There are myriad factors to consider when you’re selecting a new or evaluating your current Managed Services Provider (MSP). Companies must be mindful that there’s more to an effective MSP than the ability to fix things and perform basic tech support. How MSPs manage their own governance and compliance practices, the processes they employ, and the way their people deliver value to their customers are also imperative.
Considering these three areas – Technology, Process, and People – we put together a Top 8 list of questions to consider, helping you ensure organizational resilience when it comes to your IT needs.
The questions address your most important needs (e.g., regulatory compliance) in different ways, so it’s important to consider each question and its impact on your business.
TECHNOLOGY QUESTIONS FOR MSPs
1. Does your Managed Services Provider have high confidence in their security posture – and can they explain why?
A strong security posture from MSPs demonstrates their credibility and commitment to safeguarding your assets. Regulatory compliance and risk mitigation are critical here. The ability to test and validate security controls, assess risks, and implement appropriate safeguards provides assurances that your systems will be hardened against threats.
In addition, MSPs should be able to describe how their incident response enables them to respond swiftly to contain and remediate issues. To build high confidence in their security posture, good MSPs will implement industry best practices, including:
- Documented security policies and control frameworks
- Multi-factor authentication and role-based access controls
- Advanced endpoint, network, and email security defenses
- 24/7 security monitoring and incident response capabilities
- Data encryption and secure backup/recovery processes
- Staff security awareness training and vetting processes
- Compliance with regulations like HIPAA, PCI-DSS, NIST 800-171, etc.
Expect your MSP to have a continually validated security program and the ability to articulate it clearly if you want to be confident your critical systems and data are in expert hands.
2. Do they perform regular security risk assessments?
An MSP implements various security controls and defenses to protect your IT systems and data. However, the effectiveness of these controls can degrade over time due to changes in technology, processes, or personnel. Routine risk assessments validate whether security measures are functioning as intended and highlight any control failures or gaps to be addressed.
To be effective, qualified security professionals using industry-recognized methodologies and frameworks, such as NIST 800-30, ISO 27005, or OCTAVE risk conduct assessments. The assessments must be designed to evaluate various risk factors, including vulnerabilities, threats, likelihood of occurrence, and potential impacts across the MSP’s infrastructure, processes, policies, and personnel
PROCESS QUESTIONS FOR MSPs
3. Are they audited by a third-party?
While an MSP may have robust internal security controls and processes, an objective third-party assessment provides an impartial validation that these measures are effective and align with industry best practices and regulatory standards.
As you’re entrusting your sensitive data and critical IT systems to an MSP, these audits are essential. Third-party audits and certifications, such as SOC 2, ISO 27001, or HITRUST, demonstrate the MSP adheres to rigorous security and compliance frameworks. Many industries have strict cybersecurity and data privacy regulations, mandated by frameworks such as HIPAA, PCI-DSS, NIST 800-171. However, third-party audits are invaluable even if rigorous, specific frameworks don’t apply to your industry.
To ensure the integrity and credibility of these audits, expect your MSP to engage reputable third-party assessment firms whose audits examine various aspects of the MSP’s operations, including:
- Physical and environmental security
- Network and infrastructure security
- Access controls and authentication
- Data protection and encryption
- Incident response and business continuity
- Risk management and vendor management
- Policies, procedures, and employee training
By undergoing regular third-party audits and maintaining relevant certifications, the MSP demonstrates they prioritize security, adhere to compliance requirements, and continuously improve their defenses against evolving cyber threats.
4. Does your MSP follow proven Organizational Change Management (OCM) principles?
Finally, as IT initiatives often support broader organizational goals like increasing efficiency, enabling growth, or transforming business models, OCM helps to align IT efforts with overarching strategies by involving cross-functional stakeholders, assessing impacts, optimizing resources, and adapting solutions to meet evolving needs.
Effective Organizational Change Management for IT relies on key components such as:
- Executive sponsorship and clear vision
- Cross-functional governance and stakeholder involvement
- Formalized policies, procedures, and approval processes
- Employee communication, training, and resistance management
- Continuous process improvement based on lessons learned
Proactively applying Organizational Change Management helps you and your MSP partner to realize the full benefits of IT initiatives while minimizing operational disruptions, reducing risks, and maintaining compliance.
5. Do they address all your compliance needs?
As the trusted IT partner, the MSP is responsible for ensuring your IT infrastructure, data handling processes, and security controls adhere to regulatory frameworks and compliance mandates. Failure to address these needs can result in severe penalties, fines, and legal consequences for your company.
For businesses subject to strict compliance regulations around data privacy, security, and breach notification procedures (e.g., GDPR, HIPAA, and PCI-DSS), how MSPs handle their customers’ sensitive data is paramount for mitigating the risk of data breaches and the associated fallout. Requirements for business continuity and disaster recovery planning are also factors under these frameworks. For instance, HIPAA requires contingency plans for data backup, emergency operations, and recovery procedures.
To effectively address customers’ compliance needs, look for an MSP that takes a comprehensive approach, which includes:
- Understanding your industry and applicable compliance frameworks.
- Conducting thorough risk assessments and gap analyses to identify compliance requirements.
- Implementing appropriate security controls, policies, and procedures to meet these requirements.
- Providing compliance training and awareness programs for your staff.
- Maintaining detailed documentation and audit trails for compliance verification.
- Continuously monitoring and updating their processes to align with evolving regulations.
Your MSP must proactively address all your compliance needs to not only mitigate legal and financial risks, but also to demonstrate their commitment to delivering secure, compliant, and trustworthy services. Expect your MSP to foster a partnership with you.
6. Does your Managed Services Provider offer 24/7/365 support?
Having 24/7/365 support is another factor that helps you ensure business continuity and uptime, incident response, and cybersecurity. Like all businesses these days, you rely heavily on your IT infrastructure and applications to function, service customers, and generate revenue. System downtime or disruption has consequences, including lost productivity, revenue losses, and even possible reputational damage. Your MSP must provide you with round-the-clock support so that your IT environment is continuously monitored, and issues are addressed promptly to minimize the impact.
Further, cyberthreats and security incidents occur 24 hours a day, not just your business hours. Plus, many businesses operate globally or have employees, customers, and stakeholders spanning many time zones. By providing around-the-clock support, Managed Services Providers can effectively cater to the IT needs of clients with dispersed operations or those who require assistance outside of traditional business hours.
Your MSP must provide 24/7/365 so you can be confident that any disruptions within your IT environment will be minimized, enabling virtually uninterrupted business operations.
PEOPLE QUESTIONS FOR MSPs
7. Can they explain things to you in a way you can understand – so you can make informed business decisions?
Plus, part of your MSP’s job is to present you with recommendations, strategies, and solutions. If these are conveyed using overly technical language or industry-specific jargon, it can hinder your ability to make the informed decisions that work best for your organization. When they use clear language, your MSP empowers you to fully comprehend the implications and benefits of proposed solutions when making business decisions.
Expect your MSP prioritize clear, jargon-free communication, to build a strong partnership with your organization. Look for an MSP you can rely on as a trusted advisor, one who prioritizes transparency and understanding in their service delivery.
8. Do you offer access to senior IT consultants or a vCIO for oversight and guidance?
Senior IT consultants and Virtual Chief Information Officers (vCIOs) bring extensive experience and expertise in the art of aligning technology strategies with business goals. They provide a high-level perspective and can guide you in making informed decisions about IT investments, prioritizing initiatives, and ensuring that technology enables and supports your organization’s overall objectives.
Experienced IT consultants and vCIOs are highly qualified to assist you in developing comprehensive technology roadmaps and plans. They assess your current IT environment, identify gaps or bottlenecks, and recommend ways to optimize processes, upgrade infrastructure, and/or implement new solutions to support future growth and scalability.
In addition to providing strategic guidance, senior IT consultants and vCIOs confer valuable staff augmentation and knowledge transfer opportunities. These experts can mentor and train your in-house IT team, share best practices, and help bridge knowledge gaps.
Finally, the expert guidance provided by senior consultants or a vCIO further supports your other IT needs, such as cybersecurity, risk management, and IT governance.
By offering access to this level of expertise, your Managed Services Provider provides the guidance necessary to navigate the complexities of IT strategy, cybersecurity, compliance, and governance. Access to these experts will elevate your ability to optimize your technology investments, mitigate risks, and ultimately achieve a competitive advantage through effective technology utilization.
A Starting Point
Finding the right Managed Services for your organization impacts many success outcomes. Don’t settle for a “good enough” MSP; invest in an MSP that will partner with you to protect your business and help you drive results.
