15 Questions to Ask Any Managed IT Provider Before You Sign in Miami

Why Choosing the Wrong MSP Costs More Than Staying Without One

Bad managed IT is worse than no managed IT. When you outsource your IT, you are trusting a single vendor with your uptime, your data, your security, and — in regulated industries — your compliance posture. If that vendor is reactive, understaffed, or not accountable, you have all the risk of a third-party relationship with none of the benefits.

The average cost of a data breach where a third party was involved was $4.29 million — 8.2% higher than the overall average.

The 15 questions below are designed to reveal the difference between an MSP that is genuinely capable and one that is good at sales calls. Ask them in the discovery call. Expect written answers in the proposal. Walk away from any provider who treats these as unreasonable.

---

Question 1: What is your guaranteed response time — and what happens if you miss it?

Why it matters: "Fast response" is meaningless marketing. You need a specific SLA tied to a specific consequence.

What to ask: "What are your response time SLAs for critical, high, and standard issues? How are they measured? What do we receive if you miss an SLA?"

What a great answer looks like:

• Critical (system down, security incident): respond within 15 minutes, begin resolution within 30 minutes, 24/7
• High (significant impact on productivity): respond within 1 hour during business hours
• Standard: respond within 4 hours or same business day
• Miss consequence: service credit against the monthly fee, documented in writing

Red flags: "We always respond quickly." Response time SLAs that only apply during business hours. No mention of what happens when they miss the SLA.

RRG's answer: We guarantee an under-8-minute average response on critical tickets — a number we track and share in monthly reporting.

---

Question 2: Who actually answers when I call after hours?

Why it matters: Ransomware does not happen at 2 PM on a Tuesday. The real test of an MSP is what happens at 11 PM on a Friday.

What to ask: "If I have a critical issue at 10 PM on a Friday, who answers? Is it a live engineer or a pager service that relays a message? How long until a technician is actively working the issue?"

What a great answer looks like:

• A live engineer (not an answering service or overseas call center reading from a script)
• They have access to your documentation and your environment, not just a general helpdesk ticket system
• They are empowered to start remediating immediately, not just log a ticket

Red flags: "Our on-call engineer will call you back." The after-hours number goes to a voicemail. The after-hours coverage is a separate add-on service.

---

Question 3: What security tools are included — and what are add-ons?

Why it matters: Many MSPs quote a low per-user fee and then bill separately for every security tool. The "all-inclusive" quote becomes a line-item nightmare.

What to ask: "Walk me through the security tools included in your flat fee. Specifically: EDR, email filtering, DNS filtering, dark web monitoring, vulnerability scanning — included or billed separately?"

What a great answer looks like:

• Named products with named vendors (not "enterprise-grade endpoint protection")
• Clear line between what is included and what is an optional add-on
• No "we recommend our preferred security partner" upsell that doubles the monthly cost

The minimum acceptable security stack in 2026:

• Endpoint Detection & Response (EDR) — not just antivirus
• Email filtering with anti-phishing (Microsoft Defender for Office 365 or equivalent)
• DNS filtering (Cisco Umbrella, Cloudflare Gateway, or equivalent)
• Patch management — OS and third-party applications
• MFA enforcement on M365 and remote access

According to CISA's guidance, these controls form the baseline that every business should have in place — an MSP that does not include them is leaving you exposed.

---

Question 4: Do you operate a Security Operations Center — and what hours?

Why it matters: Monitoring without humans watching the alerts is not monitoring — it is alert fatigue waiting to happen.

What to ask: "Do you have a SOC? Is it internal or outsourced? What are the hours of coverage? What is the escalation path when a threat is detected?"

What a great answer looks like:

• 24/7 SOC coverage (either internal or via a named MSSP partner)
• Clear escalation path: alert → analyst review → customer notification → remediation
• Mean time to respond (MTTR) metrics they are willing to share

Red flags: "We monitor your systems 24/7" with no detail about who is doing the monitoring. The "SOC" is one person on an on-call rotation.

---

Question 5: How do you handle escalations when the first technician cannot resolve the issue?

Why it matters: Most problems are solved at tier 1. The ones that aren't are the ones that determine whether your business goes down for hours or days.

What to ask: "What is your escalation path? Who is tier 2 and tier 3? Do you have vendor relationship managers (Microsoft, Fortinet, etc.) who can escalate cases on our behalf?"

What a great answer looks like:

• Named escalation tiers with defined expertise areas
• Vendor relationships that allow priority case escalation (Microsoft Partner status, Fortinet certification)
• The escalation path is automatic, not something the customer has to request

---

Question 6: How much experience do you have with our specific industry?

Why it matters: HIPAA compliance requirements for a medical practice are fundamentally different from PCI-DSS requirements for a restaurant group. An MSP without industry-specific experience will treat regulatory requirements as an afterthought.

What to ask: "How many clients do you have in our industry? What specific compliance frameworks have you implemented? Can you provide a client reference in our sector?"

The baseline RRG serves:

• Healthcare (HIPAA) — medical practices, dental, behavioral health, home health
• Financial services (PCI-DSS, SOX) — wealth management, insurance, mortgage
• Aerospace (CMMC, ITAR) — defense contractors and supply chain
• K–12 and higher education (FERPA, CIPA)
• Nonprofit (donor data, grant compliance)

---

Question 7: How do you handle HIPAA, PCI-DSS, or other compliance requirements?

Why it matters: "We are familiar with HIPAA" and "We implement and document HIPAA technical safeguards as part of your managed services agreement" are very different answers.

What to ask: "Do you provide annual HIPAA risk assessments? Do you sign Business Associate Agreements? How do you document the technical safeguards you implement?"

What a great answer looks like:

• Will sign a BAA without making it a negotiation
• Provides or coordinates the annual risk assessment
• Documents technical controls in a format usable for an OCR audit
• Understands the difference between what the Security Rule requires and what the Privacy Rule requires

According to HHS HIPAA Security Rule guidance, covered entities are responsible for ensuring their business associates — including IT providers — have appropriate safeguards in place.

---

Question 8: What happens if you make a mistake that causes downtime or data loss?

Why it matters: Every IT provider makes mistakes. The question is whether they acknowledge it, fix it, and compensate you for the impact.

What to ask: "What is your liability if a change you make causes an outage? What insurance do you carry? What is your SLA credit policy for downtime caused by your error?"

What a great answer looks like:

• Professional liability (errors & omissions) insurance, specifically covering IT professional services
• Cyber liability insurance
• Clear language in the contract about their liability for mistakes — not a blanket limitation clause that caps liability at one month's fees

Red flags: "We're not liable for anything." A contract with a limitation of liability clause that caps damages at a nominal amount regardless of the incident severity.

---

Question 9: Walk me through your onboarding process

Why it matters: The first 90 days sets the tone for the entire relationship. Bad onboarding leads to missed assets, undocumented systems, and a support team that does not actually know your environment.

What to ask: "What happens in the first 30, 60, and 90 days? Who is our point of contact? What documentation do you create, and where is it stored?"

What a great answer looks like:

• A dedicated onboarding engineer (not the salesperson who closed the deal)
• Full asset discovery and documentation in the first 30 days
• A written environment overview delivered by day 60
• A defined transition from onboarding to steady-state at day 90, with a review meeting

---

Question 10: What is not included in the flat monthly fee?

Why it matters: This is the most important contract question. MSPs generate a significant portion of their revenue from out-of-scope work billed at hourly rates.

What to ask: "Give me three examples of things that would generate an additional invoice beyond the flat fee."

Common exclusions to watch for:

• New user setups or device provisioning above a certain monthly threshold
• Major projects (office moves, M365 migrations, new server deployment)
• After-hours support billed at a premium rate above the monthly fee
• Hardware and software costs (obvious, but confirm)
• Vendor-specific support (calling Microsoft on your behalf)

The goal is not to find an MSP with no exclusions — some exclusions are reasonable. The goal is to know exactly what they are before you sign.

---

Question 11: How do you handle patching — OS and third-party applications?

Why it matters: Unpatched vulnerabilities are the most common entry point for ransomware. Verizon's DBIR consistently shows that the majority of exploited vulnerabilities had patches available before the attack.

What to ask: "What is your patch SLA for critical vulnerabilities? Do you patch third-party applications (Chrome, Adobe, Java) or just the OS? How do you test patches before deploying to production?"

What a great answer looks like:

• Critical patches: 48 hours. High: 7 days. Standard: 30 days. In writing.
• Third-party application patching included, not optional
• A testing/staging process for patches that could break production software
• Monthly patch compliance reports

---

Question 12: How do you manage backups — and how often do you test restores?

Why it matters: "We run backups" is not a disaster recovery strategy. Backups that have never been tested are often corrupted, incomplete, or pointed at the wrong location.

What to ask: "What is the backup frequency, retention period, and recovery time objective for my critical systems? When did you last test a restore for a client, and what was the result? Are backups stored offsite and isolated from our network?"

What a great answer looks like:

• Daily backups at minimum, hourly for critical systems
• Offsite/cloud backup with immutability (cannot be encrypted or deleted by ransomware)
• Quarterly restore tests, documented with results
• A defined RTO (recovery time objective) and RPO (recovery point objective) for your environment

---

Question 13: Can I see my own ticket history and SLA performance data?

Why it matters: An MSP that cannot show you SLA performance data probably has performance it does not want you to see.

What to ask: "Do I have access to a client portal where I can see open tickets, ticket history, and SLA reporting? Can I pull a monthly summary myself?"

What a great answer looks like:

• A client-facing portal (ConnectWise Manage, Autotask, HaloPSA, or similar)
• Monthly reporting delivered proactively, not only on request
• You can verify response times yourself, not just take their word for it

---

Question 14: Who owns the documentation and configurations you create?

Why it matters: Some MSPs treat the documentation of your environment as proprietary — a retention tool that makes switching harder.

What to ask: "If we terminate the agreement, do we receive complete documentation of our environment? Network diagrams, passwords, configurations, runbooks — all of it?"

What a great answer looks like: "Yes, it all belongs to you. Upon termination, we will provide a complete documentation package within 30 days and cooperate with your successor vendor."

Red flags: Vague answers. Policies that transfer documentation "subject to payment of outstanding balances." Configurations stored in a proprietary system with no export capability.

---

Question 15: What are the contract exit terms?

Why it matters: You will eventually switch. Either the relationship doesn't work, your business changes, or a better option emerges. The exit terms determine how painful that is.

What to ask: "What is the minimum term? What is the auto-renewal clause? What is the notice period for non-renewal? Is there a buyout penalty? What does transition assistance look like?"

What to look for:

• Notice period of 30–90 days for non-renewal (60 days is standard)
• No penalty for non-renewal — just the notice period
• Auto-renewal provisions that are clearly disclosed (not buried in section 14.3.b)
• A transition assistance clause committing them to cooperate with your successor

---

Comparison: What to Expect from Different MSP Tiers

Capability	Budget MSP (<$75/user/mo)	Mid-Market MSP ($100–$175/user/mo)	RRG Networks
Response time SLA	Best effort	1–4 hrs business hours	Under 8 min average
After-hours coverage	Pager/voicemail	On-call rotation	Live engineers, 24/7
Security stack	Basic AV + firewall	EDR + email filter	Full stack + 24/7 SOC
Compliance (HIPAA/PCI)	"Familiar with"	Optional add-on	Included + documented
Patch management	Monthly OS only	OS + some 3rd party	OS + full 3rd party + SLA
Backup testing	Ad-hoc	Quarterly	Quarterly + documented
Client portal	Ticket view only	Ticket + basic reporting	Full reporting + SLA metrics
BAA / contract terms	Negotiated	Standard 12–36 mo	Reasonable, client-friendly

If you're ready to compare RRG Networks against your current provider or another proposal, we're happy to do a side-by-side review. Book a free 30-minute discovery call — no commitment, no pitch.