How to Choose a Managed Service Provider (MSP)

When your business outgrows the DIY approach to IT, you may consider outsourcing IT functions to a managed service provider (MSP). Or, maybe you've been working with an IT vendor who is no longer meeting your needs and you're ready to make a change.

Once you've decided that managed IT services are the right option for managing your IT, how do you choose the best MSP partner?

In this article, we'll walk through the five areas to consider when evaluating a potential managed service partner for your business.

As a managed service provider, Innovative gets a lot of questions from businesses choosing an MSP. While we certainly follow MSP best practices, we're not the perfect fit for every business. For the remainder of this article, we'll remove ourselves from the equation and present an unbiased outline of how to evaluate a managed service provider.

Role of an MSP in Your Business

Before we dive into evaluating an MSP, let's define the role they'll play in your business.

A managed service provider is a third-party that administers and oversees the technology functions within your business.

They typically serve as the entire outsourced IT department. They work directly with the CEO or executive management team to fill all IT-related roles in the company, from CIO to front-line technical support.

In the case of larger organizations, an MSP might partner with an internal IT team or individual resource. In those cases, clear roles and responsibilities must be defined. For example, this checklist outlines traditional IT functions and serves as a way to identify and document areas of responsibility between the MSP and the internal IT team.

If roles and responsibilities are not clearly defined, a ball will inevitably get dropped due to a miscommunication between your internal IT people and the MSP (i.e., the MSP thinks your folks are doing something that they think the MSP is handling). Don't set yourself up for failure by working with an MSP that doesn't clearly define their role and areas of responsibility.

A Note About Technical Skills

You probably noticed that technical skill is not one of the five areas on which you will evaluate an MSP. Technical skills are necessary, but they're not the primary value an MSP brings to the table.

The value of an MSP doesn't come from its technical ability. The value of an MSP comes from their business expertise paired with technical skills. Their role is to adapt technology to meet the goals of your business.

Anyone with technical knowledge can fix a computer, set up a basic network, or clean up a virus.

The value of an MSP comes from things like:

• Advising you on when to replace the computer and help you build an IT budget to prepare for that cost.
• Designing a network that can scale at the same pace your businesses is growing.
• Advising you on compliance requirements to not only prevent viruses but make sure your risk mitigation is documented and evaluated per specific compliance and regulatory standards of your industry.
• Bringing an entire IT team to the table which eliminates the need to fill gaps in support due to vacations and employee turnover.

So, while you won't evaluate the technical skills of individual network technicians, you can absolutely identify an MSP that:

• Has a defined hiring, evaluation, and professional development programs to assess the knowledge of the team and develop new skills.
• Has a track record of successful projects and an overall positive impact on their clients' businesses.
• Has documented security controls and account management practices.

MSPs can't possibly demonstrate those things without adequate technical skills. But all the technical expertise in the world won't deliver tangible benefits to your business without strategy.

Five Factors in Evaluating a Managed Service Provider

Customer Service

Every vendor in every industry claims to have excellent customer service. So why bother putting this on the list?

Yes, customer service is difficult to quantify beyond client reviews and testimonials. But there are ways to document service. A good MSP tracks those metrics and can easily provide them.

Of course, you should check out things like Google and Facebook reviews, as well as client testimonials. They provide important anecdotal insight into the reputation of the MSP, but there's more you can look at to evaluate an MSP's service record.

Service Level Agreement

A Service Level Agreement (SLA) is a contractual commitment by a third-party vendor to meet specific service metrics.

Your managed services contract must include a clearly defined Service Level Agreement (SLA).

An MSP's SLA should outline the following:

• What services are included in the SLA? We'll talk through those possibilities in a minute.
• How to report a problem or request service. The SLA should include specific instructions for requesting service, usually by phone, email, or directly through a web portal or ticketing system.
• Support hours and definition of how requests submitted outside of the support hours are handled. This may be as simple as stating that the MSP provides 24/7 support, or they may define service hours and limit after-hours support.
• Your responsibilities. For the MSP to meet their service commitment, you are likely responsible for providing certain things. Examples include adequate internet service, up-to-date equipment, and malware protection.
• Response and resolution times. The SLA should define how quickly you'll receive a response to your request for service and how quickly the MSP will resolve the issue.

Check out Innovative Service Level Agreement page for an example of defined response and resolution times.

Service Metrics

You cannot measure what is not defined. The SLA defines the MSP's commitment to service. They must also measure how frequently they meet or exceed those commitments.

A quality MSP documents and tracks their SLA performance record across all clients and requests for service.

It's not good enough to say they'll answer the phone within minutes or resolve issues within a business day. How often do they meet that commitment?

At Innovative, we track and report on the following metrics each quarter:

• The number of requests for service.
• Average client satisfaction score.
• Average phone hold time.
• Percent of service requests resolved within the SLA time-frame.

Product and Service Offerings

Managed service providers include some level of network monitoring and help desk support in their service packages. Additional services, levels of service, and types of support (i.e., remote vs. on-site) vary from MSP to MSP. You must understand precisely what services are available and which of those services are included in your contract. You can find an in-depth description of service options in this article about what managed IT services you can expect from an MSP.  

At a minimum, your MSP should deliver the following services:

• Network monitoring and management, including issue resolution.
• Help desk with remote and on-site support.
• Vendor management.
• Backups and disaster recovery.
• Anti-virus and threat detection.
• Licensing and renewals.

Network monitoring and management, including issue resolution

Network monitoring is a software solution that audits the function and health of your devices (computers, servers, firewalls, wireless access points, etc.). Your MSP should install monitoring software on all of your devices and receive notifications about performance issues. These issues are typically things like low disk space, slow performance, or lost connection to the network.

In addition to receiving the alerts, your MSP must respond to and resolve monitoring issues within the SLA terms. A monitoring solution is useless if the alerts are not reviewed and resolved in an appropriate timeframe.

Help desk with remote and on-site support

A help desk is staffed by a team of technicians that troubleshoot IT issues for end-users. Most help desks can solve basic IT problems through a remote connection to the user's computer. 

Your MSP's support obligation should not end at that basic, Level I, remote support capability. Choose an MSP with a defined process for elevating higher-level issues to higher-skilled technicians. Your MSP should also have local field service technicians that can deliver support on-site at your business location when necessary.

Vendor management

Have you ever called your internet service provider to report slow speeds, only to have them tell you the issue is in your network? When you call a local "IT guy" for help, he says the internet service provider needs to fix it. You're stuck in the middle of two vendors pointing fingers and at each other, and your valuable time is tied up with repeated phone calls relaying information you don't understand.

Your MSP should serve as an intermediary between all vendors. They should ask that you report all technology-related issues to them. They work directly with any necessary vendors on your behalf. If the problem is with another vendor, it's the MSP's responsibility to communicate with the vendor. They can provide documentation of the troubleshooting they've done on the network side to demonstrate where the issues lie.

Backups and disaster recovery

There are many different types of backup solutions on the market, and your MSP should help you choose a solution that meets your needs.

They'll help you identify:

• The amount and location of data to back up.
• Where backups are stored.
• How frequently to back up.
• How to restore data from backup when necessary.

In addition to identifying a backup solution to meet your business needs, your MSP needs the capability to manage and monitor your backups. Backup management is a critical piece to any managed services contract, and you must pay close attention to how the MSP proposes to handle it. Be sure your MSP tests and repairs backups regularly as part of your service contract.

It is unlikely that any MSP includes total, catastrophic disaster recovery in your service. But they'll likely handle limited recovery efforts if you work with them to implement an acceptable backup and disaster recovery plan. In IT terms, a disaster might be the result of something as serious as a cyberattack or natural disaster, to things as simple as lost data due to user error. Your MSP should clearly define their terms for disaster recovery, what if any, recovery efforts they include in your contract, and how they will handle (and charge for) a catastrophic disaster.  

Anti-virus and threat detection

Your MSP must advise you on an appropriate cyberthreat prevention strategy, including an appropriate anti-virus solution. Much like backups, there are a variety of anti-virus solutions on the market. Your MSP needs to administer a solution that they can manage and access on your behalf to deliver the most effective support. Your anti-virus solution must integrate with the MSP's network monitoring software. This allows them to proactively manage and respond to any anti-virus alerts, ideally before they create significant issues.

Licensing and Renewals

Your MSP must document all your application licenses, domain registrations, service contracts, and anything else that requires renewal. License renewals often fall through the cracks of even the most seasoned IT teams. Your MSP manages renewals for potentially thousands of clients and needs a clear system for handling them. The licensing and renewal process is what ensures your domain doesn't expire, and your email keeps working through your Microsoft 365 subscription. So, it is an essential element of your MSP's service.

Organization and Culture

A good managed service provider is a partner to your business. They engage with your executives in strategic business decisions. Their support team, at some point, will communicate with nearly every employee in your company. To build the best partnership with an MSP, get to know their organizational structure and culture, and be sure that it aligns with your company culture.

Organization and Leadership Structure

Many MSPs start as one-person contractors providing as needed, break/fix IT support. By the time they grow and evolve into an MSP, they need a clear organizational structure and multiple leaders authorized to make decisions. Your MSP holds the keys to your business. That information cannot reside with one person alone.

To ensure your service and support is not interrupted by the absence of one person (even and especially the MSP owner), the MSP must have the following to elements in place:

• A secure, encrypted documentation system that gives any authorized employee the information and access (like administrative passwords) to pick up your service where another employee leaves off.
• Redundant decision-makers who can authorize the use of funds and negotiate services. You'll likely have some pass-through services with your MSP, for example, Microsoft 365 licenses. If the business owner is the only person authorized to pay that monthly Microsoft bill, you risk losing access to critical systems like email and cloud storage if that person is out of the picture for any period.

Culture

Cultural fit is something that isn't considered enough when evaluating potential vendors, particularly those be as integrated into your business as an MSP. You want to find an MSP that has high employee satisfaction and low turnover. Talk to as many employees as you can before you sign a contract, particularly those who are going to come into your business to administer support. Get a sense for how they'll fit into your culture and communicate with your team. Is their culture and communication style in line with your own company culture and communication expectations? Will your employees work well with them?

MSPs often provide great entry-level opportunities to IT professionals because they quickly build knowledge and experience across a wide variety of businesses, industries, and systems. It's not uncommon for an MSP to hire a lot of techs early in their careers. Their culture must be positive and supportive enough to retain those new employees and attract more seasoned professionals for higher-level positions. Employee recruitment is incredibly competitive in the IT field, and an MSP that lacks a positive culture and employee satisfaction is unlikely to attract and retain the best talent.

Security Practices

MSPs are a target for cyberattacks, but that doesn't mean your systems are any less secure without them. It means that MSPs must be even more diligent about security than the average business. You must work with an MSP who takes their own cybersecurity seriously.

Here are the essential security practices to look for in an MSP:

• A documented process for changing passwords and restricting access when employees leave the company.
• Patch management. Be sure your MSP manages and monitors their own network as well as you expect them to manage yours. This includes deploying critical security patches to all devices.
• Encryption of all sensitive data, especially the system used for network documentation.
• Multi-factor authentication (MFA) required for all systems. MFA requires all users to go through two or more security steps to sign into systems containing sensitive information. This usually includes entering a password, followed by a security verification code that is generated by an authentication app on another device. You've probably encountered MFAs when you sign in to your online banking, and you are asked to confirm your identity by entering a one-time code sent to you via text message.
• Access logs and control. Employees should not share any sign-on credentials. The MSP must monitor and control who accesses or changes information. They should also have a tiered system for limiting different types of access to different groups of employees.
• Regular security audits that identify any security gaps and a plan for preventing mitigating security risks.
• A disaster recovery plan that addresses how they will handle a large-scale cyberattack or other disasters.

Account Management

As we stated early on, the most significant value a managed service provider brings to the table is not technical; it's strategic. Your MSP's approach to account management plays a significant role in the benefits you'll get out of the partnership. Account managers may have different titles in different MSPs. They might be called consultants, account managers, success managers, or any combination of those terms. No matter what title they have, be sure your MSP assigns you a dedicated, strategic contact.

Account management serves the following functions:

• Strategic consulting.
• Budget planning.
• Partnership and advocacy.

Strategic Consulting

Your account manager is your partner and your point of contact for high-level discussions. They may serve as your strategic consultant, or work with other members of the team to facilitate various consulting services. Your MSP may offer various levels of consulting based on the scope of your business. The exact consulting process varies per MSP but look for terms like strategy consulting, technology consulting, virtual CIO (vCIO), fractional CIO, or technical account management. At a minimum, your account manager should communicate with you regularly and sit down with you at least a few times a year to go over a formal strategic planning document. If you are a larger, more mature business, you may speak with your account manager, vCIO, or consultant almost daily. Be sure you are comfortable with them, and see them as someone with whom you can build a trusted relationship.

Budget Planning

Your account manager must work a few steps ahead of you. They help you proactively budget for regular replacements and necessary IT projects like office moves, new employees, server upgrades, etc.

Account managers help you identify and budget for:

• A replacement schedule for existing hardware.
• Equipment upgrades are necessary to maintain compliance or software functionality.
• New network or equipment installation to accompany business growth.

Partner and Advocate

Your account manager is your partner. They must advocate on your behalf to other players within your business and within the MSP. It's their responsibility to mitigate any service issues with their service team and manage the planning phases of any IT projects. When they advocate within your business, they may do things like present to your board of directors, or provide your accounting team with budget justifications.

Your MSP Partnership Gets Stronger Over Time

As your MSP gets to know your business, your partnership will grow and evolve over time. The longer you work together, the better they get to know you, and the more value they can bring to your business. But that makes it difficult to evaluate an MSP before you enter into a partnership. Assessing the five areas outlined in this guide gives you the tools to evaluate and choose the best MSP before you sign on the dotted line.

Evaluate potential MSPs in these five areas:

• Customer Service – Defined SLA and documented service metrics.
• Product and Service Offerings – Include all services necessary to keep your business running with no surprises for day-to-day support.
• Organization and Culture – Redundant decision-makers and a culture aligned with your corporate culture.
• Security Practices – Documented security practices to minimize risks.
• Account Management – A dedicated advocate responsible for aligning technology with your business.

Use this approach to identify an MSP partner who is best positioned to support your business.