(412) 643-0339 info@enkompas.com

There are myriad factors to consider when you’re selecting a new or evaluating your current Managed Services Provider (MSP). Companies must be mindful that there’s more to an effective MSP than the ability to fix things and perform basic tech support. How MSPs manage their own governance and compliance practices, the processes they employ, and the way their people deliver value to their customers are also imperative.

Considering these three areas – Technology, Process, and People – we put together a Top 8 list of questions to consider, helping you ensure organizational resilience when it comes to your IT needs.

The questions address your most important needs (e.g., regulatory compliance) in different ways, so it’s important to consider each question and its impact on your business.


Thought there’s more to Managed IT Services than the technology, the tech is the basic foundation of the services provided. So, we’ll begin with our technology questions.

1. Does your Managed Services Provider have high confidence in their security posture – and can they explain why?

Managed Services Providers must have a robust security posture they’re confident in – and they should be able to back it up convincingly.

A strong security posture from MSPs demonstrates their credibility and commitment to safeguarding your assets. Regulatory compliance and risk mitigation are critical here. The ability to test and validate security controls, assess risks, and implement appropriate safeguards provides assurances that your systems will be hardened against threats.

In addition, MSPs should be able to describe how their incident response enables them to respond swiftly to contain and remediate issues. To build high confidence in their security posture, good MSPs will implement industry best practices, including:


  • Documented security policies and control frameworks
  • Multi-factor authentication and role-based access controls
  • Advanced endpoint, network, and email security defenses
  • 24/7 security monitoring and incident response capabilities
  • Data encryption and secure backup/recovery processes
  • Staff security awareness training and vetting processes
  • Compliance with regulations like HIPAA, PCI-DSS, NIST 800-171, etc.

Expect your MSP to have a continually validated security program and the ability to articulate it clearly if you want to be confident your critical systems and data are in expert hands.

2. Do they perform regular security risk assessments?

Next, your Managed Services Provider must perform regular risk assessments to identify and mitigate emerging threats, ensure regulatory compliance, validate security controls, and prioritize security investments

An MSP implements various security controls and defenses to protect your IT systems and data. However, the effectiveness of these controls can degrade over time due to changes in technology, processes, or personnel. Routine risk assessments validate whether security measures are functioning as intended and highlight any control failures or gaps to be addressed.

To be effective, qualified security professionals using industry-recognized methodologies and frameworks, such as NIST 800-30, ISO 27005, or OCTAVE risk conduct assessments. The assessments must be designed to evaluate various risk factors, including vulnerabilities, threats, likelihood of occurrence, and potential impacts across the MSP’s infrastructure, processes, policies, and personnel


Half of our questions for Managed Services Providers fall into the process category. Your MSP must systematically adhere to best practices processes to ensure that what they secured for you remains secure over time. At a minimum, you should consider these four process questions when selecting of evaluating an MSP.

3. Are they audited by a third-party?

While an MSP may have robust internal security controls and processes, an objective third-party assessment provides an impartial validation that these measures are effective and align with industry best practices and regulatory standards.

As you’re entrusting your sensitive data and critical IT systems to an MSP, these audits are essential. Third-party audits and certifications, such as SOC 2, ISO 27001, or HITRUST, demonstrate the MSP adheres to rigorous security and compliance frameworks. Many industries have strict cybersecurity and data privacy regulations, mandated by frameworks such as HIPAA, PCI-DSS, NIST 800-171. However, third-party audits are invaluable even if rigorous, specific frameworks don’t apply to your industry.

To ensure the integrity and credibility of these audits, expect your MSP to engage reputable third-party assessment firms whose audits examine various aspects of the MSP’s operations, including:

  • Physical and environmental security
  • Network and infrastructure security
  • Access controls and authentication
  • Data protection and encryption
  • Incident response and business continuity
  • Risk management and vendor management
  • Policies, procedures, and employee training

By undergoing regular third-party audits and maintaining relevant certifications, the MSP demonstrates they prioritize security, adhere to compliance requirements, and continuously improve their defenses against evolving cyber threats.

4. Does your MSP follow proven Organizational Change Management (OCM) principles?

Organizational Change Management might be one of the last things that comes to mind when you think about IT and working with an MSP, but it’s possibly the most strategically crucial question on our list. Implementing and updating IT systems, processes, or technologies often involves significant changes that can disrupt business operations if the changes are not managed properly. Change management principles result in smooth transitions, proper testing and rollout plans, user training, and more. OCM also helps to ensure regulatory compliance, which reduces the potential for penalties and legal issues.

Finally, as IT initiatives often support broader organizational goals like increasing efficiency, enabling growth, or transforming business models, OCM helps to align IT efforts with overarching strategies by involving cross-functional stakeholders, assessing impacts, optimizing resources, and adapting solutions to meet evolving needs.

Effective Organizational Change Management for IT relies on key components such as:

  • Executive sponsorship and clear vision
  • Cross-functional governance and stakeholder involvement
  • Formalized policies, procedures, and approval processes
  • Employee communication, training, and resistance management
  • Continuous process improvement based on lessons learned

Proactively applying Organizational Change Management helps you and your MSP partner to realize the full benefits of IT initiatives while minimizing operational disruptions, reducing risks, and maintaining compliance.

5. Do they address all your compliance needs?

Different industries have different compliance needs, and organizations need to ensure their Managed Services Provider adequately addresses their industry-specific compliance issues.

As the trusted IT partner, the MSP is responsible for ensuring your IT infrastructure, data handling processes, and security controls adhere to regulatory frameworks and compliance mandates. Failure to address these needs can result in severe penalties, fines, and legal consequences for your company.

For businesses subject to strict compliance regulations around data privacy, security, and breach notification procedures (e.g., GDPR, HIPAA, and PCI-DSS), how MSPs handle their customers’ sensitive data is paramount for mitigating the risk of data breaches and the associated fallout. Requirements for business continuity and disaster recovery planning are also factors under these frameworks. For instance, HIPAA requires contingency plans for data backup, emergency operations, and recovery procedures.

To effectively address customers’ compliance needs, look for an MSP that takes a comprehensive approach, which  includes:

  • Understanding your industry and applicable compliance frameworks.
  • Conducting thorough risk assessments and gap analyses to identify compliance requirements.
  • Implementing appropriate security controls, policies, and procedures to meet these requirements.
  • Providing compliance training and awareness programs for your staff.
  • Maintaining detailed documentation and audit trails for compliance verification.
  • Continuously monitoring and updating their processes to align with evolving regulations.

Your MSP must proactively address all your compliance needs to not only mitigate legal and financial risks, but also to demonstrate their commitment to delivering secure, compliant, and trustworthy services. Expect your MSP to foster a partnership with you.

6. Does your Managed Services Provider offer 24/7/365 support?

Having 24/7/365 support is another factor that helps you ensure business continuity and uptime, incident response, and cybersecurity. Like all businesses these days, you rely heavily on your IT infrastructure and applications to function, service customers, and generate revenue. System downtime or disruption has consequences, including lost productivity, revenue losses, and even possible reputational damage. Your MSP must provide you with round-the-clock support so that your IT environment is continuously monitored, and issues are addressed promptly to minimize the impact.

Further, cyberthreats and security incidents occur 24 hours a day, not just your business hours. Plus, many businesses operate globally or have employees, customers, and stakeholders spanning many time zones. By providing around-the-clock support, Managed Services Providers can effectively cater to the IT needs of clients with dispersed operations or those who require assistance outside of traditional business hours.

Your MSP must provide 24/7/365 so you can be confident that any disruptions within your IT environment will be minimized, enabling virtually uninterrupted business operations.


Last but not least, our last two questions concern the people at your Managed Services Provider, their expertise and their ability to communicate. To ensure you’re working with people who can effectively offer you sound, ongoing protection, weigh your MSP against our final questions.

7. Can they explain things to you in a way you can understand – so you can make informed business decisions?

Expect your Managed Services Provider to explain things to you in a clear, jargon-free manner. Your MSP must effectively translate complex concepts into terms you understand to foster a transparent and collaborative partnership.

Plus, part of your MSP’s job is to present you with recommendations, strategies, and solutions. If these are conveyed using overly technical language or industry-specific jargon, it can hinder your ability to make the informed decisions that work best for your organization. When they use clear language, your MSP empowers you to fully comprehend the implications and benefits of proposed solutions when making business decisions.

Expect your MSP prioritize clear, jargon-free communication, to build a strong partnership with your organization. Look for an MSP you can rely on as a trusted advisor, one who prioritizes transparency and understanding in their service delivery.

8. Do you offer access to senior IT consultants or a vCIO for oversight and guidance?

Senior IT consultants and Virtual Chief Information Officers (vCIOs) bring extensive experience and expertise in the art of aligning technology strategies with business goals. They provide a high-level perspective and can guide you in making informed decisions about IT investments, prioritizing initiatives, and ensuring that technology enables and supports your organization’s overall objectives.

Experienced IT consultants and vCIOs are highly qualified to assist you in developing comprehensive technology roadmaps and plans. They assess your current IT environment, identify gaps or bottlenecks, and recommend ways to optimize processes, upgrade infrastructure, and/or implement new solutions to support future growth and scalability.

In addition to providing strategic guidance, senior IT consultants and vCIOs confer valuable staff augmentation and knowledge transfer opportunities. These experts can mentor and train your in-house IT team, share best practices, and help bridge knowledge gaps.

Finally, the expert guidance provided by senior consultants or a vCIO further supports your other IT needs, such as cybersecurity, risk management, and IT governance.

By offering access to this level of expertise, your Managed Services Provider provides the guidance necessary to navigate the complexities of IT strategy, cybersecurity, compliance, and governance. Access to these experts will elevate your ability to optimize your technology investments, mitigate risks, and ultimately achieve a competitive advantage through effective technology utilization.

A Starting Point

While our eight questions cover a lot of ground for assessing your Managed Service Provider against technology, process, and people criteria, these questions represent the very basics of what needs to be considered. They’re a great jumping off point for ensuring you’re working with an MSP that’s a good fit for your business but consider what additional factors could impact your success with your MSP. For example, you may want to consider only MSPs that have extensive experience in your industry, no matter how good they otherwise look on paper.

Finding the right Managed Services for your organization impacts many success outcomes. Don’t settle for a “good enough” MSP; invest in an MSP that will partner with you to protect your business and help you drive results.

About enkompas Technology Solutions

enkompas powers your entire technology environment, working closely with your team to provide strategic enterprise technology solutions. With nearly 30 years of experience as a trusted Managed IT Services Provider, our goal is to help you build a secure, scalable organizational roadmap for your IT environment. Contact us for more information on how enkompas Technology Solutions measures up against your organization’s MSP needs.