Choosing a managed service provider comes down to verifying five things: security practice, response reality, the people you’ll actually get, contract exits, and pricing transparency. The 21 questions below test each one, with what a good answer sounds like. Bring them to every provider you interview, including us; the fastest version of this exercise is to book a free IT consultation and ask them to our faces.
A warning about how to use the list. Every MSP will answer every question confidently, because sales calls select for confidence. So the questions are built to demand evidence: a sample report, a named person, a number in writing. When a provider offers the artifact without flinching, that’s the tell. When they generalize, keep interviewing.
Security and patching (questions 1–5)
- What EDR product do you deploy, and who reviews its alerts at 2 a.m.?
Good answer: a named product plus a named 24/7 arrangement, whether an in-house SOC or an MDR partner. “We have antivirus” ends the meeting. If the vendor landscape confuses you, the MSP vs MSSP distinction explains who watches what. - How do you prioritize patches?
You want to hear that actively-exploited flaws jump the queue, ideally with a reference to CISA’s Known Exploited Vulnerabilities catalog, and a standing monthly cadence for everything else. - When did you last restore a client backup, and can I see the log?
Backups that are never test-restored are theories. A good provider produces a restore log from the last 90 days without hunting for it. - Will you require MFA everywhere, even if my staff complains?
The right answer is an unapologetic yes. A provider who lets clients opt out of MFA is pricing in your future breach. - What happens to accounts when I fire someone at 4:45 on a Friday?
Listen for a same-day offboarding procedure with a time commitment. Orphaned accounts are the quietest way ex-employees keep reading your email.
Response and support (questions 6–9)
- What are your actual response commitments, in writing, by severity?
Not “we’re usually pretty fast.” A table: emergency, degraded, routine, each with a clock. Then ask question 7. - What’s your average response and resolution time across all clients last quarter?
Providers who measure will show you. Providers who don’t measure are guessing about their own service, which tells you how they’ll report on yours. - Who answers the phone: your techs or an answering service?
Neither answer is disqualifying, but you should know whether 2 a.m. reaches a human who can act or a human who takes messages. - Do you charge extra for after-hours emergencies?
Some flat-rate plans quietly exclude nights and weekends. Fine either way; surprise is the only wrong version.
People and process (questions 10–13)
- Who exactly works my account, and what’s your technician turnover?
Small shops: you’re hiring three specific people, so meet them. Big shops: ask how often your assigned tech changes. Institutional memory is half the value. - How do you document my environment, and do I get access?
The right answer: a live documentation system you can view, covering devices, licenses, configurations, and passwords in a vault you co-own. If the documentation lives in one tech’s head, so does your uptime. - What does onboarding look like, week by week?
Competent providers describe a 30–60 day sequence: audit, agent deployment, quick-win fixes, documentation. “We’ll just take over” means they’ve never done it cleanly. - Can I talk to two clients my size who’ve been with you 3+ years, and one who left?
The last part is the real question. How a provider characterizes a departure tells you how yours would go.
Contract, pricing, and exit (questions 14–18)
- What exactly is excluded from the flat fee?
Projects, hardware, licensing, after-hours, on-site visits: every plan draws these lines somewhere. You want the exclusions page before the pricing page. Our guide to what managed IT actually costs in DFW breaks down the line items providers leave off first-year quotes. - What’s the term, and what does leaving cost?
Month-to-month or one year with a clean exit is healthy. Three-year terms with auto-renewal and termination fees are a confidence problem dressed as a discount. - When I leave, how do I get my passwords, documentation, and licenses back?
The answer should be a defined offboarding deliverable at no ransom. Providers who hesitate here are telling you the exit is the product. - Who owns the hardware and licenses you provide?
Provider-owned firewalls and provider-held license agreements walk out the door with them. Neither is wrong, but price the switching cost in. - What did your last price increase look like, and how much notice did clients get?
Increases are normal. Ninety days’ notice with a reason is professional. Discovering it on an invoice isn’t.
Fit and local reality (questions 19–21)
- How many clients my size, in my industry, do you support today?
A provider drowning in 200-seat clients will deprioritize your 15. One who’s never touched your compliance load will learn on your dime. - How far are you from my office, really?
Remote fixes cover most days, but the day it matters, drive time matters. Our city-by-city DFW coverage guide is our own answer to this question, on the record. - If you also handle cameras, door access, or alarms: what’s your Texas security license number?
One-roof providers are worth real money, but security work in Texas requires a license you can verify through the Texas DPS Private Security program. Ours is B10492801. Any provider doing that work should hand theirs over as fast as we just did.
Five red flags that end the conversation
The pattern behind bad MSP outcomes is consistent, and a 30-person construction firm off US-380 in McKinney showed us most of it in one story last year: they’d signed with the cheapest bidder and came looking for IT support in McKinney after eight months of it. The bill for those eight months, reconstructed later: a three-year term they were still inside, backups that had silently failed since week six, no MFA on the estimating team that wires money to suppliers, and documentation that consisted of one departed technician’s memory. Unwinding it cost more than the first year of doing it right would have. Watch for: (1) no written response commitments, (2) MFA treated as optional, (3) refusal to share a sample monthly report, (4) a three-year term pushed hard on the first call, and (5) vagueness about who does the work. Any two together, walk.
Our take: weight the exit questions (14–16) more heavily than the sales process encourages. Every provider is charming in month one. The measure of the relationship is how it’s designed to end, because that design is set the day you sign, when your bargaining power is highest.
How to choose a managed service provider: scoring the answers
| Category | You’re verifying | Fails if |
|---|---|---|
| Security (1–5) | Named tools, tested restores, MFA spine | Adjectives instead of artifacts |
| Response (6–9) | Written clocks, measured reality | “It depends” with no numbers |
| People (10–13) | Who, documented how, references | Documentation lives in heads |
| Contract (14–18) | Clean exits, visible exclusions | Termination fees, license ransom |
| Fit (19–21) | Size, industry, distance, licensing | Learning your world on your dime |
If it were our building: we’d interview three providers, ask all 21, and pick the one that volunteered the most paper without being pushed. The best predictor of a good MSP relationship isn’t the demo; it’s how they behave when you ask for evidence.
A note on weighting, since not all 21 answers deserve equal votes. Treat questions 1, 3, 4, 14, and 16 as pass/fail: a provider without real EDR, tested restores, enforced MFA, visible exclusions, and a clean exit isn’t a lower-scoring option, they’re a different product. The rest of the list separates good from great. Two strong candidates will genuinely split on questions 10 and 19, which is where your size and industry should break the tie.
Frequently asked questions
How do I evaluate a managed service provider?
Interview at least three, use a fixed question list covering security practice, response commitments, staffing, contract exits, and pricing exclusions, and demand artifacts: sample reports, restore logs, written SLAs, references. Score answers on evidence produced rather than confidence displayed, and weight exit terms heavily before signing anything.
What questions should I ask an MSP before signing?
The essentials: what EDR you deploy and who watches it overnight, your written response times by severity, when you last test-restored a backup, everything excluded from the flat fee, the contract term and exit process, and exactly who works my account. Good providers answer all six with documents.
What are the biggest MSP red flags?
No written response commitments, optional MFA, refusal to show a sample report or restore log, hard-sold multi-year terms with termination fees, vagueness about staffing, and hesitation about how you’d get documentation back if you left. Any two together reliably predict the relationship you’d be signing up for.
How much should a managed service provider cost?
In the DFW market, full managed plans typically run $100–$185 per user per month, varying with server count, compliance load, and security stack. Quotes far below that range usually exclude the expensive parts. Compare exclusions pages, not headline rates, and get every carve-out in writing first.
Choose slowly, once
The provider you pick will hold your passwords, your data, and your worst mornings. It’s worth three interviews and 21 questions to get it right the first time. Already have proposals in hand? Send us the quotes you’re comparing and we’ll annotate them honestly, including the parts where a competitor’s answer beats ours.