May 30, 2026
Hiring an IT services provider is a high-stakes decision that's hard to evaluate on the surface. Most MSPs sound similar in their pitch. The difference shows up six months later when you're either delighted or trying to extract yourself from a bad contract.
Here are the 15 questions we'd ask if we were on the buying side — organized by what they actually tell you about the relationship you're about to enter.
Pricing and contracts
1. "Is your pricing per user, per device, or per ticket?"
Each model has trade-offs. Per-ticket pricing aligns the MSP's revenue with your problems — you want fewer tickets, they want more. Per-user and per-device are flat and predictable. Be wary of any "hybrid" model that bundles a low base rate with per-ticket surcharges.
2. "What's included in the base rate, and what's billed separately?"
Get this in writing. If after-hours support, on-site visits, security incidents, or "projects" (migrations, deployments) are billed separately, find out the rates. Cheap MSPs cut corners in predictable ways.
3. "Show me a sample monthly invoice from another client (redacted)."
An invoice tells you everything. Are there many line items, surprise charges, project fees? Or one number that matches the contract? A good MSP will share a redacted sample without hesitation.
4. "What's the contract term? What's the off-ramp?"
If they push hard for 36 months, fine — but ask what happens if you're unhappy at month 6. Do you have an out? Is your data and documentation yours to keep? Many MSPs build their contracts so the off-ramp is painful and expensive.
Response time and structure
5. "What's your guaranteed response time for critical issues?"
Get a number in writing. "Industry-leading response times" is meaningless. "60 minutes for critical, 4 hours for high-priority, end of next business day for low-priority" is meaningful.
6. "Where is your team based?"
If your business is in New Orleans and the MSP is headquartered in Atlanta, ask where the actual support technicians are. Many regional MSPs use offshore L1 teams — not necessarily wrong, but you should know it.
7. "Who specifically will be on my account, and can I meet them?"
You're not hiring a logo, you're hiring a team. Get the names of the engineers who will actually do your work. Some MSPs assign an account manager (sales) but never let you talk to the engineers (delivery). You want both.
Cybersecurity
8. "What cybersecurity stack do you deploy and manage?"
You should hear specifics: endpoint detection and response (EDR) tool, email security (Microsoft Defender for Office 365, Mimecast, Proofpoint), security awareness training platform (KnowBe4, Hoxhunt), backup with immutable storage, MFA enforcement, etc. If they just say "we handle cybersecurity," push for the specific products.
9. "What's your incident response process?"
Ransomware, business email compromise, and account takeovers are no longer rare events. Ask: who do I call at 11pm on a Saturday if I think we've been hit? What happens next? How fast can you get on the bridge?
10. "What's your cyber liability insurance?"
If they get breached and it cascades into your environment, you want to know they carry enough insurance to absorb the loss. Ask for proof of $1M+ cyber liability and $1M+ E&O coverage.
Compliance
11. "Have you worked with clients under [HIPAA / CMMC / PCI-DSS] before?"
If you have specific compliance requirements, the MSP needs to have done it before. Ask for references at clients with similar obligations. A general-purpose MSP that's never been through a HIPAA audit is going to learn on your dime.
12. "Will you sign a BAA / DPA / equivalent?"
If you're under HIPAA, you need a Business Associate Agreement. Under GDPR-adjacent agreements, a Data Processing Agreement. Their willingness to sign tells you whether they're serious about compliance or treating it as a marketing checkbox.
Continuity
13. "What happens if our primary engineer leaves your firm?"
This happens. Good answer: "We have full documentation of your environment, redundant engineers cross-trained on your account, and a 30-day transition protocol." Bad answer: "That won't happen."
14. "Where is our documentation stored? Is it ours to keep?"
If you ever leave, will you get a complete copy of your environment documentation, passwords, network diagrams, asset register? Some MSPs lock all of this in their internal PSA tool. You want documentation in a format you can export and use.
The off-ramp
15. "If we decide this isn't working in six months, what does the transition look like?"
A good MSP has a transition-out process they're comfortable describing. They'll cooperate with your next provider, hand over documentation, and not make it painful. A bad MSP starts to get defensive even being asked.
Red flags during the sales process
Things that should make you pause:
- They can't show you a sample contract before pressuring you to sign
- They quote without scoping your environment first
- The pitch is heavy on awards / partnerships / certifications and light on what they'll actually do for you
- They won't connect you with current clients as references
- Their proposal has typos and the formatting is sloppy (if they don't sweat the details in sales, they won't in delivery)
- They don't ask many questions about your business — they're just selling a product
Our $0.02
The best signal in this process is whether the MSP is willing to be specific. Vague answers, brochure language, and "we'll handle everything" should make you nervous. Specific answers with numbers, names, and trade-offs should make you confident.
Want to talk through your specific situation?
Book a free 15-minute discovery call. No high-pressure pitch — just a straight conversation about whether we're a fit.