How to Choose an MSP without getting burned

DEFINITION

What is an MSP, and do you actually need one?

A managed service provider (MSP) is a third-party firm that operates parts of your IT environment under a recurring contract — typically helpdesk, endpoint management, patching, backup, monitoring, and increasingly cybersecurity. Unlike a break-fix shop that bills hourly when something fails, an MSP is paid to prevent failure in the first place. The economics only work when the relationship is long-term and proactive.

Most MSP buyers run 10 to 500 employees with one to three internal IT staff — or none at all. The typical pattern: a generalist IT manager who is drowning in tickets, plus a leadership team that just got asked hard questions by a cyber insurer or auditor.

Five signals you have outgrown break-fix

• Unplanned downtime hits more than twice per quarter.
• Internal IT spends more than 40% of the week clearing tickets.
• No documented backup restore test in the last 90 days.
• No written patching SLA for servers, endpoints, or firmware.
• An audit or cyber insurance renewal flagged control gaps.

MSP vs MSSP vs VAR

An MSP operates your day-to-day IT for a fixed monthly fee. A managed security service provider (MSSP) is security-only — 24/7 SOC, threat hunting, SIEM, and incident response — and we rank those separately in our national MSSP rankings. A value-added reseller (VAR) sells you hardware and software licenses but does not operate them after the sale.

Co-managed or fully outsourced?

Mid-market buyers with an internal IT lead usually want co-managed IT, where the MSP handles after-hours tickets, patching, backup, and tooling while your staff keeps strategy and vendor relationships. Fully outsourced suits leaner teams that have no internal IT at all. We publish city-by-city rankings of providers across both models in our MSP rankings index.

FRAMEWORK

The 6 Evaluation Criteria we use to rank every MSP

These are the six factors ITreviews.co weights in our Trust Score, the same scoring model behind every city ranking we publish at our MSP rankings index. We refresh the scores quarterly. Use this as your buyer scorecard: any provider you shortlist should score well across all six, not just one or two.

ITreviews.co is independent. No paid placements, no sponsored listings, no directory fees. See our published methodology for the full scoring rubric, then mirror this scorecard in a spreadsheet during your own evaluation.

PREPARATION

Pre-Evaluation Checklist: do this before any sales call

The single biggest reason MSP engagements fail is that the buyer walked into vendor conversations without an inventory, without requirements, and without success criteria. Spend two weeks on the work below before you take a single demo. Providers will quote you more accurately, and you’ll know which proposals are realistic.

1. Asset inventory. Count endpoints (workstations plus laptops), servers (physical plus virtual), users with email, mobile devices, SaaS apps, network gear (firewalls, switches, access points), and any line-of-business apps. This is the foundation every accurate quote depends on.
2. Document current pain points. Pull tickets per month, list recurring issues, and write up the last three outages with their root causes. Vendors who see this data quote tighter; vendors who avoid it are guessing.
3. List compliance and insurance requirements. Include HIPAA, PCI DSS, SOC 2, CMMC, and every cyber insurance attestation question your carrier asks. Compliance-heavy verticals push pricing toward the upper end.
4. Define scope. Decide fully managed versus co-managed, and name which functions stay in-house (identity, line-of-business apps, vendor management). Ambiguity here is where scope creep and surprise invoices start.
5. Set success criteria. Write target ticket resolution times, uptime SLA, backup RTO and RPO, and patch cadence. These become the measurable terms in your contract, not vague promises.
6. Set a realistic budget range. Use per-user math against the ranges in our pricing section. Walking in with a defensible number stops vendors from anchoring you high.
7. Identify stakeholders who must sign off. Typically the IT lead, the CFO or controller, and an executive sponsor. Get them aligned before demos, not after a proposal lands.
8. Decide on contract preferences. Term length, exit clause requirements, and data ownership clauses. These three points decide whether you can leave cleanly if the relationship fails.

BUDGETING

MSP Pricing Models and what they really cost

Most MSPs use one of four pricing structures. The cheapest model on paper is rarely the cheapest in practice, because scope exclusions and project work add up. Ranges below reflect typical 2026 US market pricing for SMB and mid-market — use them as sanity checks, not quotes.

What is rarely included

Hardware procurement, major project work (server migrations, Microsoft 365 tenant moves), security incident response retainers, and third-party software licensing markup almost always sit outside the recurring fee. Ask for a written exclusion list before signing.

Onboarding fees

Expect a one-time onboarding fee of $1,000 to $10,000 — typically 1x to 3x the monthly recurring amount. This is non-negotiable for most reputable providers because it pays for documentation, agent deployment, and baseline remediation. A provider who waives it too easily is a red flag.

WARNING SIGNS

Red Flags that should end the conversation

Reputable MSPs are easy to spot because they behave the same way every other professional services firm does — measured, document-heavy, slow to commit. The warning signs below come up repeatedly in the buyer interviews we conduct for our quarterly rankings refresh.

If you see two or more of these during your evaluation, walk. The MSPs that earn placement on our city rankings — and on named lists like Channel Futures MSP 501 and CRN MSP 500 — do not exhibit these behaviors. Our Trust Score weights reviews at 35% and awards at 20% for a reason: the market already filters out providers who cannot operate transparently.

• High-pressure closing tactics. “Sign this week or the price goes up” is a sales motion, not a partnership. Professional MSPs hold pricing for the length of a normal procurement cycle.
• No published SLA, or vague language like “we respond quickly.” You need specific response and resolution times by severity, with credits tied to misses. Anything less is unenforceable.
• No SOC 2 Type II report, no ISO 27001, no documented internal security program. This is disqualifying for any provider who will hold your admin credentials, especially in healthcare, legal, or financial services.
• No named certifications on staff. Expect CompTIA A+, Network+, and Security+ at the help desk, plus Microsoft MS-102, Cisco CCNA, and AWS or Azure associate-level credentials on the engineering bench.
• Won’t provide three client references in your size and industry band. Or zero verified Clutch reviews and fewer than 20 verified reviews after several years in business. Both signal a thin or unhappy client base.
• Not listed on any named publication ranking. Absence from Channel Futures MSP 501, CRN MSP 500, Inc. 5000, or comparable lists after several years of operation is worth questioning directly.
• Refuses to put data ownership and exit-clause language in writing. Your data is yours. The contract should say so, and define export format, timeline, and cost.
• Quotes 50%+ below market. If the SMB market range is $75–$200 per user per month and a provider quotes $40, something is being cut — usually security tooling, after-hours coverage, or staff certifications.
• Single point of failure. One owner-operator with no documented runbooks, no second-tier support, and no on-call rotation is one vacation away from an outage you cannot resolve.
• Undisclosed vendor bias. An entire stack from one manufacturer with no technical justification, or unmentioned referral kickbacks, means you are paying for their margin, not your fit.

LEGAL

Contract Terms That Matter more than the monthly price

MSP contracts are where buyers lose negotiating power. Five specific clauses determine whether you have a partnership or a lock-in. Negotiate these explicitly, in writing, before you sign anything.

A great price means nothing if the contract traps you, hides scope, or holds your data hostage at termination. Read every clause below before you sign, and push back on any provider who resists clarifying them.

• Term length. 12 months is reasonable for a new relationship. Accept 36 months only if you get a price-lock and a scheduled quarterly business review built into the contract.
• Exit clause. 60 to 90 day termination for convenience after month 12 is industry-standard. Avoid any contract that locks you in for the full term with no off-ramp.
• Data ownership. Your data is yours. The contract must explicitly grant full export rights in standard formats (CSV, PST, raw database dumps) at termination, with no exit fees.
• Offboarding and transition assistance. Require 30 to 60 days of paid transition support to the next provider, documentation handover, and credential rotation cooperation in writing.
• SLA structure. Response time and resolution time are different metrics. Get both, broken down by severity tier (P1/P2/P3/P4), with defined service credits when the MSP misses.
• Escalation path. Named individuals or roles for tier 2, tier 3, and account management. A generic helpdesk inbox is not an escalation path.
• Change control. “In scope” versus “project work” must be defined with examples. Vague scope language is where monthly bills quietly double.
• Cyber liability and insurance. Confirm the MSP carries $2M to $5M minimum in cyber liability coverage and will name your company as a certificate holder.
• Renewal terms. Auto-renewal requires a clear opt-out window. A 90-day notice is fair; anything longer than 120 days is a trap designed to roll you forward.

DISCOVERY CALLS

12 Questions to Ask every MSP in your shortlist

Ask all twelve to every finalist, in the same order, ideally in the same week. The point is comparability, not a single perfect answer. Take notes verbatim — the difference between “we have a SOC” and “we partner with a SOC” will matter at 2 a.m. during an incident.

1. Client fit and references. How many clients do you currently serve in our employee-count and industry band, and can we speak to three of them?
2. Tenure and churn. What is your average tenure with clients, and what is your annual client churn rate?
3. SLA and service credits. What is your documented response and resolution SLA by severity tier, and what service credits apply if you miss them?
4. Security stack walkthrough. Walk us through your security stack — EDR, MFA enforcement, identity management, SIEM, backup immutability — and what frameworks (NIST CSF, CIS Controls, ISO 27001) you align to.
5. SOC 2 Type II evidence. Do you hold SOC 2 Type II — and can we see the report under NDA?
6. Named team members. Who specifically would be our account manager, our vCIO, and our primary engineer — and what is their tenure?
7. Escalation path. What is your escalation path when tier 1 cannot resolve — by name and role?
8. Engineering certifications. What certifications does your engineering team hold — Microsoft, Cisco, AWS, Azure, CompTIA, ITIL?
9. After-hours coverage. How do you handle after-hours, weekend, and holiday coverage — is it your own staff or an outsourced NOC?
10. Patching cadence. What is your patching cadence and how do you handle emergency CVEs?
11. Offboarding terms. What does offboarding look like if we leave — documentation, credential handover, data export, transition support?
12. Real artifacts, not slides. Show us a real client onboarding plan and a real monthly reporting deliverable — not a sales deck.

SCORING RUBRIC

How to Compare Proposals apples-to-apples

By the time three proposals land on your desk they will be formatted differently, scoped differently, and priced differently on purpose. Build a one-page scoring rubric before the proposals arrive so you score the providers, not the design of their PDF.

1. Normalize the scope. Rewrite each proposal into the same line items: users covered, devices covered, helpdesk hours, after-hours coverage, security stack, backup, vCIO hours, and project hours. If a provider omits a line, mark it zero.
2. Score the six Trust Score criteria. Rate each finalist 1–10 on Reviews, Awards, Years in Business, Physical Presence, Industry Specialization, and Service Breadth using our published methodology as your guide.
3. Compute fully loaded annual cost. Monthly fee × 12 + onboarding fee + estimated project hours + any per-incident or after-hours fees. The cheapest monthly number is rarely the cheapest year.
4. Reduce to cost per user per month. Divide the fully loaded annual total by users and by 12. This single number lets you compare a $9,000/month fixed-fee proposal against a $135/user proposal honestly.
5. Build an SLA comparison table. Side-by-side: response time, resolution time, uptime guarantee, backup RTO/RPO, and patch SLA. Look for measurable commitments, not adjectives.
6. Run a reference check scorecard. Call three references per finalist and ask each the same set of questions: average tenure, biggest incident handled, escalation responsiveness, billing surprises, and whether they would resign today. Score consistency, not enthusiasm.
7. Assess cultural fit. Subjective, but document it. Note who returns calls, who delivers documents on time, who pushes back on bad ideas, and who caves to whatever you ask.
8. Apply a buyer weighting. A suggested split (not our Trust Score): Trust Score criteria 60%, normalized cost 25%, cultural fit 15%. The highest composite score wins, not the lowest price.
9. Document the decision. Save the rubric, the scores, and the reasoning. The next time you re-evaluate (every 24–36 months), you have a baseline instead of starting from zero.

PROVIDER TYPE

Regional vs National MSPs: which is right for you?

There is no universal right answer — we rank both regional and national MSPs across 54 cities at our MSP rankings index. The decision usually comes down to your physical footprint, compliance posture, and how much onsite support actually matters to your operation.

When a regional MSP wins

Choose a regional MSP when you operate from a single location or 2–3 nearby offices, onsite escalation matters to your business, you value direct access to senior engineers, and you prefer fewer-layers account management without ticket queues routed offshore.

Regional providers usually staff a smaller bench, which means the engineer answering your Tuesday morning ticket likely remembers your network topology from last quarter’s project. That continuity is hard to price but easy to feel.

When a national MSP wins

Choose a national MSP when you have 5+ geographically distributed offices, need 24/7 follow-the-sun coverage across time zones, carry multi-state compliance requirements like HIPAA or PCI DSS, or want a single vendor accountable across all sites with one MSA and one invoice.

The hybrid option

Hybrid models — a regional anchor with national overlay through a partner network — can work, but verify SLAs flow through cleanly from the prime contractor to every subcontracted location. Ask which entity owns the ticket when a remote office goes down.

Buyers comparing local options can browse city-specific rankings including Los Angeles, New York, Dallas, Atlanta, Boston, Seattle, and Washington DC.

VERTICAL FIT

Industry-Specific Considerations for regulated and specialized buyers

Industry specialization is 10% of our Trust Score because regulatory and operational context determines whether a generalist MSP can actually support you. We publish vertical-specific rankings for the five most-asked sectors at /rankings/msp/.

Healthcare

Require documented HIPAA compliance experience, hands-on EHR support for the platform you actually run (Epic, Cerner, or athenahealth), and medical-device network segmentation. Ask for prior Business Associate Agreements and breach-response history. See our Healthcare MSP rankings.

Legal

Look for matter-centric document management, ediscovery support, and an MSP that can speak to ABA Model Rule 1.6 confidentiality obligations. Generalist file-sync setups fail audits. Compare firms in our Legal MSP rankings.

Financial services

Demand SOC 2 Type II evidence, SEC/FINRA recordkeeping workflows, FFIEC alignment, and for New York-based firms, documented NYDFS 23 NYCRR Part 500 controls. Verify in our Financial Services MSP rankings.

Manufacturing

Ask about real OT/IT convergence experience, ICS/SCADA awareness, alignment to IEC 62443, and a written downtime cost model tied to your production lines. See our Manufacturing MSP rankings.

Professional services

For agencies, accounting firms, and consultancies, bill-by-the-hour productivity is the workload. Endpoint reliability, fast helpdesk response, and collaboration uptime drive revenue. Compare providers in our Professional Services MSP rankings.

Cross-cutting requirements

CMMC applies to defense contractors handling controlled unclassified information. PCI DSS applies to any business touching cardholder data. SOC 2 Type II should be table stakes for any MSP holding your admin credentials, regardless of vertical.