How to Evaluate an MSP Before You Sign Anything

Evaluating a managed IT provider comes down to five checks. A response time guarantee in writing, a documented incident plan, transparent flat pricing, verifiable client retention numbers, and clear terms for who owns your data if you ever leave.

Most owners approach an MSP contract the way they approach a phone plan. Skim the pitch. Ask about price. Sign. Simple enough. That works fine right up until the first outage, the first ransomware scare, or the first invoice nobody in the office can explain.

I’ve sat on the other side of this evaluation for most of my career, for the better part of two decades building out infrastructure for businesses your size. VJNetworks provides managed IT services for companies of 5 to 60 employees across the Tri-State area, everything from a single-site professional practice to a multi-location operation with staff spread across three counties. The industry rarely changes the questions worth asking. A healthcare practice, a municipality, and a growing multi-location business are all circling the same core question. Whether this company can back up what was said in the sales meeting.

Start With the Response Time Guarantee, in Writing

Ask any provider how fast they respond, and nearly every one says “fast.” Ask for the number in writing and watch what happens. Some hedge. Some produce a figure tied to an actual service level agreement. VJNetworks holds itself to 15 minutes, live, from a person, on every ticket. Not a target mentioned in the sales meeting and forgotten about afterward. It’s written into what we sign with every client.

A response time guarantee only means something when it’s specific and measurable, tied to a real SLA document instead of a verbal promise, with a named person accountable for missing it. “Prompt” or “priority support” isn’t a guarantee. It’s a placeholder for one. Nothing more.

Read the Security Answer Closely, Not Just for Confidence

One thing a lot of buyers miss. Ask what their password policy actually requires. If the answer is still mandatory resets every 60 or 90 days, that’s worth a second look. NIST’s own digital identity guidelines, the standard most serious security programs are built around, specifically recommend against forcing password changes on an arbitrary schedule, reserving forced resets for evidence of compromise instead. An MSP still pushing quarterly password rotations as a security win is running on a decade-old playbook. Small tell. Real one though. It’s worth asking the same kind of question about the rest of their cybersecurity stack too, not just passwords.

The Same Framework, Different Stakes

Evaluation criteria barely shift by industry. What changes is what a wrong answer costs.

A healthcare practice needs a provider who treats a Business Associate Agreement as standard paperwork, not a special request, the same way a locked server room is standard and not something anyone would expect a client to specifically ask for. The Department of Health and Human Services is direct about this. Any vendor handling protected health information on a covered entity’s behalf needs a signed BAA in place, and a provider that hesitates or asks what that is has already answered the evaluation question for you.

A municipal office or local government client carries its own version of the same test. The Cybersecurity and Infrastructure Security Agency maintains dedicated guidance for state, local, tribal, and territorial governments, because that sector gets targeted differently than private business. A provider with no real answer for public-sector requirements isn’t ready for that account, regardless of how polished the rest of the pitch sounds.

A multi-location business asks a quieter version of the same thing. Rarely simple. Does the provider have a plan for what changes when a second office opens, or does every new location get bolted onto the same setup without anyone checking whether the network, the licensing, and the phone system all still hold together under the added weight. We’ve walked a client through exactly that, from five locations to seventy, and the honest answer is it never gets less involved. It gets planned for instead of improvised.

Where the Sales Pitch and the Verifiable Answer Split

A pitch deck and a signed contract rarely say the same thing. Rarely even close. Here’s where buyers usually catch the gap, side by side.

Six Questions Worth Asking Before You Sign

Bring these into the room yourself. Don’t wait for the provider to volunteer them. They usually won’t.

• What’s our guaranteed response time in writing, and what happens if you miss it?
• Walk me through the first hour of a ransomware incident, step by step.
• What’s included in the flat monthly rate, and what triggers an extra charge?
• If we leave, do we keep our data and credentials without a fight?
• Have you supported a business that scaled from one location to several? What actually changed when it did?
• If we’re in a regulated industry, healthcare, finance, or government, what does your hands-on experience actually look like?

What Happens After You Sign Matters Just as Much

The evaluation doesn’t end at the signature. A transition plan should document your current environment, migrate credentials and monitoring without a gap, and run old and new systems in parallel long enough that nothing falls through during the handoff. Ask to see that plan before you sign, not after you’re already committed. Every time.

Ask any provider what their actual retention rate looks like, not just how long they’ve been in business. Big difference between the two. 97 percent of VJNetworks clients have stayed with us for over 20 years. Not a lucky streak. Not close to one. It’s what happens when the relationship after the signature holds up the same way the pitch did. A provider who can’t produce a real retention number, or won’t, is telling you something about year two before you’ve even signed for year one.

If you want a second opinion on a contract already in front of you, or a framework for scoring a shortlist of providers, a free IT assessment from VJNetworks gives you an outside read before you commit to anything. No pressure. No pitch. Just an honest look at what you’re about to sign.

What Smart Buyers Ask Next