Define what the firm needs covered
List the users, locations and critical systems that support client work. Include Microsoft 365, document and email access, devices, networks, local servers and any practice-management dependencies.
Ask the provider to identify exactly what is covered, which applications require a separate support relationship and how responsibilities are divided between the MSP, your staff and software vendors.
Ask how access and changes are managed
- How are new users approved and given appropriate access?
- What happens to accounts and devices when someone leaves?
- How are administrative privileges controlled and reviewed?
- How are external sharing and document permissions checked?
- Who approves material changes, and how are they documented?
Ask for evidence behind security assurances
Ask what is actually reviewed and what remains outside scope. A useful assessment should connect findings to evidence and distinguish a missing control from an item that simply has not been verified.
Examples to discuss include device coverage, identity settings, patching, recovery-test evidence and documented operational practices. A summary score should not hide an important individual gap.
Clarify support and recovery expectations
Ask how users request help, how urgent issues are escalated, when support is available and which onsite arrangements apply. Any service-level commitments should appear in the agreement.
Discuss which systems and data are covered by backups, who owns recovery decisions and what testing evidence exists. Agree priorities for restoring work rather than assuming every system can be restored in the same way.
Compare scope and ongoing accountability
Ask how the provider reviews progress with leadership and how projects outside the monthly agreement are identified. Request an explanation of inclusions, exclusions and any assumptions behind the proposal.
Provicore combines managed IT support with ProviScore baseline and quarterly reviews. We discuss the findings and business priorities with your firm so the roadmap remains understandable and relevant.