How to Choose a Managed Service Provider: Criteria, Questions and References
Evaluate managed service providers on security, scope, references, staffing and contract terms, with a scoring table and the questions that reveal real differences.
Choose a managed service provider (MSP) by testing five things: whether it can show how it secures its own systems, whether its scope matches your needs, whether references from similar businesses are positive, whether its staffing and support model fit your hours, and whether its contract protects your ownership of data and credentials. Price comes after those checks, not before. A provider that fails on security or contract terms is expensive at any price, because an MSP typically holds administrative access to everything you own.
Why provider selection deserves care
An MSP usually has privileged access to your computers, email, backups and network. That is the point of the service, and also the risk: attackers have targeted MSPs precisely because compromising one gives access to many customers. Choosing a provider is therefore a security decision as well as a purchasing decision.
The five criteria
1. Security of the provider itself
Ask how the provider protects the tools it uses to manage you:
- Is multi-factor authentication required for every technician on every administrative tool?
- Are technician accounts individual, logged and reviewed, rather than shared?
- How are customer credentials stored, and who can see them?
- Does the provider have an independent assessment such as a SOC 2 report, or can it describe its security program against a framework such as the NIST Cybersecurity Framework?
- What is its incident response plan if its own systems are compromised, and how quickly would it notify you?
Providers who treat these as normal questions and answer specifically are a better sign than those who answer with slogans.
2. Scope fit
Compare the services in the proposal with your written scope: help desk hours, monitoring, patching, backup and restore testing, security tools, Microsoft 365 or Google Workspace administration, vendor management, on-site visits and projects. Anything you need that is "available separately" belongs in your total-cost comparison. See what affects the price.
3. Experience and references
Ask for references from businesses of your size and industry, ideally ones that have been clients for more than two years, and call them. Questions to ask references:
- How fast is response in practice, not just in the contract?
- When there was a real problem, what happened?
- Have you had surprise charges?
- Do you get regular reports and reviews?
- Would you choose them again?
4. People and process
Ask how many technicians support clients, how tickets are tracked, who answers after hours, and whether you will have a named account manager. A provider with five clients per technician provides different attention than one with fifty. Ask about turnover and whether the person selling to you is part of the delivery team.
5. Contract and exit terms
Check ownership of your assets, term length, auto-renewal, escalators, service level credits and exit assistance. Reading an MSP service agreement covers the clauses in detail.
A simple scoring table
Rate each provider from 1 (poor) to 5 (strong) and weight categories by importance to you. This example uses invented scores to show the arithmetic.
| Criterion | Weight | Provider A | Provider B | Provider C |
|---|---|---|---|---|
| Provider security | 30% | 4 | 3 | 5 |
| Scope fit | 25% | 5 | 4 | 3 |
| References | 20% | 4 | 5 | 4 |
| Support model | 15% | 3 | 4 | 4 |
| Contract terms | 10% | 4 | 3 | 4 |
| Weighted score | 100% | 4.10 | 3.80 | 4.05 |
Provider A: 0.30 x 4 + 0.25 x 5 + 0.20 x 4 + 0.15 x 3 + 0.10 x 4 = 1.2 + 1.25 + 0.8 + 0.45 + 0.4 = 4.10. Provider B scores 3.80 and Provider C scores 4.05 by the same method. The point is a consistent method, not a magic formula.
Questions to ask in the first meeting
- Which industries and sizes do you serve most?
- What does a typical first 90 days look like?
- Which tools do you use for monitoring, endpoint protection, backup and ticketing, and do you own them or resell them?
- What do you need from us in order to start?
- What is not covered by the base fee?
- What is your average response and resolution time for high-priority tickets, and how do you measure it?
- Do you carry cyber liability and professional liability insurance, and can you share a certificate?
- Have you had a security incident affecting clients, and what did you change afterwards?
- What happens if we want to leave?
Red flags during selection
- Refuses to itemize pricing.
- Pushes you to sign quickly with a "today only" discount.
- Cannot explain how it secures its own tools.
- Claims to guarantee that you will never be hacked.
- Asks for shared administrator passwords by email.
- Offers no references or only hand-picked ones you cannot speak with directly.
See red flags and scams for a longer list.
Local versus remote providers
Remote delivery handles most tasks well: monitoring, patching and help desk do not require physical presence. A local provider matters if you need frequent on-site work, have specialized equipment, or value face-to-face relationships. Ask where technicians are located and how quickly someone can be on site if needed.
Final decision step
Run a short reference check, review the contract with someone who has read it carefully, and ask for a transition plan in writing. Use the checklist tool to confirm nothing is missing before you sign. Then move to the onboarding timeline.
Frequently asked questions
Should I pick the provider with the lowest price?
Price matters, but a low quote often excludes security, after-hours support or onboarding. Compare total first-year cost and scope, not headline price.
Do certifications matter?
Industry certifications and independent security reports can be a useful signal, but they do not replace references and a careful look at the contract.
How many providers should I interview?
Three is a practical minimum. More than five usually adds confusion without adding insight.
Is a bigger provider safer?
Not automatically. Size can bring resources and mature processes, but smaller providers may give more attention. Evaluate specifics.
Sources and further reading
- Cybersecurity and Infrastructure Security Agency — guidance on managed service provider security and supply chain risk.
- NIST — Cybersecurity Framework for evaluating a provider's security program.
- Better Business Bureau — a place to look up complaint history, as one input among several.
- Federal Trade Commission — business guidance on vendor oversight and data security.
