Questions to Ask Before Hiring an MSP

Contract and term

1. What is the minimum contract term, and what happens if I need to cancel early? Why it matters: long lock-in periods reduce your leverage if service quality drops. Good answer sounds like: a 12-month term with a defined, reasonable early-termination clause and no hidden penalties.
2. How much notice do I need to give to end the agreement? Why it matters: short notice periods make switching providers much easier if the relationship does not work out. Good answer sounds like: 30 to 60 days written notice, clearly stated in the contract.
3. Does the contract auto-renew, and on what terms? Why it matters: auto-renewal clauses can lock you in longer than expected if missed. Good answer sounds like: renewal terms stated in writing with a reminder sent before the renewal date.

Pricing and inclusions

1. Is pricing per user or per device, and what exactly is included at that price? Why it matters: the base rate means little without knowing what falls inside versus outside the fee. Good answer sounds like: a written scope document listing every included service line by line.
2. Is Microsoft 365 licensing included, passed through at cost, or marked up? Why it matters: licensing can be a significant share of total monthly cost. Good answer sounds like: a clear statement of how licensing is billed, with no ambiguity.
3. What triggers additional charges beyond the base fee? Why it matters: undefined boundaries lead to surprise invoices. Good answer sounds like: a specific list of what counts as a project versus routine support.

Response expectations

1. What is the guaranteed response time for a critical outage versus a routine request? Why it matters: vague promises like fast response mean nothing without a measurable number. Good answer sounds like: a written SLA, for example 30 minutes for critical issues and same business day for routine tickets.
2. How is response time measured and reported? Why it matters: a provider that cannot show you its own performance data likely is not tracking it. Good answer sounds like: a monthly or quarterly report showing actual average response times against the SLA.
3. What happens if the SLA is missed? Why it matters: an SLA without any consequence is just a suggestion. Good answer sounds like: a defined escalation path or service credit for repeated misses.

Backups and recovery testing

1. What is backed up, how often, and where is it stored? Why it matters: backup frequency and location determine how much data you could lose and how resilient it is to a site-wide incident. Good answer sounds like: daily backups with at least one copy stored offsite or in a separate cloud region.
2. When was the last time a full restore was actually tested? Why it matters: a completed backup job does not guarantee the data can be restored. Good answer sounds like: a specific recent date and a description of what was tested, not just an assurance that backups run.
3. What are the recovery time and recovery point objectives? Why it matters: these numbers define how long you could be down and how much data you could lose in a real incident. Good answer sounds like: specific hour-based figures agreed in writing, aligned to services like backup and disaster recovery or disaster recovery as a service.

Cybersecurity stack

1. What endpoint protection is included, and is it monitored 24/7 or just installed? Why it matters: installed software without active monitoring misses live threats. Good answer sounds like: managed detection and response or endpoint detection and response with an active monitoring team, not just antivirus.
2. Is security awareness training included for staff? Why it matters: most breaches start with human error, not a technical failure. Good answer sounds like: security awareness training with periodic phishing simulations included in the base plan.
3. How is multi-factor authentication enforced across accounts? Why it matters: MFA is one of the single most effective controls against account compromise. Good answer sounds like: MFA enforced by policy across all accounts, not left optional per user, consistent with how MFA protects your business.

Microsoft 365 and identity

1. Who administers our Microsoft 365 tenant, and do we retain the global admin credentials? Why it matters: losing administrative control of your own tenant is a serious business risk if the relationship ends badly. Good answer sounds like: the business retains ultimate ownership and at least one secured global admin account.
2. Is email security and anti-phishing protection layered on top of default Microsoft 365 settings? Why it matters: default settings are not sufficient protection on their own, as covered in Microsoft 365 security best practices. Good answer sounds like: additional email and collaboration security tooling beyond the default configuration.
3. How are data loss risks managed across SharePoint, OneDrive, and Teams? Why it matters: collaboration platforms hold sensitive data that can be exposed by oversharing. Good answer sounds like: active data loss prevention policies, not just default sharing settings.

Documentation

1. Do you maintain a current network diagram, asset inventory, and password vault for our environment? Why it matters: undocumented environments create dependency on individual technicians and slow down incident response. Good answer sounds like: yes, updated on a defined schedule and accessible to us on request.
2. Who owns this documentation if we ever change providers? Why it matters: documentation should belong to the business, not be held hostage by the outgoing provider. Good answer sounds like: the client owns all documentation and receives a full copy at any time.

RMM and endpoint management

1. What remote monitoring and management platform do you use, and what does it actually monitor? Why it matters: not all monitoring tools cover the same ground, and some only track uptime rather than security posture. Good answer sounds like: a named platform covering patch status, disk health, and security alerts, tied to remote monitoring and management.
2. How are mobile and remote devices managed and secured? Why it matters: unmanaged mobile devices are a common entry point for data loss. Good answer sounds like: enrollment in mobile device management with remote wipe capability for lost or stolen devices.

Account and data ownership

1. Do we own our domain names, licences, and cloud tenants outright? Why it matters: providers who register these assets under their own accounts can create major problems if the relationship ends. Good answer sounds like: all domains, licences, and tenants registered directly under the client's own accounts.
2. Can we export our data and configurations at any time without penalty? Why it matters: this determines how easily you could leave if needed. Good answer sounds like: a documented export process with no additional fee.

Offboarding

1. What does the offboarding process look like if we end the agreement? Why it matters: a vague or unwritten offboarding process is a red flag regardless of how the sales conversation goes. Good answer sounds like: a written offboarding checklist covering credential handover, documentation transfer, and a defined timeline.
2. How long do you retain our data after the contract ends? Why it matters: data retention policies affect your ability to recover historical records after switching. Good answer sounds like: a specific retention period, typically 30 to 90 days, stated in writing.

Disaster recovery

1. What is the plan if our main office becomes unusable, whether from fire, flood, or extended power loss? Why it matters: many businesses only discover their disaster recovery plan is inadequate during an actual disaster. Good answer sounds like: a documented plan referencing offsite backups, remote access capability, and a defined communication process.
2. Have you actually run a disaster recovery drill with a client before? Why it matters: a theoretical plan that has never been tested carries much higher risk of failure. Good answer sounds like: a specific example of a tested failover or drill, described concretely.

Insurance

1. Do you carry professional liability and cyber liability insurance? Why it matters: this protects your business if an error or breach originates from the provider's side. Good answer sounds like: yes, with proof of coverage available on request.
2. Will you assist with cyber insurance applications and renewals? Why it matters: cyber insurers increasingly require specific technical controls to be in place. Good answer sounds like: yes, including documentation support for underwriting questionnaires.

Reporting

1. What reporting do we receive, how often, and in what format? Why it matters: reporting is how you verify the service you are paying for is actually being delivered. Good answer sounds like: a regular, plain-language report covering patch compliance, ticket trends, and security posture, referenced in managed IT reporting.
2. Will someone walk us through the report rather than just emailing it? Why it matters: reports that nobody reviews together tend to go unread and lose their value. Good answer sounds like: a scheduled quarterly business review included in the standard agreement.

Question groups at a glance

How to use this checklist

Bring this list to every proposal conversation and take notes on the specific answers, not just whether a question was answered. Providers who respond with concrete numbers, named tools, and documented processes are demonstrating operational maturity. Providers who respond only with confidence and general reassurance are asking you to take their word for it.

If you already suspect your current arrangement is falling short of this bar, review the signs your business has outgrown its IT provider checklist first, then use this list when evaluating replacements. Once you have chosen a direction, how to switch IT support providers covers the practical steps for a clean transition.

Frequently asked questions