If you're a founder, dev lead, or the person who ends up owning "IT stuff" at a small company, you've probably weighed outsourcing infrastructure and support to a managed service provider (MSP). Most evaluations stop at price and scope. The questions below are the ones that actually predict whether the relationship holds up once something breaks in production — or at 2am on a Saturday.
- What's the actual SLA—not the marketing version?
"Fast response" isn't a number. Get response and resolution times broken down by severity, and confirm they apply outside business hours. If there's no distinction between a P1 outage and a stuck printer, that's a red flag.
- Do they understand your compliance surface?
If you're touching HIPAA, PCI-DSS, SOC 2, or similar, ask for concrete examples of clients they support under the same requirements — not a checkbox "yes, we do compliance".
- Dedicated engineer, or ticket queue roulette?
Some MSPs route every ticket through a shared queue with no continuity. Others assign someone who actually knows your stack. For anything beyond commodity helpdesk work, this matters more than price.
- What's excluded from the contract?
Ask explicitly about:
Employee onboarding/offboarding automation
Hardware procurement
After-hours emergency escalations
Security incident response
Undocumented scope is billed scope, later, as a surprise.
- Walk me through your actual incident response process.
Not "if" — when. Ask for the real sequence: detection, containment, notification, and recovery. A team that can't answer this in specifics probably hasn't run the drill.
- What's the offboarding story if we migrate providers?
Get clarity in writing on data portability and credential handoff before you need it — this is the equivalent of checking you can actually export your data before you commit to a SaaS vendor.
- Can you connect me with a current client running a similar stack/size?
References beat marketing copy every time.
- What does proactive communication actually look like?
Good MSPs surface findings before you ask — patch cadence reports, vulnerability scans, and capacity trends. If all communication is reactive (i.e., only when something's on fire), you're paying for a helpdesk, not a partner.
Final Thoughts
Outsourcing IT/infra support is an architecture decision as much as a business one — it affects uptime, security posture, and how much on-call burden your team actually carries. These eight questions are a reasonable filter before signing anything.
Disclosure: I work with ZIA Networks, an MSP based in New Mexico — happy to answer questions on any of the above in the comments.
