Hiring a Managed Service Provider is one of the most important IT decisions you'll make for your business. When you get it right, your systems run smoothly, security improves, and you can focus on growing your business. When you don't you spend months dealing with poor service, surprise bills, and potential security gaps.
MSPs may sound similar in their marketing. They promise 24/7 support, proactive monitoring, security management, and expert guidance. But when you actually work with them, the reality is vastly different.
Some MSPs are genuinely excellent partners. Others can act just as call-center repair shops.
How do you tell the difference?
This guide provides five critical questions to ask before hiring an MSP, and more importantly, what kind of answers you should expect. We'll also cover red flags and industry-specific considerations as a detailed evaluation framework to help you make the right choice for your Wisconsin or Illinois business.
Why MSP Vendor Selection Matters
Before we dive into questions, let's establish why this decision is so critical.
The stakes:
- Average MSP contract: $3,000-$8,000/month
- Typical contract term: 12-36 months
- Annual spend: $36,000-$96,000+
- Total contract cost: $36,000-$288,000+
What goes wrong when you choose poorly:
- Slow response times (emergencies take hours)
- Hidden fees (surprise invoices)
- Poor security practices (vulnerability exposure)
- Lack of accountability (things fall through cracks)
- Vendor lock-in (can't leave without penalty)
- Mismatch to your business (generic solutions)
- Staff turnover (lose relationships and knowledge)
What goes right when you choose well:
- Issues prevented through proactive monitoring
- Transparent pricing
- Strong security
- Accountable partnership
- Flexibility to scales with your business
- Industry expertise
- Stable relationships
The difference between a good MSP and a bad one can cost you $50,000+ in avoided crises, prevented downtime, and optimized IT spend.
Learn More: 5 Ways Managed IT Services Can Benefit Your Business
Question #1: "What Does Your Service Model Include, and What Are Your Pricing Terms?"
Why this question matters: Pricing is often where MSPs hide complexity. Some charge per-device, some per-employee, some flat-rate. Some have hidden fees. Some lock you into long contracts with early termination penalties.
You need absolute clarity on what you're paying for and what you're getting.
What GOOD Answers Sound Like
- Clear, specific service list: help desk hours, monitoring frequency, backup included, security tools, etc.
- Pricing structure clearly explained: flat-rate, per-device, or per-employee
- All-inclusive pricing
- Transparent about what's NOT included (if anything)
- Contract terms explained: length, early exit options
- Scalability explained: what happens when you grow/shrink
- Written quote with itemized services
What BAD Answers Sound Like
🚩 Red flag phrases:
- "Pricing depends on your situation"
- "We charge per ticket/incident"
- "You'll get a bill at the end of the month with charges"
- "Training is not included"
- "We don't do quarterly reviews"
Questions to Ask As Follow-Up
If answer is vague, drill deeper:
- "Can you provide a written quote with itemized services?"
- "Are there any charges outside the monthly fee?"
- "What's your contract cancellation policy?"
- "How does pricing adjust if we grow from 30 to 50 employees?"
- "What happens if we need something outside the contract?"
Question #2: "What Is Your Response Time Guarantee, and How Do You Handle Emergencies?"
Why this question matters: When your systems go down, time matters. Downtime costs real money:
- Manufacturing: $10,000-$100,000+ per hour
- Healthcare: $5,000-$50,000+ per hour
- Finance: $2,000-$50,000+ per hour
- Professional services: $1,000-$10,000+ per hour
An MSP that takes 4 hours to respond to an emergency is vastly different from one that responds in 1 hour.
What GOOD Answers Sound Like
- Specific response time commitment (e.g., "1-hour response time for emergencies")
- Clear emergency definition (what qualifies as emergency)
- Multiple support channels (phone, email, chat)
- 24/7 availability (not just business hours)
- Escalation process defined (who to call if urgent)
- After-hours support (how is it handled)
- Redundancy explained (what if primary person is unavailable)
What BAD Answers Sound Like
🚩 Red flag phrases:
- "We respond during business hours"
- "Response time depends on the situation"
- "We'll get back to you as soon as we can"
- "You can email us and we'll respond within a day"
- "You can call our answering service"
Questions to Ask As Follow-Up
- "Do you monitor systems 24/7?" (proactive detection, not just responsive)
- "What's your average emergency response time?" (not guaranteed, actual)
- "Can you name specific examples of emergencies you've handled?"
- "What happens if your primary contact is unavailable?"
- "Do you charge extra for after-hours support?"
- "How do you track and report on response time performance?"
Question #3: "What Security Measures Do You Implement, and What Compliance Support Do You Provide?"
Why This Question Matters
Security is the #1 reason businesses hire MSPs. Yet some MSPs have minimal security practices. Others are truly security-focused.
If your business handles healthcare data (HIPAA), payment cards (PCI-DSS), government contracts (CMMC), or any regulated industry, you need an MSP that understands compliance.
What GOOD Answers Sound Like
- Specific security tools listed: firewall, MFA, EDR, antivirus, etc.
- 24/7 threat monitoring included
- Compliance certifications mentioned: SOC 2, ISO 27001, etc.
- Industry-specific compliance support: HIPAA for healthcare, PCI-DSS for retail, etc.
- Regular security assessments
- Patch management process defined
- Backup with immutable storage (can't be deleted in ransomware attack)
- Employee security training
- Incident response plan in place
What BAD Answers Sound Like
🚩 Red flag phrases:
- "We install antivirus" (baseline minimum, not security)
- "We run backups" (but are they immutable? tested?)
- "Security is important to us" (vague, not specific)
- "We handle HIPAA requirements" (but do they really? ask specifics)
- "We recommend you get an expert for compliance" (they don't specialize)
- "Employee training is optional" (security depends on staff awareness)
- "We charge extra for security" (should be included)
- "We have a firewall" (which one? how configured?)
Questions to Ask As Follow-Up
- "Can you detail your backup process? (frequency, testing, immutable storage?)"
- "Are backups tested regularly?"
- "Do you have experience with [HIPAA/PCI-DSS/CMMC]?" (ask your specific requirement)
- "What happens if we have a security incident?"
- "Do you do regular security assessments?"
- "Can you provide references from companies in [your industry]?"
Question #4: "Can You Explain Your Onboarding Process and How You Handle the Transition?"
Why this question matters: Onboarding is where you find out if an MSP is organized or chaotic.
Poor onboarding can mean:
- Weeks of disruption
- Lost data
- Undocumented systems
- Knowledge gaps
- Staff confusion
Good onboarding means:
- Smooth transition
- Complete documentation
- Zero data loss
- Clear process
- Professional approach
What GOOD Answers Sound Like
- Detailed onboarding timeline
- Kick-off meeting planned
- System documentation process
- Data migration plan (if applicable)
- Transition managed with minimal disruption
- Staff training included
- Dedicated transition manager
- Post-transition support (first 30/60/90 days)
- Knowledge transfer documented
What BAD Answers Sound Like
🚩 Red flag phrases:
- "We just take over your systems"
- "Onboarding depends on your situation"
- "We'll figure it out as we go"
- "You'll probably have some downtime" (should be minimized)
- "We don't really document things"
- "Staff training is extra"
Questions to Ask As Follow-Up
- "Can you provide references from recent onboarding clients?"
- "How long does onboarding typically take?"
- "What if we discover systems you didn't know about?" (happens often)
- "How do you handle data migration?"
Question #5: "How Do You Measure Success, and What Does Our Relationship Look Like Long-Term?"
Why this question matters: This separates transactional MSPs from true partners.
Transactional MSPs: You pay them, they manage your systems, that's the relationship.
Partner MSPs: Quarterly business reviews, strategic planning, ongoing optimization, relationship building.
You want a partner, not a vendor.
What GOOD Answers Sound Like
- Quarterly business reviews (QBRs) held
- Specific metrics tracked: uptime %, ticket resolution time, security incidents, costs
- Strategic planning included
- Periodic reporting: monthly metrics, quarterly strategy
- Relationship manager assigned
- Technology roadmap developed
- Cost optimization discussed
- Continuous improvement mindset
What BAD Answers Sound Like
🚩 Red flag phrases:
- "We just manage your systems" (transactional, not strategic)
- "Success is systems running" (no deeper partnership)
- "We send a bill each month" (that's it?)
- "Quarterly reviews aren't needed" (no accountability)
- "Optimization means less work for us" (conflict of interest)
- "We focus on support, not strategy" (no vision)
- "No formal reporting" (you don't know what's happening)
Questions to Ask As Follow-Up
- "Who will be my main contact?"
- "How often do we meet in person vs virtually?"
- "Do you provide a monthly report?"
- "Who approves major changes to my environment?"
- "How do we discuss IT budget for next year?"
- "What if I want to upgrade systems or try new technologies?"
Industry-Specific MSP Evaluation
Different industries have different MSP needs. Here's what to focus on:
Manufacturing Key Questions:
- Do you have OT/IT separation expertise? (production systems separate from business systems)
- Can you support industrial control systems?
- Do you understand production uptime requirements?
- Can you minimize planned downtime windows?
- Do you have experience with manufacturing compliance?
What to prioritize:
- Redundancy (downtime directly impacts revenue)
- 24/7 monitoring (production never stops)
- Rapid response (1-hour is critical)
- Industry experience (understands constraints)
Healthcare Key Questions:
- Do you specialize in HIPAA compliance?
- Do you have experience with EHR systems?
- Can you ensure patient data security?
- Do you support telemedicine infrastructure?
- What's your experience with healthcare practice size like ours?
What to prioritize:
- HIPAA expertise (not optional)
- Patient data security (critical)
- Regulatory compliance (audits required)
- Business continuity (patient care can't stop)
Finance/Accounting Key Questions:
- Do you understand SEC/regulatory requirements?
- Can you ensure audit readiness?
- Do you have SOC 2 certification?
- What's your experience with accounting software?
- How do you handle sensitive financial data?
What to prioritize:
- Compliance (regulatory is strict)
- Data security (financial data is targeted)
- Audit trails (everything tracked)
- Professional liability insurance (they carry it)
Professional Services (Law, Consulting) Key Questions:
- Do you understand attorney-client privilege?
- Can you implement client portal security?
- What's your data confidentiality approach?
- Do you have professional services experience?
- How do you handle privileged communications?
What to prioritize:
- Confidentiality (client trust is everything)
- Secure collaboration tools (client communication)
- Professional liability support (protect your firm)
- Compliance with legal ethics (varies by state)
FAQ: MSP Vendor Selection Questions Answered
Q: How many quotes should we get before choosing?
A: Get 3-5 quotes minimum. You need comparison. Less than 3 means you haven't shopped around. More than 5 becomes analysis paralysis. Get quotes, compare carefully, reference check top 2-3.
Q: Should we pick the cheapest MSP?
A: Absolutely not. Cheapest MSP often means corners cut on security, support, or staffing. You get what you pay for. Look for value (not lowest price). Good MSPs have consistent pricing because they're not slashing rates.
Q: Can we negotiate pricing?
A: Possibly. If you're locking into long-term contract (3 years), some MSPs will discount. But don't negotiate service quality down. Price is negotiable; quality is not.
Q: What if we want to leave after 6 months?
A: Most MSPs require 12-month contracts minimum. 30-day cancellation is ideal but rare. Ask about early termination clauses. Some charge reasonable early exit fees ($1-2K). Others charge full contract remainder (avoid these).
Q: Should we choose local MSP or national?
A: Depends on your situation. Local MSPs: faster on-site response, relationship building, understand regional business. National MSPs: larger team, more resources, potentially more expertise. Best is local MSP with national resources.
Q: How long does it take to see benefits from MSP?
A: First 30-90 days are onboarding. By month 3-4, you should see: reduced downtime, clearer spending, better security posture. True strategic benefits (cost optimization, roadmap execution) show by month 6-12.
Q: What if the MSP isn't working out?
A: Address it immediately. Schedule meeting with account manager. Be specific about problems. Give them 30 days to improve. If not, escalate. If still not better, use cancellation clause to exit. Don't stay in bad relationship hoping it improves.
Q: Should we interview the actual technicians who will support us?
A: Yes, if possible. Meet the team that will do the work. Ask who your primary contact is. Understand their experience. Technician quality often matters more than company promises.
Q: Do we need MSP + vCIO or just MSP?
A: Most SMBs need just MSP. But if you want strategic IT planning (technology roadmap, vendor management, quarterly strategy), add vCIO. MSP executes; vCIO plans.
Q: What SLA should we require?
A: Minimum: 1-hour response for critical issues, 4-hour for urgent, next-business-day for standard. Uptime guarantee: 99%+ (means about 7 hours downtime per year, acceptable). Resolution time: 24 hours for most issues, 48 hours for complex.
Q: Should security be extra or included?
A: Should be included. If MSP charges extra for firewall, MFA, or EDR, it's a red flag. These are foundational; they shouldn't be upsell items.
Q: How do we verify references?
A: Ask for 3 recent client references. Call them directly (don't use the MSP's phone number). Ask: "How long have you worked with them?" "Would you recommend them?" "What's one thing they do better than competitors?" "Anything you wish they'd improve?"
Q: What's a typical MSP contract length?
A: 12-24 months is standard. 3-year contracts are common but less favorable for you (locks you in). Negotiate for 12-month with option to renew (flexibility).
Q: Can we switch MSPs if we need to?
A: Yes, but it's disruptive. Your current MSP should help transition (it's professional). New MSP should handle migration. Plan for 1-month transition time, some downtime possible.
Q: What if we have multiple locations?
A: Make sure MSP can manage all locations equally. Some MSPs focus on single location. Discuss support for each site, travel time for on-site support, communication across locations.
Q: Should we check if MSP has liability insurance?
A: Yes. They should carry errors & omissions (E&O) insurance. If something goes wrong and data is lost, you need to know they can cover claims. Ask for proof of insurance.
Q: How do we compare "apples to apples" between quotes?
A: Create comparison spreadsheet with these factors: pricing (monthly cost), services included, response time SLA, uptime guarantee, contract length, early termination clause, security tools included, support hours, account manager assigned, quarterly reviews offered, references provided.
Q: What questions should we ask MSP references?
A: Ask these key reference questions: (1) How long have you used them? (2) Did they deliver on promises? (3) How's their response time in reality? (4) Have you had security incidents—how did they respond? (5) Is pricing transparent or surprises? (6) Would you recommend them? (7) What's one thing they could improve?
Q: Should we do trial period before committing?
A: Some MSPs offer 30-day trial. Good idea if available. You get to experience their actual support, not just promises. But know that first 30 days is limited (they're learning your environment).
Q: What if MSP discovers problems in our current environment?
A: This is common and good—it means they're thorough. Get estimate for fixes before committing. Some may be critical (security gaps), others can wait. Understand scope and cost before signing.
Choosing an MSP is one of the most important IT decisions you'll make for your business. Ask these five questions. Listen carefully to the answers. Pay attention to tone, specificity, and confidence. Check references. Trust your gut.
Now you can tell a great MSP partnership can transform your IT into a competitive advantage from one that keeps it a cost center.
Make the right choice.
