How to Choose a Managed Service Provider (MSP)

In 2024 we published a five-point test for any IT support company, now expanded in what is a managed service provider, and it still holds. Whether it's an MSP or an IT contractor, your support company should:

1. Keep all your systems patched and keep an eye on the news for security threats.
2. Prevent problems from happening and fix them quickly when they do.
3. Maintain and test your backups.
4. Provide a pleasant experience for the people they interact with.
5. Have a good understanding of your systems and help your company grow.

Those five points are the standard. The ten questions below are how you find out, before signing, whether a provider meets it. Each question ends with NRVPC's own answer, marked "At NRVPC," so you have one completed row to measure other quotes against. Write every answer you receive into the comparison sheet in the last section.

Ask three things: the minimum monthly fee, the per-user rate, and the list of factors that change the number. A provider that states a floor in the first conversation is saving you a discovery call.

The factors that move the price are consistent across the market: user and device count, server count, number of locations, compliance requirements such as HIPAA, the Windows and Mac mix, and how often a visit is needed. Ask each provider to show you which of these apply to your quote. What moves the number is in managed IT services cost.

At NRVPC: one predictable monthly fee, set per user in two plans (managed services with help desk, and managed agents); the current prices are on our pricing page, with a calculator. Windows-primary environments are the core; Mac is supported with clear expectations, and mixed environments work well.

Ask for the owner's name, where the company is based, how long it has operated, and who picks up when an employee calls the help desk. Ownership tells you who is accountable for the agreement. Who answers tells you what your team will experience every day. Ask whether your team can reach an engineer directly.

At NRVPC: Zach Launey, President. Based in Fairfax, Virginia, and founded in 2006. Your employees have direct engineer access to a local Northern Virginia team: five technicians work the help desk, escalations follow a set matrix, and Zach steps in himself for executives or when every technician is busy.

Ask for the named certifications of the engineers who will work your account, not only the company's partner badges. CompTIA is the vendor-neutral baseline: A+ for hardware and operating systems, Network+ for the network, Security+ and SecurityX (formerly CASP+) for security practice. Then ask about the platforms you already run, because experience on your firewall or endpoint product is what makes an engineer useful on day one.

At NRVPC: engineers hold CompTIA A+, Network+, Security+, and SecurityX (formerly CASP+), plus Carbon Black. The platforms we manage daily include Microsoft 365, Google Workspace, Windows, Dell, HP, Cisco, Ubiquiti, Meraki, SonicWall, Sophos, Bitdefender, and Synology.

Ask which industries the provider serves, for how long, and which compliance frameworks it manages the technical controls for. A provider that names its industries is telling you where its documentation, templates, and vendor relationships already exist, and that is where your onboarding goes fastest.

At NRVPC: five industries. Healthcare providers, where NRVPC manages the technical controls behind HIPAA. Legal practices, where the controls support attorney-client confidentiality and legal ethics. Nonprofit organizations, with grant and donor compliance. Mid-sized businesses that have outgrown one-person IT, with complete IT management, security, and planning that scales. Professional services, covering accounting, consulting, financial advisors, and architecture and engineering firms.

Ask who meets with whom, how often, and what document comes out of the meeting. Ask for the contract term and the exit window. The document that matters most is the one that shows up every quarter, because it shows the provider is planning your technology, not only maintaining it.

At NRVPC: quarterly business reviews with a C-level contact on your side and leadership on ours. Each review updates a 3-year technology roadmap, the hardware refresh budget, and any vendor evaluation in progress. Vendor evaluation is independent: the recommendation is the option that fits your roadmap and budget. The agreement runs one year and renews automatically unless the price changes by more than 5%; leaving takes 30 days' notice.

The question has two meanings, and you want both answered. First, onboarding your company: what happens in the first 30 days, who documents the environment, and when the security baseline is fully in place. Second, onboarding and offboarding your people: how a new hire gets a working laptop on day one, and how a departing employee's access is closed the same day. Ask one more thing: who owns the documentation, passwords, and licenses if you leave. The right answer is that you do.

At NRVPC: onboarding takes 30 days. It brings every device up to the security baseline, documents your environment, and introduces your team to the help desk. User onboarding and offboarding is part of the minimum managed scope for every client: a new or departing employee's account is set up or removed within an hour of you telling us, automated in most cases through a Microsoft or Google form. If you leave, you get the documentation and repair notes, and we help your next IT company gain access to every system.

An MSP RFP for a company your size does not need forty pages. It needs the same ten questions, sent to each provider with the same facts about your environment: user count, device count, servers, locations, the email platform, the firewall model, and any compliance requirement. Give every provider the same inputs and ask each to fill in its row. NRVPC's row is already complete below.