How to Choose a Managed IT Service Provider (MSP) in 2026

Your office manager is resetting passwords between client calls. A laptop died last week and nobody knew whether it was backed up. The person who “knows computers” just gave notice. This is usually the moment owners start searching for a managed IT service provider.

An MSP can take that weight off you, but the wrong one can lock you into a long contract with slow response times and fuzzy security promises. Worse, an MSP holds the keys to your whole environment. If its own systems are compromised, yours can be too.

This guide covers what an MSP does, how to compare providers, the contract and SLA red flags worth catching before you sign, and how the common pricing models work.

What a managed IT service provider actually does

A managed IT service provider takes ongoing responsibility for some or all of your technology for a recurring fee. That’s the key difference from the old “break-fix” model, where you call a technician only when something breaks and pay by the hour.

Typical MSP services include:

• Help desk and user support: password resets, account setup, software issues, onboarding and offboarding staff.
• Device management: patching, antivirus or endpoint detection, laptop and phone setup, asset tracking.
• Network and infrastructure: firewalls, Wi-Fi, servers, cloud tenants such as Microsoft 365 or Google Workspace.
• Backup and disaster recovery: scheduled backups, restore testing, recovery planning.
• Security services: monitoring, multi-factor authentication rollout, email filtering, security awareness training.
• Strategy: a technology roadmap, budgeting and vendor management, sometimes called vCIO services.

Not every MSP does all of this well. Some are strong at help desk work and weak at security. Others focus on a single industry, such as healthcare or law, and know its compliance rules. Your job is to find the overlap between what you need and what they actually do every day.

If you’re still deciding whether to outsource at all, read our breakdown of IT outsourcing vs in-house first.

Signs you’re ready for an MSP

You probably need outside help if 2 or more of these are true:

• Staff lose hours each week to IT problems that nobody owns.
• You can’t say with confidence that your data is backed up and restorable.
• Former employees may still have access to email or cloud apps.
• A customer, insurer or regulator has asked about your security controls and you didn’t have an answer.
• You’re growing fast and onboarding new hires takes days instead of hours.
• Your 1 internal IT person is overloaded and has no backup.

How to compare MSPs side by side

Most MSP websites look alike. A scorecard keeps you honest. Score each shortlisted provider from 1 to 5 on the criteria below, and ask for evidence rather than promises.

A provider that offers a SOC 2 report gives you something a sales deck can’t: an independent auditor’s opinion on its controls. It isn’t mandatory, but it’s a strong signal.

The security questions most buyers forget

An MSP’s remote management tools reach into every device you own. That’s why the US Cybersecurity and Infrastructure Security Agency (CISA), with the NSA, FBI and international partners, published advisory AA22-131A in May 2022 warning that attackers target MSPs to reach their customers.

The advisory gives customers a practical list of things to require. Turn them into questions:

1. Do you require MFA on every account that touches our environment? The answer should be yes, with no exceptions for technicians.
2. Do you reuse admin credentials across customers? CISA says your contract should forbid it.
3. Who owns hardening, detection and incident response? The contract should spell out which party does what.
4. How and when will you tell us about an incident? Get a notification time in writing.
5. Can we see logs of your activity in our systems? You should have visibility into the MSP’s connections and actions.
6. Are your accounts kept out of our internal admin groups and limited to the systems you manage? That’s least privilege in practice.
7. What happens to your access when we leave? CISA notes that disabling MSP accounts is often missed when a contract ends.

Good providers will answer these without hesitation. If a provider gets defensive, treat that as your answer. For the bigger picture on access control, see our guide to zero trust security.

Key takeaway: An MSP is part of your attack surface. Judge it on how it secures its own access to you, not just on how fast it answers the help desk phone.

Contract and SLA red flags

The contract matters more than the sales call. Read it with these red flags in mind.

Vague service level agreements

“We respond promptly” isn’t an SLA. Look for defined priority levels, response targets and resolution targets for each, and what you get if the provider misses them. CISA’s guidance for MSP customers suggests performance-based SLAs that separate operational services from security services, so a fast help desk can’t hide weak security monitoring.

Response time without resolution time

A 15-minute “response” can mean an automated email. Ask how the provider measures time to resolution and how often it hits its targets.

Unclear scope

If the agreement doesn’t list what’s included, every request becomes a billing debate. Watch for loose terms like “reasonable support” and for projects, new-hire setups or after-hours work that are billed separately without stated rates.

Long auto-renewals and steep exit fees

Multi-year terms with automatic renewal and penalties for early termination reduce your bargaining power. Negotiate a shorter initial term or a termination-for-cause clause tied to missed SLAs.

No exit or offboarding plan

You need written commitments that the provider will hand over admin credentials, documentation, configurations and data, and then remove its own access. Without that, switching providers later is painful.

Subcontracting without disclosure

Many MSPs use subcontractors for after-hours support or security monitoring. CISA suggests that customers vet subcontractors. Ask who else will touch your systems.

Backup terms that don’t match your needs

CISA’s advisory tells customers to confirm the contract covers backup and recovery that meets their resilience needs. Check how often backups run, where they are stored, how long they are kept and how often restores are tested.

MSP pricing models explained

Prices vary widely by region, scope and provider, so compare structures before you compare numbers.

Many MSPs combine models, such as a per-user fee for support plus project fees for migrations. Ask each shortlisted provider to price the same scenario: your current headcount, devices, cloud apps and backup needs. Then compare like with like.

Also ask what’s excluded. Software licenses, hardware, cyber insurance requirements and on-site visits are common add-ons.

Where to start: a 6-step selection process

1. List your needs. Write down your users, devices, cloud apps, compliance rules and the 3 biggest IT pains you want solved.
2. Build a shortlist of 3 to 5 providers. Ask peers, your industry association or browse curated directories such as our top IT companies in the USA and state-by-state top lists.
3. Send the same brief to everyone. Ask for a proposal, a sample contract, sample SLA and a sample monthly report.
4. Run the security questions. Use the 7 questions above and request any audit reports.
5. Call references. Ask how the provider handled an outage or security incident, not just whether they’re friendly.
6. Negotiate the contract. Fix vague SLAs, add exit and offboarding terms, and agree a 90-day onboarding plan with milestones.

Once you sign, schedule a review at 90 days. Check the SLA reports against your own experience and raise gaps early.

Conclusion

Picking a managed IT service provider is less about finding the biggest name and more about fit, security and a fair contract. Use a scorecard, press on how the provider protects its own access, and read the SLA line by line. A good MSP will welcome the scrutiny, because it means you’ll be a client who stays.

Strong identity controls are one of the first things a good MSP will raise. Our guide to passkeys explains why.

Sources

• CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A) — customer contract terms, MFA, least privilege, logging, backups and offboarding recommendations
• CISA Insights: Risk Considerations for Managed Service Provider Customers — performance-based SLAs, subcontractor vetting and access to security logs
• AICPA: System and Organization Controls (SOC) suite of services — what SOC reports are and that CPAs issue them