Free matching service — we find IT providers who fit your industry and size. Get matched →
← Back to Resources
MSP Evaluation 18 min read Updated May 18, 2026

How to Evaluate an MSP in 2026: The Complete Business Owner's Guide

Most businesses pick an IT provider the same way they pick a contractor — whoever calls back first and sounds confident. That's how you end up locked into a bad contract for three years. This guide walks you through the actual evaluation process, from scoping what you need to the reference questions that expose providers before you sign.

Quick answer A rigorous MSP evaluation takes 6–8 weeks: scope your requirements, send an RFP to at least three qualified providers, score proposals on SLA terms and security stack (not just price), run a structured reference check, and negotiate contract exit terms before signing. The providers who resist this process are the ones you shouldn't hire.

1. What You're Actually Buying

Before you evaluate a single provider, you need to understand what managed IT services actually is — because the MSP industry has done an exceptional job of making it sound like a commodity when it isn't.

When you hire an MSP, you're buying four distinct things at once:

  • Monitoring and management: Continuous oversight of your servers, workstations, network, and cloud systems — catching problems before they become outages.
  • Helpdesk support: A team that responds when your people have IT problems, measured by how fast they respond and how well they resolve issues.
  • Security operations: Patching, EDR management, backup verification, email security, and access management. This is what separates a real MSP from a help desk service with a monitoring dashboard.
  • Strategic advisory: vCIO-level input on your IT roadmap, budget, compliance requirements, and vendor relationships. Most small-business MSPs skip this. Mid-market providers should include it.

The reason this matters: when you're comparing proposals, you're almost never comparing apples to apples. One proposal might include EDR, backup, and email security. Another might include "endpoint protection" (which might just be antivirus) and "backup monitoring" (which might not include tested restores). Unless you understand what each line item means, you'll optimize for price and get the worst deal.

The baseline minimum in 2026: Any MSP proposal that doesn't include EDR (not just antivirus), tested backup restores (not just backup monitoring), MFA enforcement, and a documented incident response plan is missing the security foundation. Anything below this floor isn't fully managed IT — it's monitoring with a helpdesk.

2. Scoping Your Requirements Before You Talk to Anyone

The most common mistake in MSP evaluation is starting the process by taking sales calls. Sales calls are designed to let the provider scope the conversation. You want to scope it yourself first.

Before you talk to a single vendor, document these six things:

Your environment inventory

  • How many users need IT support?
  • How many physical locations?
  • What's the mix of Windows/Mac/Linux?
  • What cloud platforms are you on (Microsoft 365, Google Workspace, AWS, Azure)?
  • What business-critical software does your team run daily?
  • What networking equipment do you have (and is it under warranty)?

Your compliance requirements

This is where businesses consistently underestimate what they need. If you're in any of these situations, your MSP must understand the specific compliance framework:

  • Healthcare or companies handling patient data → HIPAA
  • Financial services (RIAs, insurance, mortgage, accounting) → GLBA Safeguards Rule
  • Defense contractors handling CUI → CMMC Level 2
  • Companies with EU customers → GDPR
  • Companies with California customers over certain thresholds → CCPA

Your support model requirements

  • What are your business hours? Do you need after-hours coverage?
  • Do your employees travel or work remotely?
  • How frequently do you need an onsite technician versus remote support?
  • What's an acceptable response time for a critical outage (server down, ransomware event)?
  • What's acceptable for a standard helpdesk ticket (can't print, password reset)?

Your pain points with current IT

Document specifically what's broken or inadequate about your current situation. "Our IT company is slow" is not useful. "Our average ticket resolution time is 3 days and we had two server outages last quarter that lasted 4+ hours each" is useful. Specific pain points let you evaluate whether a new provider would actually solve them.

Your budget range

Know your number before you go in. Market rate for small business fully managed IT is $100–$175 per user per month. Mid-market with compliance requirements runs $150–$250/user/month. If you have 30 users and $1,500/month to spend, that's $50/user — which is below the floor for real managed IT. Know this before you collect proposals so you're not surprised.

Your deal-breakers

Every business has one or two requirements that are non-negotiable. Write yours down before you talk to anyone. Common examples: must be able to sign a BAA, must have a local technician within 30 miles, must support Salesforce, must have CMMC experience. These filter your candidate list before you waste time on proposals from providers who can't actually serve you.

3. Finding Qualified Candidates

Where you find MSP candidates determines the quality of the pool you're evaluating. Most businesses do one of two things: Google "IT support near me" or ask a peer for a recommendation. Both approaches work — but neither is reliable alone.

Peer referrals (highest quality, limited pool)

The best MSP leads come from business owners in your industry who run a similar-sized operation. Not from your IT person's former employer. Not from your accountant's brother-in-law. From someone who actually uses them, pays them monthly, and has lived through an incident with them.

When you ask for a referral, ask this specifically: "Has your IT provider ever had to respond to a real incident — not a slow computer, but an actual outage or security event? How did they respond?" The answer tells you more than any sales call.

Industry associations and communities

Your industry association likely has a vendor directory or peer community where members share IT provider recommendations. If you're in healthcare, legal, manufacturing, or financial services, there are industry-specific MSPs who live in your world. Find them through your peers, not through Google.

SerenIT matching (no obligation)

SerenIT matches businesses with vetted MSPs based on industry, size, compliance requirements, and location — not on who pays us the most. Use the matching service here if you want qualified candidates without the cold call inbox flood.

Building your shortlist

You want 3–5 providers in your evaluation pool. Less than three gives you no baseline. More than five becomes unmanageable. Filter your initial list using your deal-breakers: if CMMC compliance is required and a provider says they "do compliance," that's not the same as having completed CMMC assessments with C3PAO partners. Cut anyone who can't be specific.

Red flag before you even start: Any MSP that gives you a proposal without asking detailed questions about your environment, compliance requirements, and current pain points is not evaluating your needs — they're pasting your user count into a pricing template. That's a sign of what the relationship will look like.

4. The RFP and Proposal Process

You don't need a formal Request for Proposal for a small business MSP evaluation. But you do need to give every provider the same information and ask the same questions — otherwise you're comparing answers to different questions, which tells you nothing.

What to include in your information packet

  • User count and location count
  • Current tech stack (Microsoft 365 or Google Workspace, key business applications, network equipment)
  • Compliance requirements (be specific)
  • Support hours required and response time expectations
  • Pain points you're trying to solve
  • Budget range (yes, share it — providers who won't quote within your range are wasting both your time)
  • Timeline for decision

What to ask every provider

Ask these questions in writing. Answers to written questions are more considered, and written answers can be compared side-by-side:

  1. What is your current client-to-technician ratio?
  2. Describe your after-hours response process — not your on-call policy, the actual process.
  3. What EDR platform do you use and how are alerts monitored?
  4. What does your backup solution include, and how often are restores tested?
  5. Describe your onboarding process. What happens in the first 30 days?
  6. What compliance frameworks have you actively implemented? Provide specifics.
  7. What is your exit process if a client leaves? How long does offboarding take and what do you provide?
  8. What is the penalty if you miss a response time SLA?

The last question is the one that separates real providers from those selling on promises. Get the answer in the proposal and verify it's in the contract.

5. Scoring Proposals: A Framework That Works

When proposals come back, normalize them before you compare prices. Price is the last thing you should compare — and only after you understand what each price actually includes.

Step 1: Normalize to per-user per-month

Convert every proposal to a single number: total monthly cost divided by number of users. Now you have an apples-to-apples base.

Step 2: The inclusion checklist

For each proposal, mark whether these are included or extra-cost:

ItemMust Be IncludedProvider AProvider BProvider C
24/7 remote monitoringYes
Helpdesk with defined SLAYes
Automated patch managementYes
EDR (not just antivirus)Yes
Backup monitoring + tested restoresYes
MFA enforcementYes
Email security / anti-phishingStrongly recommended
After-hours critical supportDepends on your needs
Onsite visitsDepends on your location
vCIO / strategic advisoryMid-market: yes
BAA signing capabilityIf regulated industry

Step 3: Score on the eight factors that matter

Score each provider 1–5 on each dimension:

  1. SLA terms and enforcement — Are response/resolution times defined by priority level? Is there a contractual penalty?
  2. Security stack completeness — EDR, tested backups, MFA enforcement, email security all included?
  3. Client-to-technician ratio — Under 80:1?
  4. Industry expertise — Do they have verifiable experience in your specific vertical?
  5. Reference quality — Can they provide three references your size in your industry?
  6. Contract flexibility — Reasonable contract length (1–2 years), exit clause, data portability?
  7. Communication model — Do you have a named account manager? How are escalations handled?
  8. Onboarding plan — Is there a structured first-30-days process documented?

Price enters the equation only after you score all eight dimensions. The cheapest provider who scores below 3 on SLA terms and security stack is the most expensive option — you just don't feel it until something goes wrong.

6. The Reference Check: The Most Overlooked Part of the Evaluation

Most businesses either skip references entirely or ask the wrong questions. Providers curate their reference list — you're talking to their happiest clients. The goal is to ask questions that get honest answers from even a curated reference.

The three most revealing reference questions

  1. "Tell me about the worst incident you've had in the past year. How did the team respond?"
    Every business with real IT has had at least one outage or security event. References will answer this honestly because it's specific and their answer reflects on them as much as the provider. A reference who says "we've never had an incident" isn't credible — a real business does. The honest answer tells you how the provider performs under pressure.
  2. "What does communication look like when something is wrong — not the resolution, the communication?"
    This separates providers who fix problems from providers who fix problems and disappear for four hours. Communication during incidents is the thing businesses complain about most when they switch providers. A good reference will have a specific answer about frequency and format of updates.
  3. "Knowing what you know now about this relationship, would you sign the same contract again?"
    This question gives the reference an out — they can say "mostly, except..." and often will. You'll hear about price creep, communication gaps, or response time issues that weren't visible in the sales process. The answer is almost always more nuanced than a simple yes or no, and the nuance is what you're looking for.

Additional reference questions worth asking

  • How long has your business been with this provider?
  • Do you feel like they understand your industry's specific IT requirements?
  • Have you ever needed to escalate a problem? How was it handled?
  • What does the monthly reporting look like — what do you actually see?

Ask for one reference from a client who has switched providers while working with this MSP. Any company that's been growing has migrated platforms, changed ERPs, or added acquisitions during their MSP relationship. How the provider handles complexity and change tells you more than steady-state performance.

7. Contract Red Flags: What to Demand Before Signing

IT contracts are written by the provider's lawyers to protect the provider. That's not a complaint — it's the nature of contracts. Your job is to negotiate the terms that protect you before you're in a bad situation with no leverage to leave.

Non-negotiable contract requirements

  • Contract term under 3 years. Two-year terms are standard. Three years is acceptable if you're getting a significant discount and the exit clause is solid. Anything longer is a red flag — you're taking all the term risk.
  • Exit clause for SLA failure. You need the right to terminate without penalty if the provider misses SLA consistently. Define "consistently" in the contract — something like "three or more P1 response time violations in a 90-day period."
  • No auto-renewal with a 90-day+ opt-out window. Auto-renewals with long opt-out windows trap you into another term if you miss a date. Negotiate this down to 30 days or eliminate the auto-renewal entirely.
  • You own your credentials and licenses. Your Microsoft 365 or Google Workspace tenant must be in your name, billed to your credit card. If the provider holds the license, they hold leverage. Get language explicitly stating you retain ownership of all credentials, licenses, and account access.
  • Data portability on exit. You are entitled to all your data, documentation, configurations, and credentials within 30 days of contract termination. Get this in writing. Providers who resist this clause are planning to make it difficult to leave.
  • Defined scope of "project work." Managed IT contracts almost universally exclude "project work" from flat-fee billing. Define what constitutes a project versus standard managed service. Without this definition, you'll be surprised by project invoices for tasks that feel routine.

Contract language red flags

  • "Provider reserves the right to change pricing with 30 days notice" — negotiate to 90 days and limit the increase percentage
  • "Client is responsible for all software licensing" with no definition of what that includes — clarify before signing
  • "SLA measured on a best-efforts basis" — SLAs are meaningless if they're not contractual commitments
  • No mention of what happens to your data after contract termination
  • Arbitration clauses that require out-of-state arbitration — negotiate to your jurisdiction

Have an attorney review any IT contract over $50,000/year. A two-hour legal review costs $400–$800 and can save you from a three-year commitment to a provider who performs below expectations. The cost is trivial relative to the exposure.

8. The SLA Deep-Dive: What Your Contract Should Actually Guarantee

The SLA is the most important part of your IT contract and the part most businesses don't read carefully. Here's what it needs to contain to actually protect you.

Response time vs. resolution time

These are different commitments. Response time is how long until someone acknowledges your ticket. Resolution time is how long until the problem is fixed. Both should be defined separately for each priority level. A provider who only defines response time is giving themselves unlimited time to actually fix things.

Priority levels should be defined in the contract

PriorityDefinitionTypical Response SLATypical Resolution SLA
P1 — CriticalBusiness operations halted (server down, ransomware, site outage)15–30 minutes4 hours
P2 — HighSignificant business impact, workaround exists1–2 hours8 hours
P3 — MediumSingle user affected, workaround available4 hoursNext business day
P4 — LowMinor issue, request, or question8 hours3–5 business days

The penalty clause

This is what makes the SLA real. Without a penalty, missing an SLA has no consequences — the provider apologizes and moves on. Your contract should include at minimum:

  • Service credits (typically 10–20% of monthly fee) for each SLA violation above a defined threshold
  • Right to terminate for cause after repeated violations, with specific triggers defined
  • No penalty clause to apply if the failure is caused by client action or third-party outage (legitimate carve-out)

Providers who say "we don't include penalty clauses because it's a trust-based relationship" are telling you they don't intend to be held accountable. A confident provider will put their commitments in writing.

Measurement and reporting

The SLA is only useful if you can see how the provider is performing. Your contract should specify monthly reporting that includes ticket volume, response time performance against SLA, resolution time performance against SLA, and any violations. Without this reporting, you'll never know if they're meeting the SLA or just telling you they are.

9. What Good Onboarding Looks Like

Onboarding is the period most likely to make you regret a decision. The transition from your old provider to your new one is when everything that wasn't documented becomes a problem. A provider with a rigorous onboarding process is a provider who has done this enough times to know where things go wrong.

What good onboarding includes

  • Environment discovery: Your new MSP should document every device, every application, every network configuration, and every credential they'll need to manage your environment. This takes 2–4 weeks for a typical small business. If they're ready to take over in week one, they're guessing.
  • Credential transfer: A formal process for transferring (not just receiving) admin credentials from your previous provider — with verification that they actually work.
  • Security baseline assessment: Before making changes, a good MSP documents your current security posture: patch levels, backup status, MFA coverage, EDR deployment. This becomes the baseline they're measured against.
  • Communication setup: How your team submits tickets, who their primary contact is, what the escalation path is for critical issues, and what the reporting cadence will look like going forward.
  • 30/60/90 day check-ins: Structured reviews at 30, 60, and 90 days to identify anything that wasn't accounted for in the initial scoping and address it before it becomes a problem.

The transition overlap question

Ask every provider: "What is your process for the transition period — specifically the overlap between your onboarding and my previous provider's offboarding?" A provider who has never thought about this question has never managed a difficult transition. A good answer describes a specific handoff protocol and a period where both providers have access to ensure nothing falls through.

Never cancel your current provider before your new one completes environment documentation. The leverage you lose the moment you inform your current provider you're leaving is significant. Wait until your new MSP has documented your environment and you have verified copies of all credentials and configurations.

10. The First 90 Days After You Switch

The honeymoon period in an MSP relationship is about 60 days — long enough for the initial enthusiasm to wear off but not long enough for the account to fall into steady-state management patterns. The first 90 days is when you establish what the relationship will actually look like.

  • Review the first month's reporting and verify it contains what was promised. If reporting is incomplete or late, address it immediately — this pattern compounds.
  • Test the escalation path with a non-critical incident. See how it's handled before you're in a real emergency.
  • Schedule your first QBR (quarterly business review) for day 90. A provider who pushes back on a 90-day review is a provider who doesn't want to be held accountable to what they promised in the sales process.
  • Document everything. Every incident, every resolution, every time the SLA was tested. After 90 days, you have a factual record of performance — not a subjective feeling about whether things are going well.

Frequently Asked Questions

How long does it take to evaluate and switch MSPs?

A thorough MSP evaluation takes 4–8 weeks: 1–2 weeks to scope requirements and build an RFP, 2–3 weeks for proposal review and site visits, and 1–2 weeks for contract negotiation. Onboarding after signing typically takes 30–60 days for complete environment documentation and transition. Rushing the evaluation creates the same problems you're trying to solve.

How many MSP proposals should I collect?

Get at least three proposals. Two gives you no baseline and no negotiation leverage. Five or more becomes unmanageable. Three from providers of comparable size and specialization gives you enough price variance to understand market rate and enough service variation to identify what's standard versus what's being upsold.

What is the most important thing to verify in an MSP contract?

The SLA penalty clause: what actually happens when the provider misses their response or resolution time commitment. An SLA without contractual remedies (service credits, right to terminate) is a marketing document, not a commitment. Verify this before signing — providers who resist putting it in writing are telling you they don't expect to meet it.

Should my MSP hold my Microsoft 365 or Google Workspace licenses?

No. Always maintain your own Microsoft 365 or Google Workspace tenant with a billing account in your company's name. When MSPs bundle your licenses into their billing, they become your account's owner — if you leave the relationship, they can hold your licenses hostage or threaten service disruption during migration.

What questions should I ask an MSP's references?

The three most revealing questions: (1) Describe the worst outage or incident you've had in the past year — how did the MSP respond? (2) What does communication look like when something goes wrong? (3) Knowing what you know now, would you sign the same contract again? References will answer these honestly because they're specific rather than general.

Tools That Help You Evaluate Vendors

📋
IT RFP Generator
Build a vendor RFP in minutes, not hours
🕵️
Vendor BS Detector
Decode what IT vendors are really saying
📄
Contract Scanner
Spot red flags before you sign
🔥
IT Sanity Check
Find out if your current IT is protecting you

Want us to find the right MSP for you?

We match businesses with vetted IT providers based on industry, size, and compliance needs — not on who pays us more.

Get Matched Free →