Managed Service Provider (MSP)
Buyer’s Guide

Every modern organization must ensure its employees have secure access to the critical infrastructure and applications that drive the business. When your systems go down or are breached, employees are unproductive, customers are not served, sales stop, costs soar, and you are exposed to data loss and reputation damage.

This is why small to midsize businesses (SMBs) outsource all or part of their IT support. A benefit of managed service is the modern approach organizations use to access the latest technologies and the experts required to support them. Instead of building an internal IT team or paying for expertise on a time and material (T&M) basis, MSPs allow with guaranteed service levels.

MSPs plan, monitor, manage, and optimize on-premises and cloud-based systems including servers, laptops, operating systems, applications, databases, mobile devices, networks, agreed-upon performance standards as contained in a service level agreement (SLA).

MSPs make IT work for business by allowing you to:

• Focus your resources on your core business—By having a trusted ally take over the burden of IT management.
• Enable your team to focus on higher-level needs—And tasks.
• Ensure system uptime—And the performance of your business- critical applications.
• Continuously improve data security to prevent data loss—And comply with regulations.
• Get access to deep technical talent that can help you rapidly respond to problems when they occur—And ready your organization for the future.

Why SMBs outsource IT to MSPs:

01 Reduce Downtime

Downtime hurts. Customers aren’t served, employee productivity tanks, deadlines are missed, and business is lost. The exact impact of downtime depends on your industry. If you are a healthcare provider, you may be unable to access patient records.

If you are a manufacturer, production may grind to a halt. If you are a property manager, you may lose rental opportunities. If you are a retailer, you may not be able to process credit card transactions. If you are a salesperson, you may not be able to connect with prospects and customers.

A good MSP will help you reduce downtime and maintain business continuity in several key ways:

• Ensure your network is well designed and secure
• Actively detect threats and automatically patch systems
• Proactively monitor your environment and address issues before they cause downtime time to resolution
• Self-heal and remediate problems before a user is even impacted
• Provide deep expertise across all IT disciplines and business applications

02 Access the Broad Range of Experts Required to Manage Today’s IT Complexity

The technologies supporting your business are diverse and complex. Servers, operating systems, applications, databases, endpoints, firewalls, DNS, cybersecurity solutions, networks, storage, and virtualized environments all must be taken into account. Moreover, today's security and compliance/governance issues add to the challenge.

Broad and deep IT talent and knowledge are necessary to address the IT issues that can impact your business. Unfortunately, most small and midsize businesses can't afford to have all the IT talent available in-house at a moment’s notice, which is the reason many organizations look to outsource all or part of their IT to MSPs. Many organizations with internal IT teams augment their staff with MSPs to address specific areas such as patch management, monitoring, and security.

03 Protect Data and Systems

Data is the lifeblood of your organization. Whether it is medical records, personally  inventory, customer records, intellectual property, or employee files, data is your most important asset. Unfortunately, many things can go wrong.

For example, a hardware or software malfunction, human error, a natural disaster, a security breach, or even something as simple as a software upgrade can cause data loss. And with IT environments becoming even more complex and data volumes continuously growing your data - whether it resides in on-premises servers, in the cloud, or on employee laptops and mobile devices - drives your company’s success.

MSPs can help you keep your data safe. Ensuring that you have backup solutions and policies in place with on-and off-site copies in an important fundamental task MSPs perform to protect your data.

Also, ensuring your network is hardened to prevent breaches is a required service that a solid MSP should automatically include in its engagement.

04 Address Security Concerns and Mitigate Risk

Are you confident that you are safe from a security attack and that you are complying with regulations like HIPAA, PCI, and GDPR? Are you sure your perimeter is hardened, your security procedures are up to par, and your security posture is adequate?

Can your employees go to any website and download anything they want? Do your employees know what to do if they receive a phishing email that could lead to a breach? Are you certain your systems and data are secure from malware and ransomware?

Many business owners and executives will tell you that the security of their data is what keeps them up at night. Why? Because they do not have access to a security expert who can implement the needed IT controls and best practices.

The fact is, what you don’t know about the security of your data CAN hurt you, because cyberattacks and data breaches happen every day to businesses of all sizes. For these reasons, SMBs look to MSPs to reduce threats and ensure their data is secure.

The best MSPs continuously monitor your security posture and use machine learning, automation, modern MSPs should incorporate security management as native to their engagement, as IT can no longer be managed without including some form of managed IT security.

05 Improve Employee Productivity

Today, almost every employee needs access to the internet, their email, and business- critical applications. When a system is down, a password needs to be reset or access is denied and your employees are unproductive, which is why some MSPs offer help desk assistance to fix your employee’s IT problems fast and get them back to work.

If you’ve had an in-house help desk, you know it is costly and hard to manage. Employees who lack access to internal support can be costly. They spend time and money trying to fix the issue themselves or looking for someone who can.          

No longer considered a necessary evil, help desks keep employees productive, and successful businesses understand their value, which is why many organizations rely on help desk maintenance and support from an MSP. Help desks are no longer the traditional entry-level note-taking and routing-forward personnel.

A good MSP will treat the first call as the primary point of problem resolution. Triage experts will either troubleshoot and remediate the problem or precisely route it to the proper expert within the MSP technical organization. The help desk should be awesome and not simply a ticket-creation roadblock.

Help desks are no longer the traditional entry-level note-taking and routing-forward personnel. 

06 Planning for the Future

Managed services are not only about blocking and tackling day-to-day issues. Leading MSPs provide access to strategic technology planning.

A good MSP can help you stay current on new developments in IT and how they impact your business.

Choose an MSP that can provide your organization with top-notch IT advice and guidance. This includes strategic issues, new products, and new services. Ask about the levels of expertise and years of experience its team members have supporting IT infrastructures like yours. Ask about their understanding of other popular technology and standard tools.

Just as important, choose an MSP that also understands your business and values its role as your trusted advisor. Most important, your MSP should be a partner with skin in the game and should never be viewed as a vendor.

On the surface, MSPs can all look the same. But just as a Toyota is different from a Ford, a Dell PC is different from a Mac, and Amazon is different from Ebay, all MSPs and IT outsources are not created equal. The MSPs that serve Fortune 500 companies are not the same as the MSPs that serve small and medium-sized businesses. This guide focuses on MSPs that primarily serve SMBs that completely outsource their IT or augment their existing IT teams with specialized capabilities and expertise.

Since it’s so important to understand the range of services that an MSP provides, let’s take a look from two perspectives:

• Technologies managed
• Services provided

What Technologies Do MSPs Manage?

01 Applications

MSPs must have expertise in Microsoft products to provide managed services to small and medium-sized businesses. These products include Microsoft Office365, Sharepoint®, Active Directory®, Azure, and Dynamics®. Look for an MSP that specializes in your industry. Make sure their team knows your business and can provide IT support for popular applications specific to that industry.

02 Mobile Devices

Whether you provide mobile devices to your employees or have a BYOD policy, an MSP can assist with managing the devices, wireless access, and data protection to ensure secure and reliable access to organizational assets from mobile devices.

03 IT Infrastructure

Engaging an MSP to manage your on-premises and cloud infrastructure is an option. This could include physical servers, virtual servers, and other related services. If you are a Microsoft customer, find an MSP that specializes in Windows Server®, Windows® Desktop, and Hyper-V®.

If you are moving to a virtualized environment, or planning to do so, you may need technical assistance. This includes hypervisor environments such as VMware® and Citrix®. Check each item and make sure it performs properly.

04 Cloud Platforms

If your organization has a private or public cloud, MSPs can help you migrate all or part of your infrastructure and applications to the cloud. Look for MSPs that have experience across cloud platforms including Azure and Amazon Web Services.

05 Databases

If your SQL Server® database fails, your entire business can fail, which is why SMBs use managed database services. Your databases, just like your operating systems and applications, need regular maintenance. This includes patching, backing up, and optimizing for peak performance.

Database optimization and management services should be a core offering of any MSP today.

06 Storage

much of the cost associated with traditional backup methods and eliminates the need for in-house administration. MSPs improve data protection and disaster recovery. They ensure that data is backed up and stored in multiple places. Make sure your MSP has proven validation of added volumes, data integrity, and recovery points for all critical business data.

What Types of Services Does an MSP offer

01 PatchManagement

This service includes patching:

• Network devices
• Operating systems
• Applications
• Databases

This is to ensure the software is always up to date and protected from emerging threats and exploits. Software vendors are releasing patches with greater frequency, which creates measures.

Advanced MSPs automate the patch management process, which eliminates human error and ensures timely updates. In addition, detailed reporting should be available in real-time so you can see the patch status of your environment across devices.

02 Equipment and License Procurement

Managing numerous hardware and software vendors can be time intensive and complicated. Mature MSPs have regular contact with technology vendors. They have the necessary knowledge to get better deals on pricing, terms, and conditions. Leading MSPs can help renewals, warranties, and end-of-life management.

03 Monitoring and Alerting

Full-service MSPs provide remote monitoring and alerting to immediately detect problems in your infrastructure. MSPs often have Network Operating Centers (NOCs). These NOCs monitor performance and can quickly respond to critical issues. This helps to keep your systems running smoothly.

04 Security

Every day you hear about new cyberattacks hitting large and small companies, and you know you are not immune. Cybersecurity experts are in short supply. The top MSPs have the certified security experts you need to protect your data and provide peace of mind.

Look for an MSP that offers vulnerability testing, managed anti-spam and antivirus, DNS security, and perimeter protection as part of its service for SMBs that must maintain a higher level of security to meet corporate and regulatory requirements. Security management in IT is no longer optional.

05 Backup and Disaster Recovery

Protecting your data is essential. Backing up data regularly is essential. It allows us to quickly restore data if it is corrupted or lost, or if a system is infected.

This can help prevent disaster. Disaster recovery is a plan to ensure your IT systems and data are back up and running should your IT assets (e.g., data center) be destroyed by a major advanced MSPs use sophisticated automated technology backups for most network equipment, ensuring faster recovery in case of a failure.

06 Help Desk

When problems occur, you need help fast. That’s where the help desk comes in. Whether it’s an end user who needs to reset a password or an application owner concerned about system performance, MSPs should provide help desk and technical support to troubleshoot and remedy their issues.

Help desk technicians are your immediate it’s a problem with end-user laptops or critical components of the IT infrastructure, and assign the correct specialist as required. Look for and, most important, a help desk capable of resolving most issues on

07 Remote Management

When your users have problems, MSPs can troubleshoot and resolve them remotely. MSPs can find weak spots in your servers, workstations, routers, and switches. If a problem occurs, they can quickly identify the cause.

This reduces downtime and lowers IT costs. Look for MSPs that have invested in remote monitoring and management tools that can automate up resolution of issues as they arise.

The best MSPs address as many problems as possible through automation, which can remediate a problem in milliseconds versus minutes or hours. MSP Tip: Ask about self-healing! The best-in-class MSPs have self-healing technology that addresses a majority of common issues before an end user even experiences a problem.

08 Compliance and Risk Management

Your business must be continuously mindful of and in compliance with regulations and frameworks such as GLBA, COBIT, GDPR, HIPAA, ISO, ITIL, PCI DSS, and SOX.

Compliance at an organizational level is achieved through management processes. These processes identify contracts, strategies, and policies. They then assess the state of compliance and the risks and expenses associated with non-compliance.₁

Finally, the processes prioritize, fund, and initiate corrective actions as needed. Many SMBs and compliance as a managed service are helping these businesses maintain compliance, reduce risk, and cut costs. 

MSP Tip: Ask about self-healing! The best-in-class MSPs have self-healing technology that addresses a majority of common issues before an end user even experiences a problem.

https://en.wikipedia.org/wiki/Governance,_risk_management,_and_compliance

Outsourcing critical IT systems for your business is a big decision. You need confidence and trust in you provider.

Key benchmarks to measure the fitness of your SMP:

• Customer Support, Responsiveness, and Ease of Doing Business
• Automation Technology
• Security Services
• Technologies Supported and Services Offered
• Operational Excellence and Process Maturity
• Remote Monitoring Systems and Automation
• Breadth and Depth of Technical Expertise and Capacity

Your MSP should be the trusted advisor that can coach you on the and continued operation of your entire IT infrastructure, the security of your systems and data, and compliance with regulatory requirements.

View your managed services provider (MSP) as a strategic partner, not just a provider. This will make your experience with managed services more successful. So, how can you understand an MSP’s capabilities and ability to be a trusted partner?

01 Responsiveness

You want an MSP that can meet your response time requirements, deliver service as per the SLA, and be a true partner with your organization. You want a partner who supports you. They should be willing to do whatever is necessary for your success. They should also treat your business as if it is their own.

Remember that your relationship with your MSP will be for the long term and must stand the test of time. This means that in addition to asking for proof of its success with business models like yours, you must evaluate the “soft” values and the MSP’s “emotional intelligence to work well with not only your technology, but also your people.”

Assess the MSP's integrity and reputation. Determine how willing they are to assist. Evaluate their capacity to collaborate with your organization.

How do you do this?

Speak with references and ask about these soft values when you do. These will be just as important as the MSP’s level of technical expertise.

02 Ease of Onboarding

Whether you are outsourcing your IT for the first time or switching MSPs, the onboarding process is critical. Done properly, it is a relatively quick and painless process. Leading MSPs have dedicated teams, project managers and specialists to ensure onboarding is quick and plan accordingly.

This is arguably the most important part of a transition, so ensure your MSP has a wealth of experience and a proven process for onboarding new clients. Experience and track record matter!

03 A Team of IT and Business Experts

First, you want to evaluate the MSP’s technical expertise. You need to determine what the MSP’s bench strength and experience are with the technologies your business uses, as well as with other popular technologies and industry-standard tools.

Just as important, you also want the MSP to demonstrate business expertise beyond your infrastructure; one that can marry business realities with IT best problems. Just as important, you want to be sure that the MSP has the appropriate security expertise and certifications.

04 Operational Excellence

MSPs can be large or small, ranging from companies that have hundreds of employees to a small business that has two IT technicians working from a garage.

As an SMB, you want to work with an MSP that has the full range of expertise to support your current and future needs, and focuses on businesses that are your size.

Large MSPs typically work with enterprise-size, global organizations. While they may service smaller businesses, you may find that your business gets lost in their customer mix. On the other hand, small MSPs that consist of just a few employees do not have the business maturity to consistently meet Service Level Agreements (SLAs).

Make sure the MSP you choose has documented processes in place that provide the standards for its operational maturity and excellence. Innovative MSPs assess their level of operational maturity using Service Leadership’s Operational Maturity Level (OML) methodology.

The OML model scores MSPs on a scale of 1 to 5. Look for MSPs that score above 4.0 in order to have confidence in their operational processes and maturity.

Innovative MSPs assess their level of operational maturity using Service Leadership’s Operational Maturity Level (OML) methodology.

05 Automation and Quality Assurance

The most sophisticated MSPs codify mature business and IT practices to automate self-healing tasks.

Examples of automation include automated patching of operating systems and applications, running backups, running infrastructure and security audits, and straightforward help desk assistance.

Automation is important to you because the more these tasks are automated, the better your IT performance will be. The best MSPs automate endpoint review and scan networks daily to remediate issues such as missing antivirus protection and backup failures.

By leveraging automation, an MSP can perform tasks faster and more efficiently without increasing costs. Automation also eliminates human error and provides assurance that an activity has occurred as planned.

For example, all MSPs have technicians that check on their customers’ systems. But if it is a manual process, it may be too costly to do this every night. With automation, an MSP can audit every device as often as required to patch appropriate systems, check for new devices, ensure backups are successful, deploy monitoring agents and antivirus software, identify other potential security weaknesses, etc. Not only does this eliminate improves system performance and uptime.

Automation also provides more advanced reporting - proof that tasks were completed as well as the information on the problems that were fixed.

06 Deep Security Expertise

Information security is important! With the number and types of cyberattacks growing, the security of your systems and data can be maintained only if all your employees and partners take ownership. When it comes to engaging an MSP, you must assess the service and has a dedicated team of senior-level CISSPs (Certified Information Systems Security Software Lifecycle Professionals) with 10-20 years of experience.

Just as important, consider only MSPs that are SOC 2-compliant, which means the best-in-class safeguards and procedures in place to ensure the security and privacy of its customers’ information. 

Look for an MSP that is obsessed with delivering great customer experiences - and can prove it!

Ask to see an MSP’s Net Promoter Score®, customer satisfaction metrics, or Customer Effort Score.

07 A Delightful Customer Experience

Most of us have had bad customer experiences with service providers such as mechanics, plumbers, and insurance companies. And we have also experienced great customer service when the provider “went the extra mile” and really took care of us. Look for an MSP that is obsessed with delivering great customer experiences - and can prove it!

Ask to see an MSP’s Net Promoter Score®, customer satisfaction metrics, or Customer Effort Score. If an MSP cannot or will not share this information with you, walk away. It may be that the results of its customer surveys do not pass muster or the MSP. Maybe they don't have the operational maturity in place to promote a customer experience program.

Even if an MSP’s survey scores are high, questions about their buying, support, billing, and service experiences. 

08 Governance and Regulatory Compliance

If you are a financial services or healthcare organization, you know the importance of governance and compliance. Unfortunately, it is not a one-time event but a plan and series of ongoing actions that ensure your business is consistently compliant.

Advanced MSPs can assist your organization with the design of governance standards and the processes to ensure you adhere to these standards. Good governance is important for security and regulatory compliance. Even small companies must meet the standards of their larger customers.

Healthcare providers must follow HIPAA regulations. Even a remote employee working from home can break patient privacy rules. Your organization must set standards to ascertain what users have remote access, what devices they can use, and what the minimum requirements are for setting up these remote devices.

HIPAA requires you to consistently monitor devices and the network. This is to ensure the standards are maintained. Once established, the standards must be upheld.

Look for an MSP that can assist and govern your IT compliance and regulatory needs, providing peace of mind and minimizing the risk of noncompliance. 

Experience

• How many managed services customers do you have in total?
• How many customers do you have that are our size? What is your “sweet spot” for customer size?
• How many endpoints do you manage?
• How many people are on your service delivery team?

Value

• How do you help customers improve their use of money and lower IT costs?
• How do you help customers plan for the future?
• How do you help customers identify and mitigate threats before problems occur?
•  In what situations will you advise customers to purchase technology that you don’t sell?

Service offerings

• What services are included in your managed services offerings?
• What technologies do you support?
•  What security services do you offer?
• What SLAs do you offer for incident response, and what is your SLA compliance rate?
• What cloud platforms do you support? 
• Do you offer any IT compliance services?
• Do you incorporate security into your managed services offerings?

Customer Satisfaction

• How do you measure customer satisfaction? 
• What is your customer satisfaction performance for the past 12 months?
• What is your annual managed services customer churn rate? 

Operational excellence

• What metrics and reports do you share with customers to demonstrate the status of their environment and incident response effectiveness?
• What’s different or unique about your systems management approach?
• Are your support tools integrated into a single dashboard?
• What is the number of daily incidents resolved automatically by proprietary automation?
• How do you audit patch status and remediate threats?
• How do you measure and report the success rates for backups?
• What is the first-call resolution rate for call to the help desk?
• How do you ensure that technicians are knowledgeable about customer environments?
• How do you ensure knowledge is not lost when staff leaves?
• How many backups are successfully performed daily? How do you know they are successful?
• Do you adopt ITIL or similar excellent practices around IT service delivery? 

Your competitors are just as challenged as you are when it comes to the continuous operation of their IT infrastructure. You could be wondering what they are doing about their IT problems.

Every MSP offers different services and subscription plans, which means that you must carefully evaluate each MSP’s ability to perform. Assessing an MSP's technical expertise is important. Furthermore, you must ensure that the MSP meets your standards for performance, security, governance, and customer service. To that end, Appendix A provides a list of questions you should ask when evaluating an MSP as your strategic partner. 

Today, many SMBs are turning to MSPs to keep their systems up and secure, their employees productive, and their business operations running.