Hiring a managed service provider, the industry term for an outsourced IT department, is one of the highest-trust purchases your business will ever make. You are handing a vendor the keys to every system, every password, and every file you own. And yet most businesses choose one after a couple of polished sales meetings where every provider sounds exactly the same: proactive, responsive, secure, and very fond of the word partner.
The difference between providers does not show up in the pitch. It shows up when you ask questions that are slightly uncomfortable to answer. Here are the ten we would ask before signing with anyone, including us. A good provider will answer all ten without flinching. A great one will enjoy it.
The Ownership Questions
These come first because they matter most on the day the relationship ends, which is the day nobody thinks about while signing.
- Who owns our documentation? Network diagrams, system configurations, vendor lists, license records. The only acceptable answer is: you do. Some providers treat documentation about your own business as their proprietary property, which quietly makes leaving painful. Get ownership in writing.
- Who holds our administrator passwords, and can we see them anytime? Admin credentials are the master keys to your company. A trustworthy provider keeps them documented in a secure vault and will hand them over on request, because they are yours. If the sales rep hedges on this one, believe the hedge.
- What exactly happens when we leave? Ask for the offboarding process in writing: what gets handed over, in what format, on what timeline, at what cost. Providers who plan their own exit gracefully are confident you will never want to use it. Providers who dodge this question are telling you the exit is the retention strategy.
The Response Time Questions
Speed promises are where marketing does its finest work. Every proposal says fast. These two questions separate the brochure from what actually happens when your server dies on a Friday afternoon.
- What is your real average response time, not the contract number? Service level agreements, the SLAs in the fine print, are full of soft language. “Four-hour response” can legally mean an automated email within four hours, on business days only, for the highest-severity tier only. Ask for actual averages from last quarter: time until a human engages, and time until the problem is resolved.
- Who answers when something breaks at 2 a.m.? Their own technicians, or an outsourced overnight call center reading from scripts? Neither answer is automatically disqualifying, but you deserve to know before the bad night, not during it.
The Questions About Their Own Security
Here is the uncomfortable truth about our industry: attackers love IT providers, because breaching one unlocks dozens of client businesses at once. The remote access tools an MSP uses to manage your systems are exactly what criminals want to steal, and phishing accounted for 52 percent of attacks targeting MSPs in 2025, according to industry reporting compiled by security firm Guardz. We wrote about how much smarter those attacks are getting in our post on AI-powered cyberattacks. So interrogate any future provider like the high-value target they are.
- How do you secure your own company? Listen for specifics: multi-factor authentication enforced on everything, separate accounts for administrative work, monitoring of their own systems around the clock, and ideally an independent audit such as SOC 2, which is a third-party review of a company’s security controls. “We’re the experts, don’t worry about us” is not an answer.
- Do you test your own backups, and will you test ours? Ask when they last restored their own systems from backup, then ask how often they will run restore tests for you, with results you can see. Confidence without testing is the industry norm: in Veeam’s 2026 resilience research, 90 percent of leaders believed they could recover from an incident, while only 28 percent of ransomware victims actually got all their data back.
- Have you ever had a security incident, and what changed because of it? “Never” from a provider of any real age means luck, blindness, or spin. The strong answer describes a genuine scare, the honest client communication that followed, and the specific controls added afterward.
The Accountability Questions
- What will we see from you every month? Ask for a sample monthly report: patching status, backup test results, ticket trends, a security summary. If reporting is vague, occasional, or an add-on fee, expect silence once the honeymoon ends. Proof of work should be part of the base price.
- Can we talk to two current clients our size? Not the hand-picked showcase account. Two businesses roughly your size, ideally in your industry, and at least one that has been through a genuinely bad day with this provider. How an MSP behaves during a crisis is the actual product you are buying.
How to Read the Answers
You are not grading for perfection. You are grading for specificity. Good providers answer these questions with documents, numbers, and stories, because they thought about all of this long before you asked. Weak providers answer with adjectives. If you ask about documentation ownership and receive a speech about partnership, trust the dodge, not the speech.
Watch the exit question especially. The providers most relaxed about your ability to leave are the ones most confident you will stay, and that confidence is what you are really shopping for. For the bigger picture on when outsourcing IT makes sense at all, see why more businesses are outsourcing IT in 2026.
The Bottom Line
Ten questions: documentation ownership, password access, exit terms, real response times, after-hours reality, their own security, tested backups, incident honesty, monthly proof of work, and honest references. Ask every one, and take notes on which ones cause squirming. You are not buying help desk hours. You are choosing who stands next to you on your worst business day, and that decision deserves at least one uncomfortable meeting.
Want to hear how we answer all ten? Ask away. We keep the answers in writing, and we think you will like question three’s the most. Contact us today
Sources:
Comments are closed