Every managed service provider’s website says roughly the same thing. Fast response. Proactive monitoring. Enterprise grade security. A trusted partner. There are now more than 40,000 active MSP businesses across the United States, and on paper, most of them look identical. The difference between a provider who transforms your operations and one who quietly costs you a year of your career does not show up in the sales deck. It shows up at 2am when something breaks and you find out, for the first time, what you actually bought.

Choosing an MSP is not a single decision. It is a structured evaluation process, and most business owners skip the structure entirely. They talk to one or two providers, compare a couple of numbers, and sign based on gut feel and a persuasive salesperson. That approach works fine when it works. When it does not, the cost is not just the monthly fee. It is months of re-onboarding, a security gap nobody caught, or a compliance failure discovered during an audit rather than during due diligence.

How to choose a managed IT provider comes down to ten questions, asked directly and answered in writing, before anyone signs anything. Here they are, along with what a real answer sounds like and what should make you keep looking.

Before the ten questions: get your own requirements straight

The evaluation only works if every provider answers the same questions about the same environment. Before contacting anyone, write down your current user count and growth projection over three years, your regulatory obligations (HIPAA, CMMC, PCI, SOC 2, or none), your current pain points in specific terms, and your non-negotiables. Give every provider the identical brief. Otherwise you are comparing answers to different questions, which tells you nothing useful.

Talk to at least three providers. Fewer than three gives you no real baseline for comparison. More than five becomes unmanageable and you will lose the ability to compare answers carefully. Three to five, evaluated against the same ten questions, is the range that produces a real decision instead of a guess.

The ten questions, in order

1. What is your written response SLA, and what happens if you miss it?

Every MSP will tell you they respond quickly. Few will put a number in writing with a consequence attached. Ask for the specific commitment: what counts as “response” (an automated acknowledgment does not count; a human engaged with the problem does), what the timeframe is for critical versus standard issues, and what remedy exists if the SLA is missed. A provider who cannot answer this specifically, or who answers with “we’re usually very fast,” has told you everything you need to know.

2. Show me a sample invoice from a client my size.

Rate cards lie. Real invoices tell the truth. Most MSPs quote a clean per-user or per-device number, then bill projects, hardware, after-hours work, vendor management, and “advanced support” separately. A $95 per-user quote regularly lands closer to $140 effective once the extras appear. Ask for a redacted invoice from an existing client of similar size. A provider who volunteers a one-page breakdown of every fee that has ever hit a client’s bill is showing you they have nothing to hide. A provider who refuses is showing you the opposite.

3. What happens when we want to leave?

This is the single most revealing question in the entire evaluation, and the one most business owners never think to ask before they are locked in. Get the offboarding process in writing: what data ownership looks like, what documentation you receive, what the transition timeline is, and whether there are early termination penalties tied to the full remaining contract value. A provider who dodges this question is relying on lock-in rather than service quality to keep your business. A serious provider answers without hesitation, because they are confident they will not need contractual friction to retain you.

4. Walk me through your security stack in specific technical detail.

“We take security seriously” is not an answer. In 2026, cybersecurity is not an add-on to managed IT, it is embedded in every layer, and an MSP without a strong security stack is a break-fix shop with a monitoring dashboard attached. Ask specifically: what endpoint detection and response platform do they run, is it monitored 24/7 by an actual person, is multi-factor authentication enforced on every account with no exceptions, and what does their network segmentation approach look like. A provider who cannot go two layers deep on any of these questions is describing a product they resell, not a program they operate.

5. How do you verify backups are actually restorable, and how often?

Almost every MSP says they back up your data. Far fewer test whether that data can actually be restored. Ask for the specific testing cadence, whether backups are immutable and isolated from the production network, and what the documented Recovery Time Objective and Recovery Point Objective are for your environment. Backing up data is only half the equation. A provider who has never had to answer “when did you last actually restore a full environment from backup” has not thought hard enough about the difference between having backups and having real disaster recovery.

6. Can compliance work be proven with actual completed engagements, not just a claim?

If your business is subject to HIPAA, CMMC, PCI, or SOC 2, “we do compliance” is not the same statement as “we have completed CMMC Level 2 assessments alongside C3PAO partners” or “we have built HIPAA-compliant environments for three medical practices your size.” Push for specifics: named frameworks, named prior engagements, and documentation they can produce. A provider without direct experience in your regulatory environment will learn on your business, at your expense, during your audit.

7. Who, specifically, is my dedicated point of contact, and how many other accounts do they carry?

This question separates providers who deliver real white glove service from providers who route you into a ticket queue and call it personalized support. A named consultant carrying fewer than 25 accounts can actually know your environment. A named consultant carrying 80 accounts is a name on a signature block, not a relationship. Ask directly for the number.

8. How does your model scale if we grow from 30 employees to 150?

Gartner evaluates MSPs partly on Ability to Execute, which is a direct proxy for whether a provider can handle your growth without degrading service for the clients they already have. Ask what their largest current client looks like, whether they have handled growth of this magnitude before, and what specifically changes in your service model as you scale. A provider who serves your business well today but has never actually supported a client through 5x growth is asking you to be their test case.

9. What is your project work pricing, separate from the recurring contract?

Recurring managed services rarely cover everything. Cloud migrations, security stack overhauls, compliance program buildouts, and office moves typically fall outside the base scope. Budget an additional 20 to 30 percent of annual contract value for project work in a typical year, and get the hourly or project based rates for common categories in writing before signing. A provider who cannot give you real numbers here will surprise you later with numbers they choose unilaterally.

10. Can I call three of your current clients directly, including one who has been with you through a difficult incident?

Every provider will hand you a curated reference list of happy clients. The more revealing ask is a client who has actually been through something hard: a breach, an outage, a compliance audit gone wrong. Ask specifically how the provider performed under pressure, not just during quiet months. Providers who resist this request, or who can only offer references who have never experienced a real incident, are showing you an incomplete picture on purpose.

How the ten answers map to real evaluation categories

The five red flags that apply across every question

Beyond the individual answers, five patterns show up repeatedly across weak MSP relationships, regardless of which specific question exposes them first.

• Long-term auto-renewal contracts with no clean exit. If leaving requires more effort than joining did, that structure exists for the provider’s benefit, not yours.
• Vague SLAs with no defined timeframes. “As quickly as possible” is not a commitment. It is the absence of one.
• No environment documentation. If the provider cannot produce current network diagrams, asset inventories, and configuration documentation for your own environment, nobody else, including a future provider, could take over cleanly.
• Resistance to third-party audits. A provider confident in their work welcomes independent verification. A provider who resists it is protecting something.
• Excessive add-on charges beyond the base price. The pattern from question two, quoted low and billed high through a growing list of exceptions.

Local versus national: which model fits

Part of the evaluation is deciding which structural model fits your business. A local Orange County provider typically offers faster on-site response and a genuinely dedicated account team, which matters most for businesses in regulated industries, businesses with hands-on infrastructure needs, or businesses that value a provider actually based where they operate. A national provider can make sense for businesses operating across multiple markets with a need for consistent coverage everywhere, though the tradeoff is usually less personalized service and slower on-site response for any single location.

Neither model is universally correct. What matters is knowing which one your business actually needs before you start evaluating, so you are not comparing a local provider’s strengths against a national provider’s different strengths as if they were the same category.

The honest version

Choosing a managed IT provider is a six to eight week process when done properly: scope your requirements precisely, send the same brief to three to five qualified providers, score every proposal against the same ten questions rather than against price alone, run a real reference check that includes at least one hard case, and negotiate exit terms before you need them. Most businesses compress this into a single sales call and a gut decision, then discover eighteen months later exactly what they skipped.

The ten questions above are not exotic. Every one of them is answerable, in writing, by a provider who actually operates the way their marketing claims. The businesses that ask them consistently end up with a partner. The businesses that skip them end up, eventually, needing this article a second time.

Related reading:
Managed IT Services in Orange County ·
7 Questions Every CEO Should Ask Before Signing an IT Contract ·
What White-Glove IT Actually Means ·
What an IT Assessment Should Actually Deliver ·
Book a Discovery Call