How to Choose a Managed IT Provider
A straightforward framework for evaluating MSPs — what to look for, what to avoid, and the questions that separate providers who can deliver from those who can’t.
Managed IT vs. Break-Fix: The Fundamental Question
Before evaluating specific providers, make sure you’re clear on what you’re buying. These are two fundamentally different models:
Break-Fix
- Something breaks, you call, you pay by the hour
- No proactive monitoring or maintenance
- Provider profits when things go wrong
- Unpredictable costs
Managed IT
- Proactive monitoring prevents problems before they happen
- Fixed monthly cost with defined SLAs
- Provider profits when things go right
- Strategic planning and budgeting included
If you’re still on break-fix, the question isn’t which MSP to choose — it’s whether you can afford to keep operating without proactive management. For professional services firms handling sensitive client data, the answer is almost always no.
What to Look For in an MSP
Not all managed IT providers are the same. Here are the criteria that matter most — in order of importance.
Industry Specialization
An MSP that serves law firms, dental offices, and retail chains is spreading its expertise too thin. Look for a provider that focuses on your industry and can demonstrate familiarity with your regulatory environment, your software stack, and the operational patterns that affect IT decisions.
Ask: “What percentage of your clients are in our industry? Can you provide references from firms our size?”
Defined SLAs with Teeth
A Service Level Agreement should specify response times, resolution targets, and what happens when the provider misses them. If the SLA is vague (“we respond promptly”) or has no consequences for failure, it’s marketing, not a commitment.
Ask: “What is your guaranteed response time for a critical issue? What happens if you miss it?”
Security Is Standard, Not an Add-On
If endpoint detection, MFA, email encryption, and security awareness training are “premium” tiers, the provider is treating security as a profit center. These are baseline requirements for any firm handling confidential data — they should be included in every engagement.
Ask: “What security controls are included in your standard offering? What costs extra?”
Strategic Advisory (vCIO) Included
Managed IT without strategic oversight is just outsourced help desk. Your provider should include a virtual CIO who handles budgeting, planning, compliance, and vendor management. If this is a separate line item, it often gets skipped — and the firm ends up making reactive decisions.
Ask: “Do you provide a dedicated strategic advisor? How often do they meet with our leadership?”
Transparent, Predictable Pricing
Per-user pricing is the industry standard. You should know exactly what you’re paying and exactly what’s included. If the pricing model is complex, has tiers you don’t understand, or includes “block hours” that run out, keep looking.
Ask: “Is your pricing per-user or per-device? What is not included in the monthly fee?”
Proof of Their Own Security Posture
Your MSP will have privileged access to your entire environment. If they can’t demonstrate their own security practices — SOC 2 compliance, cyber liability insurance, documented incident response procedures — they are a risk, not a solution.
Ask: “Do you have SOC 2 certification or a current audit report? Do you carry cyber liability insurance?”
Red Flags to Watch For
No written SLA
If they won't commit to response times in writing, they don't intend to meet them.
Security is a paid add-on
EDR, MFA, and email security are essentials, not upsells.
They serve every industry
A generalist MSP won't understand your compliance obligations or your software.
Block hour pricing
You buy 40 hours, use them, then pay overage. This is break-fix with a subscription wrapper.
No vCIO or strategic planning
If nobody is planning your IT future, you're just treading water.
Can't provide references in your industry
If they don't have clients like you, they haven't solved problems like yours.
Long-term contracts with auto-renewal traps
Month-to-month or annual with clear exit terms is reasonable. 3-year lock-ins are not.
They can't explain their security stack
If they can't tell you exactly what's protecting your endpoints, email, and backups, walk away.
What Managed IT Costs
Pricing varies by scope, geography, and industry. Here’s what professional services firms should expect:
| Service Level | Per User / Month | Typically Includes |
|---|---|---|
| Basic / Break-Fix Hybrid | $50–$100 | Monitoring, patching, limited support hours. Security often extra. |
| Standard Managed IT | $125–$200 | Full monitoring, unlimited support, basic security, some strategic planning. |
| Comprehensive (DP3 model) | $200–$300+ | Everything above + EDR, email security, vCIO advisory, compliance support, vendor management. |
The cheapest option is almost never the best value. A firm paying $100/user for basic monitoring will spend more on security incidents, emergency projects, and reactive fixes than a firm paying $250/user for comprehensive managed services. For a deeper analysis, see our article on the true cost of building an in-house IT team.
Switching MSPs: What to Expect
If you’re already with an MSP and considering a change, here’s the typical transition timeline:
Week 1: Discovery & Documentation
Full environment audit — inventory, credentials, configurations, vendor contacts, existing issues.
Week 2: Agent Deployment & Security Baseline
Monitoring agents, endpoint security, and backup verification deployed across all devices.
Week 3: Cutover & Old Provider Offboarding
Remove previous provider’s agents, transfer DNS and vendor accounts, verify all services operational.
Week 4: Stabilization & User Communication
New support procedures communicated to staff, initial issues resolved, first QBR scheduled.
Frequently Asked Questions
How much do managed IT services cost?
For professional services firms, expect $125–$300+ per user per month depending on scope and security requirements. Beware of providers quoting under $100/user — that usually means reactive break-fix with limited security, not true managed services.
Should my MSP specialize in my industry?
For law firms and professional services — yes. Industry-specialized MSPs understand your compliance requirements, your software ecosystem, and the operational rhythms that affect IT. A generalist MSP will keep your email running but won’t understand why a DMS outage during trial prep is a crisis.
How long does it take to switch MSPs?
A typical transition takes 2–4 weeks. A good MSP handles the entire process — discovery, deployment, cutover, and offboarding of the previous provider — with minimal disruption to your team.
What’s the difference between managed IT and co-managed IT?
Co-managed IT means you have internal IT staff and an external MSP. The MSP typically handles monitoring, security, and strategic planning while internal staff handle day-to-day operations and user-facing support. It works well when roles are clearly defined.
Evaluating Providers? Let’s Talk.
We’ll give you a straight answer on whether DP3 is the right fit for your firm. If we’re not, we’ll tell you that too.