Key takeaways
Good questions cover scope, security, response, pricing, contract exit, data ownership and who actually does the work.
Strong answers are specific and in writing; vague answers and reluctance to put terms on paper are the clearest red flags.
Ask every provider the same questions so you can compare answers side by side.
Before choosing a managed IT provider (MSP), ask questions that reveal what they actually do, how they protect your data, how fast they respond, how they bill, and how you would leave if you needed to. The best answers are specific and willing to go in writing. Below are the questions grouped by topic, with what a good answer sounds like and what should give you pause.
Why the questions matter
A managed IT provider holds the keys to your email, files and computers. That level of access is exactly why CISA lists managed service providers as a vendor type worth assessing carefully. The FTC's guidance for small businesses makes a simple point: put security expectations in writing, verify them, and limit vendor access to what is needed.
If you are still deciding whether to hire a provider at all, start with our guide on when to hire an MSP. This guide assumes you are choosing between providers.
Scope
What exactly is included in the monthly fee?
Good answer: a written list covering help desk, Microsoft 365, security, backup and patching. Red flag: "everything" with no list.
What is billed separately, and at what rate?
Good answer: projects, after-hours work, extra devices and on-site visits with stated prices. Red flag: "we will quote it when it comes up" for routine items.
Do you manage Microsoft 365 or only our computers?
Good answer: accounts, licensing, sharing and security settings are named. Red flag: Microsoft 365 is treated as your problem.
Security
How do you protect our computers?
Good answer: endpoint detection and response with someone reviewing alerts (managed detection and response). Red flag: basic antivirus only.
How do you secure your own access to our systems?
Good answer: named accounts, MFA everywhere, least-privilege roles such as Microsoft's granular delegated admin privileges (GDAP). Red flag: shared logins or permanent full admin for every technician.
Is our Microsoft 365 data backed up by a separate service?
Good answer: yes, with a clear restore process. Red flag: "Microsoft handles that."
What happens if you have a security incident yourselves?
Good answer: a described notification process. Red flag: they have never considered it.
Response and support
What are your response targets, and are they targets or guarantees?
Good answer: written times by priority, honestly labeled. Red flag: "we always respond right away" with nothing on paper.
What are your support hours and how do staff reach you?
Good answer: stated hours, channels and after-hours options. Red flag: confusing automated monitoring with a staffed 24/7 help desk.
How do you handle on-site needs?
Good answer: a clear process, whether that is a visit fee or a referral. Red flag: no answer for a remote provider.
Pricing and billing
How is pricing calculated, and what is the minimum?
Good answer: per user or per device with a stated minimum. Red flag: pricing that changes depending on who you ask.
Can prices change during the term?
Good answer: the agreement says how and with what notice. Red flag: open-ended increase rights.
Is there a setup fee?
Good answer: a stated one-time amount. Red flag: open-ended paid onboarding.
Contract and exit
How long is the agreement and how does it renew?
Good answer: term and renewal stated plainly. Red flag: automatic multi-year renewal buried in fine print.
What does it cost to leave early?
Good answer: a stated notice period and fee formula. Red flag: "we can talk about that later."
What help do we get when we leave?
Good answer: credentials, documentation and cooperation with the next provider. Red flag: handover only at extra, unstated cost.
Contract wording deserves its own review. Our managed IT agreement checklist covers the clauses to read closely.
Data ownership and documentation
Who owns our data, accounts and Microsoft 365 tenant?
Good answer: you do, and the agreement says so. Red flag: the tenant or licenses are registered to the provider with no transfer plan.
Will we have access to our documentation?
Good answer: yes, during the relationship and at exit. Red flag: documentation is described as proprietary.
Will our firm keep its own admin access?
Good answer: yes, including emergency access accounts. Red flag: the provider holds the only admin login.
Who does the work
Who will actually support us day to day?
Good answer: a clear description of who answers tickets and who handles escalations. Red flag: vague references to "the team."
Do you use subcontractors or offshore support?
Good answer: disclosed openly, with how access is controlled. Red flag: evasive answers.
What insurance do you carry?
Good answer: named coverage types and a certificate on request. Red flag: reluctance to share.
A worked example
Take a hypothetical 18-person engineering firm interviewing three providers. It sends all three the same written list. One provider answers every question in a week. One answers most but cannot say how early termination works. One replies with a brochure. The firm's choice is not about who sounded best on a call; it is about who was willing to be specific.
Common mistakes
• Asking different questions of each provider, which makes comparison impossible.
• Accepting verbal answers on items that should be in the agreement.
• Focusing on price and skipping exit and data ownership.
• Not asking how the provider protects its own access.
How NexJen can help
We publish our pricing, inclusions, extras, response targets and agreement terms on our website so you can check them against this list. Our response targets are targets, not guarantees, and our support hours are Monday through Friday, 8 AM to 5 PM in your local time. We carry general liability and technology errors and omissions insurance, with a certificate on request. Send us your questions and we will answer them in writing.
Ask us these questions
We are happy to answer every question on this list in writing before you decide anything.