How to Compare IT Support, Cybersecurity, Response Times, Projects, Strategic Planning, and Accountability Before Choosing an MSP

Before hiring a managed IT provider, a business should understand five things clearly: how the provider supports employees, how it approaches cybersecurity, which responsibilities it owns, how it plans for the future, and how it proves that its service matches its promises.

For a 25–125 employee business, those questions reveal far more than a proposal’s monthly price. Two managed service providers can offer similar-looking agreements while delivering very different levels of help desk coverage, engineering expertise, cybersecurity, onsite support, project management, and strategic planning.

Organize your evaluation around five areas:

SUPPORT → SECURITY → OWNERSHIP → PLANNING → PROOF

The objective is to understand how the relationship will actually work after the contract is signed.

Start With What Happens When an Employee Needs Help

Almost every managed IT provider will say it provides responsive support. That statement alone tells you very little.

Ask what happens when one of your employees calls with a normal IT problem. Does that employee reach the provider’s own help desk or a third-party answering service? Is support available only during business hours, or can employees receive assistance nights and weekends? How are urgent problems escalated, and when does the provider send someone onsite?

Response time deserves particular attention because MSPs may define it differently.  An automated email confirming that a ticket was created is technically a response, but it does not mean a technician has started working with the employee. When comparing providers, ask how long it typically takes for an employee to begin interacting with someone who can actually troubleshoot the issue.

At AT-NET, for example, clients have access to an internally staffed 24/7/365 help desk with less than 60-second response. That is much more specific than simply describing support as fast.

Ask How the MSP Handles Problems That Don’t Fit the Help Desk

Routine employee support is only one part of an IT relationship.  A provider also needs a process for situations that require deeper engineering expertise. A server issue, complicated network problem, cloud configuration, security concern, or difficult line-of-business application problem may require someone beyond a frontline support technician.

Ask how those problems move through the organization. You should understand whether the MSP has its own escalation resources, how engineers become involved, and whether specialized expertise is readily available when the issue requires it.

This becomes especially important as the business grows. A provider that works well for a 10-person office may not have the engineering depth needed for a 100-person organization with multiple locations, servers, cloud systems, cybersecurity requirements, and specialized applications.

Find Out What After-Hours Support Actually Means

A provider may advertise 24/7 monitoring while providing employee help desk support only during normal business hours. Those are two different services.

Monitoring may detect that a server, firewall, or internet connection has gone down overnight. Employee support determines whether someone working at 9:00 p.m. can get assistance when they cannot access an application or sign in to their account.

Businesses with second shifts, remote employees, executives who travel, weekend operations, or employees working across time zones should understand this distinction before signing an agreement.

Ask whether technicians are available after hours, which issues qualify for assistance, whether after-hours support costs extra, and whether the people answering those requests are part of the MSP’s regular support organization.

Understand How Onsite Support Works

Remote support allows an MSP to resolve many employee and system issues quickly without sending a technician to your location, but it should not be the provider’s only option. Physical infrastructure still requires hands-on support, and businesses should understand how an MSP handles those situations before signing an agreement.

For example, a network outage may require someone to troubleshoot a firewall, switch, or wireless access point at the office. A workstation problem that cannot be resolved remotely may be faster to address in person, while equipment installations, office moves, infrastructure upgrades, and other physical changes can require technicians onsite for extended periods.

Ask prospective providers when they will send someone onsite, who performs that work, and how it is covered under the agreement. Some providers include certain onsite services within their monthly fee, while others charge separately or distinguish between routine onsite support and project work. The important part is understanding those boundaries before you need assistance.

Businesses with multiple locations should go one step further and ask how the provider supports each office. Find out whether the MSP has its own technicians within the areas you operate, how it handles locations outside its normal service area, and whether travel or additional charges could apply.

An MSP does not need a technician sitting down the street from every office, but it should have a clear and dependable process for getting qualified people onsite when remote support is not enough.

Security: Ask What the MSP Is Actually Responsible For

“Cybersecurity included” is too vague to use as a comparison point.

A managed IT provider may include basic endpoint protection and patching while treating email security, identity protection, security monitoring, vulnerability management, security awareness training, backup protection, or advanced security services as separate products.

Another provider may bundle many of those capabilities into its standard managed service.

The important aspect is that you need to understand which security responsibilities the provider will actually manage.

Ask the MSP to walk through how it handles endpoint security, multifactor authentication, Microsoft 365 security, email threats, patching, firewalls, vulnerabilities, suspicious account activity, and security monitoring. Where relevant, the discussion should also address compliance requirements and cyber insurance expectations.

Ask What Happens When Something Suspicious Occurs at Night

Cybersecurity becomes easier to evaluate when the conversation moves from products to scenarios.

What if Microsoft 365 detects suspicious account activity at 10:30 p.m. on a Saturday. What happens next?

Does someone investigate the alert? Can the provider disable an account or revoke active sessions if necessary? Who contacts your company? Does the MSP have authority to take certain protective actions immediately, or does it need approval first?  The answer helps reveal whether security monitoring is simply generating alerts or whether there is an operational process behind those alerts.

You can use the same approach for ransomware, a lost laptop, a compromised employee account, or suspicious email activity. Ask the provider to explain what its team would actually do.

Backup Is Not the Same as Recovery

Most MSP proposals mention backup, but fewer make it immediately clear how recovery works.  Ask which systems and data are backed up, how backups are monitored, how long data is retained, and how the provider verifies that recovery works. Leadership should also understand what happens when a single employee needs a deleted file compared with a larger event that requires restoring a server or critical business system.

For important systems, discuss Recovery Time Objective (RTO) and Recovery Point Objective (RPO). These help connect technical recovery capabilities to the amount of downtime and data loss the business can tolerate.

If an important system needs to be operational within four hours, a recovery design that realistically requires two days creates a business problem regardless of whether the company technically “has backups.”

Ownership: Define Who Is Responsible for What

A strong managed IT relationship has clear lines of responsibility.  The MSP may manage employee support, computers, Microsoft 365, networking, servers, cybersecurity tools, backups, and certain vendor relationships. The business may remain responsible for approving user access, notifying the MSP about employee changes, making business application decisions, approving purchases, and establishing business priorities.

Some responsibilities are shared, while others may fall outside the recurring managed service entirely.  This becomes especially important when something goes wrong. Ambiguous responsibility can lead to each party assuming the other was handling an important task.

Before choosing a provider, ask for enough detail that your leadership team could explain which responsibilities belong to the MSP, which remain with your company, and which require separate approval or project work.

Find the Line Between Managed Services and Projects

A monthly managed services agreement usually does not mean every future technology initiative is included at no additional charge.

Routine support and administration may be included while major cloud migrations, office buildouts, server replacements, large hardware deployments, acquisitions, application implementations, and infrastructure redesigns are handled as projects.

There is nothing inherently wrong with that structure. Problems occur when the boundary is unclear, so ask prospective providers to give you examples of work that is included in the recurring agreement and work that would normally become a separately scoped project. You should also understand how projects are identified, estimated, approved, and scheduled.

That gives finance much better visibility into the potential costs beyond the monthly managed services fee.

Ask Who Handles Your Other Technology Vendors

Vendor management can consume a surprising amount of employee time.

When an internet connection fails, employees may not know whether the issue belongs to the ISP, firewall, internal network, or cloud service. A problem with a line-of-business application can lead to the software vendor blaming the network while the network provider points back to the application.

Ask whether the MSP coordinates with internet providers, software vendors, phone providers, copier companies, cloud vendors, and other technology partners when troubleshooting requires multiple parties.  A provider that takes ownership of that coordination can remove a significant burden from employees who should not have to translate technical information between vendors.

Planning: Ask What Happens After the Immediate Problems Are Fixed

A managed IT provider should be able to explain how it helps clients plan beyond today’s support tickets.

Ask how the provider identifies aging equipment, technical risks, security improvements, capacity requirements, and upcoming projects. Then ask how those findings become a technology roadmap and budget.

For a growing SMB, a useful planning horizon is often 12, 24, and 36 months. The first year can contain specific purchases and projects, while years two and three provide visibility into larger investments that are approaching.

This is also where it helps to understand who performs the planning.

At AT-NET, the Technical Alignment Manager focuses on the technical environment and alignment, while the vCIO works with leadership on priorities, budgets, business decisions, and longer-term technology strategy.

Ask to See What a Strategic Review Actually Covers

Many MSPs promise strategic guidance. Ask what that looks like in practice.

A quarterly review should provide more than ticket statistics and a sales presentation. Leadership should be able to discuss support trends, infrastructure condition, cybersecurity, backup and recovery, projects, technology spending, upcoming business changes, and the roadmap.

Ask a prospective provider to describe a typical strategic review. You do not need to see another client’s confidential information, but the MSP should be able to explain its process and the types of decisions the meeting is designed to support.  That question helps distinguish a documented planning process from a vague promise of “strategic IT.”

Proof: Ask for Evidence Behind the Promises

Most MSP websites use similar language: proactive, responsive, strategic, secure, experienced, trusted.  Those words become useful only when the provider can explain what sits behind them.

If an MSP says it provides fast support, ask how response is measured. If it claims deep expertise, ask about its engineering team and escalation resources. If it promotes proactive management, ask what technicians review before equipment fails or users submit tickets. If strategic planning is part of the service, ask who performs it and what deliverables leadership receives.

You can also ask about relevant certifications, vendor relationships, years in business, staffing model, client experience, and references from organizations with similar requirements.  The purpose is not to turn the evaluation into an interrogation. It is to replace broad marketing claims with information your business can actually compare.

Questions That Sound Useful but Don’t Tell You Much

Some questions almost guarantee the answer you expect.

“Do you provide good customer service?” is unlikely to reveal anything because no provider will say no. Ask how support works when an employee calls, how quickly the employee reaches someone who can help, and how unresolved issues are escalated.

Instead of “Do you take cybersecurity seriously?”, ask which security responsibilities the provider assumes and what happens when suspicious activity occurs outside business hours.

Rather than “Are you proactive?”, ask what the provider reviews on a recurring basis, how it identifies aging infrastructure and technical risk, and how those findings reach leadership.

The more specific the question, the harder it is to answer with marketing language.

Compare How the Relationship Will Work, Not Just the Proposal

Once you have spoken with several providers, put their answers side by side.

This type of comparison helps more than placing three monthly prices next to each other because it shows what the business receives in exchange for those prices.

A less expensive provider may still be the right choice if your company needs a narrower service model. A more comprehensive provider may make sense when the business wants broader cybersecurity, deeper engineering resources, after-hours support, onsite capabilities, vendor management, and strategic planning.

Don’t Ignore the Exit Before You Sign

It may feel unusual to discuss ending the relationship before it begins, but the exit process deserves attention.

Ask who owns your Microsoft 365 tenant, domains, administrative accounts, documentation, configurations, and other important technology records. Understand what information the provider will return or transfer if the agreement ends and whether transition assistance is available.  Your company should maintain appropriate ownership and control over its business accounts and data.

Clear exit terms protect both parties and make future transitions easier, whether the relationship ends after two years or twenty.

Talk About Onboarding Before Choosing the Provider

The first several weeks of a new managed IT relationship can influence everything that follows.

Ask what the provider needs to learn about your environment, how it documents systems, how it deploys its management and security tools, how employee support transitions, and how existing vendors are introduced into the process.

You should also understand who leads onboarding and how the MSP handles issues discovered during the transition.  An environment that has been poorly maintained may reveal outdated equipment, security gaps, incomplete documentation, unsupported software, or other problems. Ask how those findings are prioritized and communicated rather than assuming everything discovered during onboarding is automatically included in the recurring service.

What Should You Know Before Comparing Managed IT Providers?

By the end of the evaluation, leadership should be able to answer five questions.

SUPPORT — What happens when our employees need help, including after hours and onsite?

SECURITY — Which cybersecurity, backup, and recovery responsibilities will this provider manage?

OWNERSHIP — What does the MSP own operationally, what remains our responsibility, and what requires separate project approval?

PLANNING — How will the provider help us identify technology needs and plan investments over the next 12–36 months?

PROOF — What evidence supports the provider’s claims about response, expertise, security, proactive management, and strategic guidance?

If those answers are clear, comparing providers becomes much easier because the decision is based on how each MSP will actually support the business.

Frequently Asked Questions About Hiring a Managed IT Provider

How many managed IT providers should a business compare?

There is no required number, but businesses should compare enough providers to understand meaningful differences in service models, scope, support, security, and planning. Evaluating a small group of qualified providers in depth is usually more useful than collecting a large number of proposals based primarily on price.

Should price be the main factor when choosing an MSP?

Price matters, but it should be evaluated alongside scope. A lower monthly fee can reflect a narrower service model, different support hours, fewer cybersecurity services, limited onsite coverage, or additional project charges. Comparing what each provider actually manages gives the price context.

Should cybersecurity be included with managed IT services?

Many MSPs include cybersecurity services within their managed offering, but the exact capabilities vary considerably. Businesses should identify which protections and security responsibilities are included rather than assuming every provider uses the term cybersecurity the same way.

How important is 24/7 IT support?

Its importance depends on how the business operates. Companies with evening or weekend operations, remote employees, multiple shifts, traveling executives, or employees in different time zones may place greater value on around-the-clock employee support.

Should an MSP provide onsite support?

Businesses should understand how onsite needs will be handled even when most support is delivered remotely. The appropriate model depends on the company’s locations, infrastructure, and operating requirements.

What should an MSP review with clients regularly?

Regular strategic reviews can cover support trends, infrastructure condition, cybersecurity, backup and recovery, projects, budgets, upcoming business changes, and the technology roadmap. The provider should be able to explain how those reviews lead to decisions and follow-up work.

Should I ask an MSP for references?

References can be useful, particularly from businesses with similar size, complexity, industry requirements, or service expectations. References should supplement the rest of the evaluation rather than replace a detailed review of the provider’s actual service model.

A Better Way to Choose a Managed IT Provider

Choosing an MSP becomes easier when the evaluation moves beyond broad promises and monthly pricing.

Ask prospective providers to explain how their teams work in real situations. Find out what an employee experiences when they need help, what happens when a security alert occurs after hours, how difficult problems reach senior engineers, how onsite needs are handled, and where recurring support ends and project work begins.

Then look beyond immediate support. Understand how the provider will maintain the environment, plan replacements, identify risk, build a technology roadmap, and communicate with leadership as the business changes.

Those conversations give you something much more useful than a stack of similar-looking proposals: a clear picture of what working with each provider will actually be like.

About AT-NET

AT-NET has helped businesses manage technology since 1999. Our managed IT clients have access to an internally staffed 24/7/365 help desk with less than 60-second response, more than 20 engineers, a dedicated Technical Alignment Manager, and a dedicated vCIO.

AT-NET provides managed IT, cybersecurity, cloud, backup and disaster recovery, infrastructure, and strategic IT services for businesses throughout North Carolina, South Carolina, Florida, and Eastern Tennessee.

Comparing Managed IT Providers?

AT-NET can evaluate your current technology environment, discuss your support and cybersecurity requirements, and help you understand what a managed IT relationship should look like for your organization.

Request an IT Assessment