How to Choose a Managed IT Provider: A Buyer's Checklist
A vendor-neutral checklist for choosing a managed IT provider: security inclusions, response model, pricing, strategy, documentation and exit terms.
Every managed IT provider’s website says the same five things: proactive, responsive, security-first, partner not vendor, tailored to your business. None of that is comparable. You cannot put “proactive” in a spreadsheet next to another company’s “proactive” and learn anything.
This page is the comparison layer. It is written to be useful whether or not you ever talk to us — the criteria below apply to any managed service provider (MSP) in any market. Use them to build a scorecard, run the same questions past every provider you are considering, and decide on evidence instead of tone.
Short answer
Choose a managed IT provider by scoring each candidate on eight things you can verify: (1) what security is included by name, (2) their response and escalation model in writing, (3) whether they can physically reach your site, (4) how pricing is structured and what triggers extra invoices, (5) whether you get strategy or only tickets, (6) whether they document your environment and let you see it, (7) how they handle your compliance obligations, and (8) what happens to your data and credentials if you leave. Marketing language is not evidence. Written answers to those eight questions are.
Step 1 — Decide which service model you are actually buying
Three very different things get sold under the same words. Get clear on which one you need before you compare prices, because comparing a break/fix quote to a managed quote is comparing a fire extinguisher to a sprinkler system.
Break/fix. You call when something breaks; you pay by the hour. Inexpensive in quiet months, slow and expensive in bad ones — and the provider’s revenue goes up when things go wrong.
Helpdesk-only. Someone answers the tickets your team opens. Useful, but reactive by design. Nothing in that arrangement prevents next quarter’s outage.
Full managed IT. Monitoring, patching, security tooling, backup oversight, vendor coordination and helpdesk bundled into an ongoing relationship, typically at a flat monthly rate per user or per device. Prevention is the provider’s margin.
Co-managed IT. You keep an internal IT person or team; the provider supplies overflow capacity, extended coverage, security depth or tooling. If you already have someone internal, say so early — a provider who only sells full outsourcing will try to replace them rather than support them.
A lot of buyers believe they are shopping for the third and receive a quote for the second. Ask each provider, in writing, which of the four they are proposing.
Step 2 — Score every provider on the same eight criteria
Build one sheet, one column per provider, and score each row 1–5. The exercise matters more than the arithmetic — it forces every provider to answer the same question.
| Criterion | What a strong answer looks like | What a weak answer looks like |
|---|---|---|
| Security inclusions | Named controls in the base plan: MFA, EDR, email threat filtering, patch management, backup with tested recovery, logging | “Enterprise-grade protection,” or security quoted as an add-on after the first incident |
| Response model | Written response targets by severity, a defined escalation path, a named owner | “We’re very responsive” |
| On-site reach | Named service areas and a real office you could drive to | “We serve the whole region,” no address |
| Pricing structure | Flat per-user or per-device, scope written down, exclusions listed | Hourly with open-ended scope, or a number with no scope attached |
| Strategy cadence | Scheduled reviews (vCIO/vCISO) with a named person, stated frequency | Tickets only; roadmap talk happens when you chase it |
| Documentation | A living record of your network, licenses, configs and credentials — and you can see it | Knowledge lives in one technician’s head |
| Compliance support | What they will sign, what artifacts they produce, where their responsibility ends | Compliance treated as a checkbox |
| Exit terms | Written transition process for data, credentials, documentation and licensing | Never raised, or raised only after you ask twice |
If two providers score close, the tiebreaker is usually continuity — a small team that learns your environment versus a rotating queue that re-reads your history on every call.
Step 3 — Ask the questions that proposals do not answer
Proposals are written to survive comparison. These questions are harder to write around.
- “List the security controls included in the base plan, by product name.” Vagueness here is the single most reliable predictor of a security upsell later.
- “Who physically comes on site, from which office, and what is the process for requesting it?” Remote support handles most issues. Firewalls, switches, Wi-Fi dead zones, cabling and conference-room hardware eventually need hands. A national queue can be excellent remotely and still have nobody within two hours of your building.
- “What is not included, and what generates a separate invoice?” Projects, out-of-hours work, office moves, hardware procurement, new sites — get the list before signing.
- “Who is our strategic contact, and how often do we meet?” Without a scheduled review, you have a very good repair service and no IT plan.
- “Show me an anonymized example of your documentation.” You are asking whether your environment will be knowable by anyone but the technician who built it.
- “What happens in the first 30, 60 and 90 days?” A provider without a stated onboarding sequence is improvising.
- “What is your escalation path when the first-line tech cannot solve it?” Ask for names and levels, not reassurance.
- “How do we leave?” The best question almost nobody asks. Get the answer before you sign, not during a breakup.
Step 4 — Read the contract terms that matter most
- Term length and renewal. Auto-renewal with a long notice window is common; know the date.
- Scope definition. “Unlimited support” almost always has boundaries. Find them in writing.
- Response commitments. Many providers publish a marketing response claim and contract a different one. Ask which you are getting.
- Data ownership. Your data, backups, documentation and licenses. Confirm all four are yours and portable.
- Guarantees. Ask for the written terms, the exclusions, and the definition of the thing being guaranteed. A guarantee you cannot read is marketing.
Red flags worth walking away from
- Security sold only as an upgrade after you decline it once
- A quote with no scope document attached
- Unwillingness to name their tooling
- No named on-site capability anywhere near you, combined with claims of local presence
- Pressure to sign before a discovery conversation has actually happened
- Review counts, rankings or award badges cited without a source you can check
- Any provider — including us — who cannot explain who is not a good fit for them
How TVG Consulting fits (and when we don’t)
We publish this checklist knowing it will be used on us. That is the point.
TVG Consulting has provided managed IT and cybersecurity since 2005. We are privately owned, headquartered in Burbank, California, with a second office in Franklin, Tennessee — supporting businesses across the Los Angeles area, across Nashville, Brentwood, Franklin and Murfreesboro, and remotely nationwide.
Against the eight criteria above:
- Security inclusions — cybersecurity is packaged into managed IT plans, not sold as an add-on after an incident. Ask us for the control list on the call; we will give you the same named-product answer we tell you to demand from everyone else.
- Pricing structure — flat-rate. Managed IT plans starting at $90 per user per month for full support (MSP care), with exact pricing after a scoping conversation, because a number without scope is not a quote.
- Response model — urgent issues get immediate engagement; routine requests are worked in priority order. We publish no response-time number, and this page tells you why you should ask any provider whether theirs is contractual.
- On-site reach — real offices in Burbank and Franklin, with dispatch when remote resolution is not enough. See IT support in Burbank.
- Documentation and exit — ask us the same two questions you ask everyone else, and ask for the answers in writing. We would rather you did that than take our word for it.
When we are probably not your provider: if you want occasional hourly fixes with no monitoring; if you need a large on-premises IT staff and really want a hardware supplier; or if you want a provider who will tell you what you want to hear on the first call.
FAQ: choosing a managed IT provider
What is the most important thing to check when choosing an MSP?
Whether security is included in the base plan by name. It is the criterion that most reliably predicts how the rest of the relationship will be priced and prioritized. A provider who itemizes MFA, endpoint detection, email filtering, patching and tested backups as standard is making a structurally different bet than one who sells those after your first incident.
What questions should I ask a managed IT provider before signing?
At minimum: what security is included by name; the written response and escalation model; who comes on site and from where; what is excluded and what triggers extra invoices; who your strategic contact is and how often you meet; whether they will show you your own documentation; how they handle your compliance obligations; and how data, credentials and licensing transfer if you leave.
Should I choose a local MSP or a national one?
It depends on how much of your risk is physical. If your business runs on cloud applications and laptops, a strong remote provider may serve you well. If you have servers, facility networking, conference-room hardware or multiple sites, someone who can be in the building the same day matters more than most buyers expect. Ask for the nearest office address, not the service-area map.
How much should managed IT cost?
Enough that prevention is worth the provider’s time, and structured so you can budget it. Scope drives price far more than headcount: sites, servers, compliance obligations and legacy systems move a quote more than user count does. Treat published ranges as market education and get a scoped quote against your actual environment.
What is a vCIO and do I need one?
A vCIO (virtual CIO) is a recurring strategic review: what broke, what is aging out, what your security posture looks like, and what needs budgeting next year. If nobody is holding that conversation on a schedule, your IT plan is whatever this month’s emergency dictated. Smaller organizations often need it more than larger ones, because they have nobody internal doing it.
Can we keep our internal IT person and still hire an MSP?
Yes — that is co-managed IT. Say so in the first conversation. A provider who responds by trying to replace your internal person, rather than defining a clean split of responsibilities, has told you something useful.
How long does it take to switch providers?
Ask each candidate for their 30/60/90-day onboarding sequence and what they need from your outgoing provider. A provider who claims the switch is instant has not done many transitions. Our page on signs you need to switch IT providers covers the mechanics in more detail.
Use this checklist on us
If you are mid-comparison, we are happy to be one of the columns on your sheet. A discovery conversation is exactly that — a look at your current setup, your risks, and whether we are the right fit. No obligation either way. If we are not, you will still leave with a sharper sense of what to ask the next provider.
Still deciding whether you need managed IT at all? Start with why small businesses need managed IT. Ready to talk? Contact TVG Consulting, or email sales@tvgconsulting.com.