Choosing a managed service provider: the 12-question checklist

To choose a managed service provider, do not start by comparing prices: ask every candidate the same twelve questions, demand proof for each answer and score them on the same grid. A managed services contract commits your company for years. Price matters, but these answers are what will make the difference the day a server goes down late on a Friday.

This checklist is for business owners, finance directors and IT managers of SMBs, in Morocco and elsewhere, who need to hand all or part of their IT to a provider. It complements our article on the questions to ask an IT provider in Casablanca, focusing on how to run the selection and separate the candidates.

Before the questions: prepare your brief

A provider can only answer seriously if you tell them what they will be responsible for. Prepare one page summarising:

• the number of users, workstations, servers and sites;
• network and security equipment: firewalls, switches, WiFi;
• the cloud services you use: email, Microsoft 365 or Google Workspace, business applications;
• what is critical to the business and what can wait;
• what is not working today, unfiltered.

If you do not have this overview, start with an IT audit: it is the common baseline that makes offers genuinely comparable.

The 12 questions

On monitoring

1. What exactly do you monitor, and with which tool? A real MSP watches servers, backups, firewalls, disk space and certificates, and can show you the console live, not a screenshot from a brochure.
2. Who receives alerts at night and on weekends? A named on-call engineer with a rota, not a mailbox read on Monday.
3. What is the contractual response time for a blocking incident? Demand a written number, not “as soon as possible”, and have them spell out the difference between response and resolution.

On security

4. Where are my backups, and when were they last restored? The right answer names an off-site location, an immutable copy and a recent test date.
5. Is MFA enabled on all administrator access, including yours? The provider’s accounts are an entry point like any other.
6. How do you manage the passwords of my systems? The answer must contain the word “vault”, with access for you.

On transparency

7. Can I get a monthly report? Incidents, response times, patches applied, backup status, remaining capacity. Ask for an anonymised sample.
8. Does the documentation of my infrastructure belong to me? Yes, unconditionally, and it must be current.
9. What happens if I change provider? A serious MSP builds reversibility into the contract: what is handed over, how fast, at what cost.

On expertise

10. Who will actually work on my site? Meet the engineer, not just the salesperson, and ask who covers during their holidays.
11. Which certifications or partnerships do you hold on the technologies I use? A partnership can be checked on the vendor’s site, for example for Fortinet or Microsoft.
12. Can you give me two clients my size to call? References you contact yourself, not just logos.

The scoring grid

Ask every candidate the same questions in the same order, and score each answer according to the proof provided. The principle is simple: a claim without proof is worth less than a modest but verifiable answer.

Score	Meaning	Example for question 4
0	No answer, vague answer or “we’ll get back to you”	“Backups run every day, don’t worry.”
1	Correct answer, but no proof	“Off-site copy and regular testing” with no date or report
2	Precise answer, demonstrated or written into the contract	Restore test report shown, clause in the contract

Add up the points: the total out of 24 gives a first reading. Then look at the zeros one by one. A zero on backups, on-call or reversibility is a deal-breaker in our view, whatever the total. Only then do you compare prices, checking that the quotes cover the same scope; our article on managed IT pricing in Morocco explains how to read a quote.

The selection method, step by step

1. Prepare the one-page brief described above and send it to three candidates at most: beyond that, the comparison becomes superficial.
2. Hold one meeting per candidate, with the person who will manage the contract on your side, and ask the twelve questions.
3. Ask for proof: console demonstration, sample monthly report, contract template with the response-time and reversibility clauses.
4. Call the references yourself, asking how the last serious incident was handled.
5. Score on the grid, ideally with two people, then compare totals and zeros.
6. Compare prices on an equal scope, only at this stage.
7. Have the contract reviewed before signing: timings, scope, exclusions, term, exit conditions.

Warning signs

• The salesperson answers everything, but no engineer is available for the meeting.
• The response time is written nowhere, or only in a brochure.
• Administrator passwords would stay with the provider, with no access for you.
• Leaving the contract is priced to deter you, or is not provided for at all.
• The quote is a flat fee but the covered scope is not listed.
• No reachable references, only logos on a website.

Common mistakes

1. Choosing on the monthly price without checking what is included: monitoring, patching, security, or just break-fix.
2. Confusing break-fix with managed services: the first steps in when things break, the second works so they do not. Our comparison of managed services vs in-house IT helps frame the need.
3. Not reading the exclusions: licences, hardware, travel, out-of-hours work.
4. Signing without reversibility and discovering on the way out that documentation and access are not handed over.
5. Forgetting to ask for a sample monthly report: without it, you will never know what the provider actually does.

Checklist before signing

• The twelve questions asked of every candidate, each with a score on the grid.
• Monitoring console seen in a demonstration.
• Named on-call engineer and response time written into the contract.
• Date of the last restore test known, and test frequency agreed.
• MFA on all administrator access, password vault with access for you.
• Sample monthly report received.
• Reversibility clause: documentation, access, backups, exit timing and cost.
• Two references called.
• Scope, exclusions and commitment term reviewed.

How we do it

We answer these twelve questions in writing, and our answers fit on one page. Every new client starts with a free initial audit that sets the scope and priorities. Our commitments are written into the contract: 24/7 monitoring of your servers, backups, firewalls and certificates, critical incidents handled in under 15 minutes, replies to other requests within 24 business hours. You receive a monthly report, the documentation belongs to you and reversibility is built in from day one. Our offering is detailed on the managed IT page, our vendor partnerships on the partners page, and examples of our work in our case studies.

For the full picture, read our complete guide to managed IT services in Morocco.

Want our answers to the twelve questions, and a clear picture of your IT? Ask us for a free audit.