Buyer's guide
How to Evaluate an MSP
A practical framework for choosing a managed IT provider — what to verify, what to ignore, and the red flags most businesses miss until it's too late.
Every MSP website says the same things: proactive, 24/7, trusted partner. Here’s how to tell them apart in ways that matter — including how to evaluate us.
Verify, don’t trust
For every claim on an MSP’s website, there’s a question that makes it real:
| The claim | The question that tests it |
|---|---|
| “Fast response times” | “Show me your ticket-time report for the last 90 days.” |
| “24/7 monitoring” | “Walk me through what happened the last time an alert fired at 3 a.m.” |
| “We do security” | “What’s your own internal security setup? Do you use MFA everywhere? Who audits you?” |
| “Proactive maintenance” | “Show me a sample patch report for a current client.” |
| “We know healthcare” | “Which regulation applies to my training deadlines — HIPAA or HB300 — and what’s the difference?” |
A good MSP answers these on the spot. A brochure-ware MSP changes the subject.
The five things that actually predict your experience
- Response process, not response promises. Who answers the phone? Is it a person who can fix things, or a dispatcher who creates tickets?
- Offboarding terms. Read the exit clause before you sign. How do you get your passwords, documentation, and data if you leave? A provider confident in its service makes leaving easy.
- Their own security. MSPs are prime attack targets because they hold keys to many businesses. Ask how they secure themselves.
- Documentation you can see. Ask to see (redacted) documentation for an existing client. If your environment lives in one engineer’s head, so does your business continuity.
- References in your size range and industry. A reference from a 2,000-seat company tells you nothing about how they treat a 100-seat one.
Red flags
- Long contracts with steep exit penalties and no service-level commitments
- Pricing that can’t be explained on one page
- No written incident response process
- Vague answers about who owns your data and credentials
- Every question answered with a product name instead of a process
Use this on us
Bring this page to a conversation with Black Lab and ask us every question on it. If any answer is fuzzy, you’ll have learned something valuable before it cost you anything.
Want a second opinion on your IT?
The MSP comparison report shows how your current setup stacks up — no obligation, no hard sell.