly rates for out-of-scope work.
5. Meet the team that would support you, not only the salesperson.
6. Call two references each, at firms your size, and ask what went wrong and how it was handled.
7. Compare contracts side by side before choosing.

Useful managed IT RFP questions beyond the basic list: describe your onboarding plan week by week; give an example monthly report; explain how you handled a client security incident; list the tools you will install and who licenses them. If your firm has specific security goals, a cybersecurity risk assessment gives every bidder the same starting facts. You can also use our form to be connected with a local provider; see managed IT services near me.

MSP onboarding checklist and process

A good MSP onboarding process takes your environment from unknown to documented and secured in the first weeks, and the provider should give you a written plan before it starts. A typical MSP onboarding checklist:

Discovery - Inventory every device, user, server, cloud service, license, domain and internet circuit. - Collect admin credentials into a vault you can access. - Document the network: firewall, Wi-Fi, switches and remote access.

Baseline - Install monitoring and endpoint protection on every device. - Turn on MFA everywhere, starting with email and remote access. Microsoft's research puts the drop in account compromise risk from MFA at 99.22% ⁷. - Bring patching up to date and flag unsupported systems. - Set up backups and run a test restore. CISA tells small businesses to regularly test partial and full restores ⁸.

Handover to steady state - Introduce staff to the help desk and how to raise tickets. - Deliver the documentation set and a list of issues found, with a fix plan. - Schedule the first review meeting.

Ask the provider for a written onboarding timeline in its proposal and hold it to that plan. Onboarding is also when you find out whether the provider documents well. If documentation is thin at the end of onboarding, it will not improve later. Our pages on backup and disaster recovery and Microsoft 365 support cover two areas that onboarding often uncovers problems in.

How to switch IT providers

Switching IT providers goes smoothly when you secure access before you give notice and run a short overlap. An MSP transition plan:

1. Read your current contract for the notice period, termination fees and offboarding duties.
2. Choose the new provider first and agree on its onboarding plan.
3. Confirm you control the keys: domain registrar, Microsoft 365 or Google global admin, firewall, backups, line-of-business software admin accounts. Add your own admin account where you can.
4. Give written notice and request the handover: documentation, passwords, configurations, backup copies and license details.
5. Overlap where possible, so the new provider installs its tools before the old one removes theirs.
6. Rotate every admin password and remove the old provider's accounts and remote tools once the handover is done.
7. Check backups under the new provider with a restore test.

If your IT provider is not responding at all, act on access first. Make sure someone at your company can log in as an administrator to email, the domain registrar and the firewall, and record what you can see. If you suspect a security incident, call your cyber insurer's hotline first if you have a policy, report to the FBI at ic3.gov, and do not wipe or rebuild systems before evidence is preserved ⁹¹⁰. See incident response.

A new provider's first assessment often finds gaps the old one left. That is normal; budget for some cleanup work in the first quarter.