How to Choose a Managed IT Provider: 48 Questions to Ask

Choosing a managed IT provider is a bit like choosing a locksmith who keeps a copy of every key to your building. You want someone skilled, responsive and honest, and you really want to know how they store those keys.

Most small businesses choose an IT provider based on a referral, a friendly first meeting and a monthly price. Those things matter, but they don't tell you how the provider will behave on the worst day: when ransomware hits on a Saturday, when the front desk can't check in patients, or when you want to leave and need your passwords back. This guide gives you a structured way to evaluate providers: 48 questions to ask, the red flags that should end a conversation, the contract terms that protect you, how to judge the provider's own security, how to check references, and how to switch without chaos.

If you're still working out budgets, read our companion managed IT services cost guide and try the Managed IT Cost Calculator. This article is about choosing who; that one is about how much.

What does a good managed IT provider actually do?

A good managed IT provider keeps your systems secure, updated and working, answers your staff quickly when something goes wrong, plans ahead so you're not surprised, and documents everything so you're never dependent on one person's memory. The provider is often called an MSP (managed service provider); see MSP.

In concrete terms, a strong provider will:

1. Prevent problems with monitoring, patching, endpoint protection and backups.
2. Fix problems quickly through a help desk with clear response commitments.
3. Protect you with layered security: multi-factor authentication, email security, endpoint detection and response, and a tested incident response plan.
4. Plan with you: hardware replacement schedules, budgets, project roadmaps and regular reviews.
5. Handle vendors like your internet provider, phone company and software vendors.
6. Document your environment in a way you can access and keep.
7. Help with compliance: HIPAA, the FTC Safeguards Rule, client security questionnaires and cyber insurance applications.

A weak provider does the second item reasonably well and the rest when reminded.

How do you start evaluating providers?

Before you talk to anyone, write a one-page summary of your business, your systems and what you need. Give the same page to every provider so you can compare like for like.

Include:

• Number of staff (full-time, part-time, seasonal) and locations.
• Devices: computers, laptops, servers, phones, tablets, printers, network equipment.
• Key software: practice management or EHR, imaging, accounting, line-of-business apps.
• Microsoft 365 or Google Workspace, and which plans. (See our Microsoft 365 plan comparison.)
• Compliance needs: HIPAA, FTC Safeguards Rule, client security reviews, cyber insurance.
• Hours of operation and after-hours needs.
• Your biggest current pain points ("the internet drops twice a month," "nobody knows the admin password").
• What you want to be different in a year.

Then shortlist three providers. One is too few to compare; five is a part-time job.

What questions should you ask a managed IT provider?

Ask questions in eight areas: fit and experience, service and response, security of their own operations, your security, backup and recovery, compliance, contract and pricing, and transition. Here are 48, grouped so you can use them as a meeting agenda. You don't need to ask all of them in the first meeting, but you should have answers to all of them before you sign.

Fit and experience

1. How many clients do you support that are similar to us in size and industry?
2. What does a typical client look like for you? (If their typical client is 500 people, you may be a small fish.)
3. Who will actually work on our account day to day? Can we meet them?
4. How many technicians do you have, and what's their range of skills (desktop, network, security, cloud)?
5. How do you handle coverage when a key technician is on vacation or leaves?
6. What industry-specific software do you already support? (For example, dental imaging, EHRs, tax software.)
7. Do you work with our software vendors directly, or will we be the go-between?
8. Can you give us three references from clients like us, including one who's been with you for over three years?

Service and response

9. How do our staff request help: phone, email, portal? What happens after hours?
10. What are your response-time commitments by priority, in writing?
11. What counts as a critical or urgent issue?
12. Is "24/7" in your proposal staffed support or automated monitoring and alerts? (Both have value; just know which you're getting.)
13. How do you handle on-site needs, and how quickly can someone be here?
14. How do you track requests, and can we see open tickets and history?
15. How often will we have a business review, and what's in it?
16. What reports will we receive, and how often?

Security of the provider itself

17. How do you secure your remote monitoring and management (RMM) and remote-access tools?
18. Is multi-factor authentication enforced on every account your staff use to access our systems?
19. Do your technicians use separate admin accounts for each client, or shared credentials?
20. Where do you store our passwords, and who can see them?
21. How do you vet and train your own staff? Do you run background checks?
22. How quickly do you patch your own tools when a vulnerability is announced?
23. Have you had a security incident in the last three years? What happened and what changed?
24. Do you carry cyber liability and errors and omissions insurance? What are the limits?
25. Do you have independent security assessments or attestations of your own operations? (Ask for evidence rather than logos.)

Your security

26. What security tools are included as standard: endpoint detection and response, email security, MFA, DNS filtering?
27. Who watches security alerts outside business hours, and what do they do when something fires?
28. How do you enforce multi-factor authentication, including for owners and executives?
29. How do you manage admin rights on our computers?
30. Do you provide security awareness training and phishing simulations?
31. What's your plan for our first 30 days to close obvious gaps?
32. How do you keep our cyber insurance answers accurate?

Backup, recovery and continuity

33. What do you back up, how often, and where are the copies stored?
34. Are backups protected from ransomware (immutable or offline copies)?
35. How often do you test restores, and will we see the results?
36. How long would it take to get us working again if our main system died today?
37. What happens if our internet goes down? Do you set up failover?
38. Do you have a written incident response plan for clients, and will we walk through it together?

Compliance

39. Will you sign a business associate agreement (BAA)? Can we see your standard BAA?
40. Can you help with our HIPAA security risk assessment, or our FTC Safeguards Rule written information security program?
41. Can you produce evidence for audits, insurers and client questionnaires (encryption reports, MFA reports, patch reports)?
42. How do you handle data that must be retained for a set time, or deleted securely?

Contract and pricing

43. What exactly is included and excluded? Is there a written service catalog?
44. What's the contract term, and what are the termination options, both for convenience and for cause?
45. Are there annual price increases, and are they capped?
46. Do you mark up hardware and licenses? Can we buy them ourselves?

Transition and exit

47. What does onboarding involve, how long does it take, and what does it cost?
48. If we leave, how and when do we get our data, passwords, documentation and admin access back, and is there any fee?

Write down the answers. The quality of the answers often matters as much as their content. A provider who answers question 23 with "never, we're very secure" is less reassuring than one who describes a minor incident and exactly what they changed afterward.

What red flags should make you walk away?

Walk away from providers who won't put commitments in writing, won't give you admin access to your own systems, can't explain how they secure their tools, or pressure you to sign before you've read the contract. Some red flags are dealbreakers; others are worth a hard follow-up question.

Dealbreakers

• They keep your admin credentials to themselves. You should always have documented "owner" access to your Microsoft 365 tenant, domain registrar, firewall and other critical systems.
• No MFA on their own remote-access tools. If their tools aren't protected, every client is exposed.
• They won't sign a BAA when you handle patient data.
• No written response times, or "we always respond fast" with nothing in the contract.
• Long contracts with no termination for cause. You should be able to leave if they repeatedly fail to deliver.
• Fees to return your own data or documentation.
• Shared admin passwords across clients. CISA specifically recommends contracts require that MSPs "not reuse admin credentials across multiple customers" (CISA AA22-131A).

Serious warnings

• They can't name who will work on your account.
• They're vague about what happens after hours.
• Their proposal has no mention of backup testing.
• References are all brand new clients, or they won't provide any.
• They dismiss security questions as "overkill for a business your size."
• Every answer leads to "you'll need to upgrade to our premium tier."
• They push you to sign this week to "lock in" a price.
• They badmouth every previous provider you mention. (Some previous providers deserve it, but a pattern says something.)

Green flags

• They ask more questions about your business than you ask about theirs.
• They show you a sample report, sample documentation and a sample contract without being asked twice.
• They tell you something you're doing is fine and doesn't need changing.
• They're specific about what they don't do well, and who they'd refer you to for it.
• Their own staff use MFA, password managers and separate admin accounts, and they can explain how.

Why does the provider's own security matter so much?

Your IT provider has privileged access to your systems, and to dozens or hundreds of other businesses at the same time. That makes MSPs an attractive target: compromise one provider, and an attacker can reach many customers. This isn't theoretical.

What government agencies have said

In May 2022, cybersecurity agencies from the U.S. (CISA, NSA and FBI), the UK, Australia, Canada and New Zealand published a joint advisory, "Protecting Against Cyber Threats to Managed Service Providers and their Customers" (CISA AA22-131A). Its recommendations for MSP customers include contract requirements that:

• MSPs enforce multi-factor authentication on all accounts used to access customer environments.
• MSPs don't reuse admin credentials across customers.
• MSPs provide visibility into their activity and connections to your network, and notify you of confirmed or suspected security incidents.
• MSP accounts are restricted to the systems the MSP manages, not added to your internal administrator groups.
• Backups meet your resilience requirements, and incident response and recovery plans are tested regularly.

CISA's earlier "Risk Considerations for Managed Service Provider Customers" makes a point every owner should take to heart: outsourcing IT to an MSP "does not absolve an organization from risk management responsibilities." It suggests asking what an MSP will provide before contract award to demonstrate its security controls, and what network and system access levels are appropriate for the provider (CISA; CISA, Going Beyond).

Real incidents that shaped this guidance

• Kaseya VSA, July 2021. Starting July 2, 2021, attackers exploited a vulnerability in Kaseya VSA, an on-premises remote monitoring and management product used by MSPs, to deploy ransomware against MSPs and their downstream customers. CISA's guidance for affected customers included keeping air-gapped backups, enabling MFA on all accounts and applying least privilege to admin accounts (CISA, Kaseya guidance).
• SimpleHelp RMM, 2025. In June 2025, CISA reported that ransomware actors had exploited unpatched versions of SimpleHelp remote monitoring and management software to compromise customers of a utility billing software provider, part of a broader pattern of attacks on unpatched SimpleHelp instances since January 2025 (CISA AA25-163A).

The common thread: remote-access and management tools are powerful, and if they're unpatched or poorly protected, they become an attacker's front door. That's why questions 17 through 25 above aren't paranoia; they're due diligence.

The broader trend points the same way. Verizon's 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled, from 15% to 30%, year over year (Verizon, 2025 DBIR). Your vendors' security is part of your security.

A provider security checklist

Ask each provider to confirm, in writing where possible:

You can also limit the provider's footprint on your side: give their technicians named accounts rather than a shared login, keep your own emergency "break-glass" admin account they don't control, and review admin role assignments with them quarterly. Our multi-factor authentication guide covers phishing-resistant MFA options.

What should be in a managed IT contract?

A good managed IT contract spells out scope, response times, security responsibilities, term and termination, data return, pricing changes and, for healthcare, a BAA. If something matters to you and it's not in writing, assume it isn't promised.

The key contract terms

About the SLA

An SLA (service level agreement) is the part of the contract that sets measurable commitments. See SLA. Read it carefully:

• Response vs resolution. Most SLAs promise a response time (someone starts working on it), not a resolution time. That's normal, since fixes vary, but make sure response times are realistic and meaningful.
• Priority definitions. "The whole office can't work" should be the top priority, with the fastest response.
• Business hours. Does the clock stop at 5 p.m.? Are weekends covered for emergencies?
• Remedies. What happens when they miss: service credits, escalation to management, termination rights after repeated misses?
• Reporting. Will they report SLA performance at business reviews?

About the BAA

If you're a medical or dental practice (or any HIPAA covered entity) and your IT provider can access systems containing ePHI (electronic protected health information), the provider is generally a business associate, and HIPAA requires a written business associate agreement (HHS, Business Associates). HHS publishes sample BAA provisions you can compare a provider's agreement against (HHS, Sample BAA Provisions).

Practical points:

• Ask for the provider's BAA early, not after you've signed the services contract.
• Check that it covers breach notification to you, safeguards for ePHI, subcontractors (the provider's own vendors), and return or destruction of ePHI at the end of the relationship.
• Make sure the BAA and the services contract don't contradict each other.

Our BAA guide for IT goes deeper. For accounting and tax firms, the FTC Safeguards Rule has a parallel requirement: select service providers capable of maintaining appropriate safeguards, spell out security expectations in contracts, monitor their work, and periodically reassess them (FTC, Safeguards Rule guide).

How should you check references?

Talk to at least three references, ideally businesses like yours, and ask about specific situations rather than general satisfaction. "Are you happy with them?" gets you a polite yes. Better questions:

1. How long have you worked with them, and why did you choose them?
2. Tell me about the last time something went seriously wrong. How did they handle it?
3. How fast do they actually respond to urgent problems? To routine requests?
4. Do you deal with the same people consistently, or a different technician every time?
5. Have they ever surprised you with a bill? What happened?
6. Do they bring you ideas and plans, or only react when you call?
7. How did onboarding go? What would you do differently?
8. If you could change one thing about them, what would it be?
9. Would you choose them again?

Also worth doing:

• Call references yourself rather than relying on written testimonials, and ask the reference how they found the provider. A reference who's also the provider's cousin is still a reference, technically, but you'll want a second one.
• Ask for one former client, someone who left. How a provider handles an exit tells you a lot about how they'll treat you on the way out, and whether the passwords and documentation were handed back without drama.
• Look at reviews on multiple platforms, focusing on how the provider responds to negative ones.
• Ask for a sample business review report with client details removed.
• Ask to see sample documentation (redacted): a network diagram, a runbook, an onboarding checklist.
• Read their case studies critically. Specific, modest claims are more believable than vague, dramatic ones. Ours are on our case studies page; the accounting firm and dental practice studies show the kind of detail worth looking for.

How do you compare finalists side by side?

Score each finalist on the same criteria, weight what matters most to your business, and let the scores guide the conversation, not replace your judgment. Here's a simple scoring sheet you can adapt:

For a dental or medical practice, you might weight compliance and recovery more heavily. For a fast-growing startup, onboarding speed and flexibility might matter most. The point isn't the math; it's making sure you've actually compared the same things.

Scenario walk-throughs

Scenario 1: A six-dentist group practice leaving its current provider

The practice's current provider is a one-person shop that's been great for years but is now hard to reach, and nobody else has the admin passwords. The practice manager's priorities: response times in writing, a BAA, documentation the practice owns, and someone who understands imaging software.

What to focus on: questions 3, 5, 6, 10, 20, 33–39 and 48. Make the transition plan (below) part of the selection: the new provider should explain exactly how they'll recover access if the old provider is slow to hand things over. Internet failover is worth raising too; our dental practice case study shows how cellular failover kept one practice running through outages.

Scenario 2: A 20-person CPA firm facing client security questionnaires

Larger clients are sending security questionnaires the firm can't confidently answer. The partners need a provider who can build controls and produce evidence.

What to focus on: questions 25, 26, 28, 40–41, plus the provider security checklist. Ask finalists to show how they'd answer a sample questionnaire. Our accounting firm case study describes a SOC 2–aligned setup that let one firm pass client security reviews with no remediation findings.

Scenario 3: A fast-growing 12-person startup with no IT staff

The founders want laptops that set themselves up, strong protection for source code, and a provider that won't slow them down.

What to focus on: questions 1–4, 26, 29, 31 and contract flexibility (44). Ask finalists how they'd onboard a new hire who lives in another state. Our software startup case study shows zero-touch device setup, Conditional Access and least-privilege access in action, and our Intune guide explains the tools.

Is it time to replace your current IT provider?

If you recognize three or more of these signs, it's probably time to start evaluating alternatives. Many businesses stay with an underperforming provider for years because switching feels risky, but staying carries its own risk.

• The same problems keep coming back, and nobody explains why.
• You can't get a straight answer about whether your backups work.
• Response times have slipped, and urgent issues wait until "tomorrow."
• You don't have admin access to your own Microsoft 365 tenant, domain or firewall.
• There's no written documentation, or the provider won't share it.
• Your cyber insurance application asked questions nobody could answer confidently.
• Security improvements (MFA, endpoint detection, encryption) only happen when you push for them.
• You've never had a business review or a technology roadmap.
• Invoices regularly surprise you.
• Your staff have stopped calling the help desk and started asking the office's "tech-savvy person" instead.

That last one is especially telling. When people route around official support, it usually means the official support isn't working, and the tech-savvy person is quietly losing a few hours a week of their real job.

Should you choose a big provider, a small one, a local one or a specialist?

There's no universally right size or type. Choose the provider whose size, location and specialty fit your needs, then verify they can actually deliver. Each type comes with typical trade-offs:

For a medical or dental office with on-site imaging equipment, servers or network gear, a provider that can be on site within a reasonable time matters. For a cloud-only office where everyone works on laptops, remote capability and security depth may matter more than distance.

How should you run the evaluation process?

Run every finalist through the same four steps: an introductory call, a discovery or assessment visit, a written proposal, and a review meeting where you ask the hard questions. Keeping the process consistent makes the comparison fair and keeps you from being swayed by whoever presents best.

1. Introductory call (30 minutes). Share your one-page summary. Ask about fit and experience (questions 1–8). Eliminate obvious mismatches.
2. Discovery or assessment. A good provider wants to see your environment before quoting: a site walk-through, a review of your Microsoft 365 setup, a look at your network equipment and backups. Be wary of a provider who quotes a fixed monthly price without asking any questions about your systems. Some providers charge for a formal assessment; that's reasonable if you get a written report you keep.
3. Written proposal. It should include scope, inclusions and exclusions, SLA, onboarding plan and cost, monthly cost, contract terms, and a sample BAA if you're in healthcare. Compare proposals using our managed IT cost guide method.
4. Review meeting. Walk through the security, backup, compliance and exit questions (17–48). Ask them to talk through a real scenario: "It's Saturday morning and our files are encrypted by ransomware. What happens, minute by minute?" A strong provider will describe isolation, investigation, communication, restoring from clean backups, working with your cyber insurer, and documenting everything. Our ransomware protection guide covers what that response should look like.

Involve the person who'll work with the provider day to day, usually the office manager or practice manager. They'll spot practical problems the owner might not.

What should the first 90 days with a new provider look like?

A good provider uses the first 90 days to learn your environment, close the biggest risks and set up a rhythm of reporting. If after 90 days you don't have documentation, a risk list and a roadmap, something is wrong. Here's a reasonable benchmark:

Days 1–30: Discover and stabilize

• Monitoring, endpoint protection and backup agents deployed on every device.
• Admin credentials collected and stored securely; you have owner access confirmed.
• Multi-factor authentication enforced for everyone, starting with admins and the owner.
• Backups verified with at least one test restore.
• Urgent issues fixed (failing backups, unsupported systems exposed to the internet, former employees' accounts still active).

Days 31–60: Document and harden

• Written documentation: network diagram, device inventory, application list, vendor contacts.
• Security baseline applied: admin rights reduced, patching on schedule, email security tuned.
• A written list of remaining risks, ranked, with recommended fixes and estimated costs.

Days 61–90: Plan and report

• First business review with reports on tickets, response times, security status and backups.
• A 12-month roadmap: hardware replacement, projects and budget.
• For healthcare and finance clients, input into your risk assessment or written information security program.

Hold the provider to this. It's much easier to fix a relationship at day 60 than at month 18.

How do you switch providers without disruption?

Plan a 30–60 day transition with overlap between the old and new providers. The goal is to secure every credential, document everything and cut off the old provider's access cleanly, without a gap in protection. Switching is less risky than staying with a provider you don't trust, but it needs a plan.

Before you give notice

1. Read your current contract: notice period, termination fees, data-return obligations.
2. Confirm you have owner-level access to your Microsoft 365 tenant, domain registrar, DNS, firewall, backup system, and key software accounts. If you don't, get it now, politely, before giving notice.
3. List everything the old provider manages: devices, accounts, licenses, vendor relationships, scheduled tasks.
4. Choose your new provider and agree the transition plan in writing.

During the transition (overlap period)

1. Give notice in writing, referencing the contract's data-return terms.
2. Request a handover package: admin credentials, documentation, network diagrams, license details, backup configurations, vendor contacts, open issues.
3. New provider onboards: documents the environment, deploys its monitoring, security and backup tools, and confirms backups are running and restorable.
4. Check license ownership: Microsoft 365 licenses bought through the old provider's partner account may need to be transferred. Plan this so email doesn't stop.
5. Keep security continuous: make sure endpoint protection doesn't lapse when the old provider's tools are removed and the new provider's are installed.

Cutover day

1. Change every admin password and remove the old provider's accounts, including any shared or "service" accounts.
2. Remove the old provider's remote-access and monitoring tools from every device.
3. Revoke the old provider's partner relationships and delegated admin access in Microsoft 365.
4. Review admin role assignments so only the right people have privileged access.
5. Confirm backups completed successfully under the new provider.
6. Tell your staff who to call now, and how.

After cutover (first 30 days)

1. Hold a 30-day review with the new provider: open issues, risks found, quick wins.
2. Confirm the old provider has returned or destroyed any of your data they held (and, for healthcare, ePHI under the BAA).
3. Update your risk assessment or written information security program to reflect the new provider.
4. Calendar the next business review.

Transition timeline at a glance

What mistakes do businesses make when choosing an IT provider?

The most common mistakes are choosing on price alone, not reading the contract's exit terms, and not checking how the provider protects its own systems. Others we see:

• Choosing the provider with the best salesperson rather than the best technicians. Ask to meet the people who'll do the work.
• Not confirming owner access to your own systems before signing, or before leaving.
• Signing a long contract to save a little per month, then discovering there's no exit for poor service.
• Skipping references because the first meeting went well.
• Assuming HIPAA is handled without a signed BAA.
• Ignoring culture fit. If the provider talks down to your staff, your staff will stop calling them, and small problems will become big ones.
• Switching in a crisis with no plan, which is exactly when credentials go missing.
• Not reviewing the relationship annually. Your business changes; your provider's fit can too.

The bottom line

The right managed IT provider makes technology boring in the best way: things work, problems get fixed quickly, security is handled, and you can see what's going on. Find that provider by asking specific questions, getting commitments in writing, checking how they protect their own keys to your building, and planning your exit before you need it.

If you'd like to put us through the same questions, we're happy to answer every one of them in writing. Learn about our managed IT and help desk service, see our healthcare IT approach, or book a free 20-minute call.