To evaluate managed IT service providers properly, write your own requirements list first and score every proposal against it. Four things decide the outcome: measures you define yourself rather than the ones each provider volunteers, credentials you verify independently rather than read, a reference call taken with the people who raise tickets rather than the person who signed, and exit terms agreed before you sign rather than when you are leaving.
Most of that is an afternoon of work. The part buyers skip is recording their own current performance on three or four measures, and without that baseline you cannot tell afterwards whether the change was worth making.
Choosing a provider is one of the few IT decisions that is hard to reverse cheaply. The contract runs for a year or three, the provider ends up holding your administrator credentials, and unpicking a bad choice costs a transition project. So it is worth more than a feature comparison and a price.
The problem is that most buyers evaluate managed IT service providers on the things providers choose to show them. A capability deck, a logo wall, a list of certifications, three references who were picked because they will say the right thing. All of it is true and none of it tells you whether the service desk will answer at 4pm on a Friday.
This guide sets out what to ask for instead, how to check the credentials rather than read them, and how to compare proposals that have been written to be incomparable. Transputec sits on the other side of this table most weeks, so it reflects what buyers actually get wrong when they evaluate managed IT service providers, rather than a template.
Start With What You Are Buying, Not Who You Are Buying From
A requirements document you wrote beats a comparison table a provider wrote. Before you evaluate managed IT service providers, or even shortlist them, write down six things.
- Users and sites. How many people, in how many locations, on what devices, and how many of those are field or home based.
- Hours. The hours you actually need cover, not the hours you work. If your finance team closes the month at 10pm, say so now.
- Systems in scope. List them, including the awkward line of business application nobody wants to own.
- What stays in house. Co-managed arrangements work well, and they fail when the boundary is vague. Name what your own team keeps.
- What good looks like. Pick three or four measures you would actually hold a provider to. Resolution time on a P2, first time fix rate, patch compliance, user satisfaction.
- Your current baseline on those measures. Without it you cannot tell afterwards whether anything improved.
On the fifth point, the measures that separate providers in practice are narrower than most scorecards suggest. Resolution time by priority rather than response time. First time fix rate. The proportion of tickets raised by users against those caught by monitoring, which tells you whether the service is proactive or reactive. Patch compliance as a percentage of the estate inside a defined window. User satisfaction collected per ticket rather than per year. Pick four, define them precisely, and hold every provider to the same four.
The baseline is the one people skip, and it is the one that makes the whole exercise measurable. If you cannot get the numbers out of your current provider, the ICO guidance on what needs to be included in the contract is worth reading first: a processor has to give you the information needed to show its obligations have been met, and has to allow for and contribute to audits.
What the Certifications Actually Prove, and How to Check Them
Credentials are the most quoted and least examined part of any proposal. Two of them are worth understanding properly, because the difference between them is the difference between a claim and a test.
Cyber Essentials and Cyber Essentials Plus are not the same thing
The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the Government for organisations of all sizes. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The scheme was developed by the NCSC and is delivered by IASME.
Both levels assess those same five controls. Standard Cyber Essentials uses a combination of self-assessment and independent audit. Cyber Essentials Plus adds more rigorous independent technical testing, to check the controls work in practice rather than on paper. If a provider is going to hold administrative access to your estate, the Plus level is the one that means something, and it is reasonable to ask which one they hold and when it was last assessed.
An ISO 27001 certificate is only as good as its scope
Ask for the certificate itself, then read the scope statement on it. A certificate can be entirely valid and still exclude the service you are about to buy, because scope is defined by site, service and system. A provider certified for its head office information management has not told you anything about the data centre your servers would sit in.
Then verify it rather than trusting the PDF. UKAS sets out three steps: check the accreditation came from an internationally recognised accreditation body, a signatory to the EA or IAF multilateral agreements; check that the certification body genuinely holds valid accreditation covering the relevant standard; and check that the certification body actually issued the certificate. UKAS also runs CertCheck, a free online database of accredited management systems certification, which it describes as a quick and simple way to verify the current accreditation status of certification claimed by prospective suppliers.
It takes about five minutes and almost nobody does it. For the record, the Transputec certifications page lists ISO 9001, ISO/IEC 27001, ISO 14001 and a Cyber Essentials Plus Certificate of Assurance, alongside G-Cloud 15, TePAS 2 under RM6098 and JOSCAR registration. Check ours the same way you check anyone else’s.
Building a shortlist?
Talk to the Transputec team about Managed IT Services. Scope, evidence and exit terms, before price.
Get in TouchHow to Evaluate Managed IT Service Providers on Service Rather Than Promises
Service level agreements are written by the people who will be measured against them, which is why they tend to measure the easy thing. Four questions get past that.
- Is that a response time or a resolution time? A fifteen minute response target is trivially met by an automated acknowledgement. Resolution targets by priority are the ones that cost a provider money, so they are the ones that reveal confidence.
- How is a priority assigned, and by whom? If the provider grades its own tickets, it controls its own scorecard. Ask how a P1 is defined and who can overrule the grading.
- What exactly do business hours mean? Get the hours, the out of hours arrangement, the public holiday position, and whether out of hours is a staffed desk or an on call rota.
- What happens when the target is missed? Service credits are a weak remedy, but the absence of any remedy tells you the targets are decorative.
Then ask for evidence. Request the last three months of performance reporting for a client of comparable size and shape, redacted. A provider that measures itself properly will have it to hand. One that does not will offer a case study instead, and that answer is itself the finding.
Look for experience level agreements alongside service levels too. Transputec contracts on experience level agreements because a ticket closed inside target that left the user unable to work is a pass on the SLA and a failure in the business. If you only evaluate managed IT service providers on SLA attainment, that is the gap you will not see until you are six months in.
The Questions to Ask Before You Sign
Most of the risk in a managed services contract sits in clauses nobody reads until there is a problem. These are the ones worth a direct answer in writing.
- Who will hold administrative credentials for our systems, and will we retain our own global administrator account?
- Is multi factor authentication enforced on your own administrative accounts that reach our estate?
- Who are the named people on our account, and what happens when they leave?
- Which parts of the service are subcontracted, and to whom?
- Where will our data be stored and processed, and by which sub-processors?
- What are our audit rights, and will you contribute to an audit if we ask?
- What is defined as out of scope, and what is the rate card for it?
- How and when can the price change during the term?
- What is the notice period, and does the contract auto renew?
- What do you owe us at the end of the contract: documentation, configuration exports, a handover period?
The last two matter more than their position in a proposal suggests. Exit terms are far easier to negotiate before you sign than when you are leaving, and our guide to how to switch MSP providers sets out what a handover should actually produce. Read it while you still have a choice of providers rather than when you need one.
Take the Reference Call Properly
The reference call is the most underused tool a buyer has, mostly because it gets treated as a formality. Three changes make it worth the half hour.
- Ask for a client that looks like you. Same size, same sector, same regulatory position, and ideally the same awkward application. A glowing reference from an organisation a tenth of your size tells you nothing about whether the provider can carry your estate.
- Ask what went wrong. Not whether anything went wrong, which invites a no. Ask what the worst incident was in the last year, how the provider handled it, and what changed afterwards. Every real relationship has one.
- Ask the service desk users, not only the sponsor. The person who signed the contract and the person who raises tickets will give you different answers, and the second answer is the one you will live with.
Two more checks cost almost nothing. Ask how long the provider has held its current client base, because churn is the clearest signal there is. And ask about the transition in: how long it took, what the previous provider failed to hand over, and what nobody had documented. A provider that answers that question in detail has done it often. Buyers who evaluate managed IT service providers without making this call are relying entirely on material the provider wrote.
How to Compare Proposals That Are Not Comparable
Three providers will quote three different shapes, and the cheapest headline is rarely the cheapest contract. Normalise first, or you will be comparing how well each provider formats a spreadsheet. Transputec quotes against a client requirements list for exactly this reason.
- Put everything on the same unit. Per user per month, for the same user count, over the same term.
- Add transition and onboarding separately. Some providers bury it, some waive it, some charge it honestly. You want it visible either way.
- Price the out of scope list. Take three things you did last year that each proposal marks out of scope, and ask what they would have cost. That number is often the real difference between two quotes.
- Separate licences and hardware from service. Resale margin is legitimate, but it should not be hiding inside a service fee you cannot benchmark.
- Score against your own requirements list, weighted. The one you wrote at the start, before anybody presented to you.
A weighted score with price as one line among several is harder to argue with internally than a gut feel, and it protects you from the proposal that is excellent at the things you did not ask for.
What a Weighted Scorecard Looks Like
Weighting is what stops a scorecard flattering the provider who presented best. The point of it is that you evaluate managed IT service providers on the things you decided mattered, in the order you decided they mattered, before anybody walked into the room.
The weights below are a starting point for a mid sized organisation buying a full service, not a standard. Change them to match the requirements list you wrote, then score each provider out of five on every line and multiply. What matters is that the weights are fixed before the proposals arrive.
| Service levels (20%) | Resolution targets by priority rather than response, with a defined remedy when one is missed |
| Measured performance (20%) | Three months of redacted reporting for a client of comparable size, offered without being chased |
| Credentials in scope (15%) | An ISO 27001 certificate whose scope statement covers the service you are buying, verified on CertCheck |
| Reference in your sector (15%) | A client of your size and regulatory position, asked what went wrong rather than what went well |
| Exit and handover (15%) | Documentation, configuration exports and a handover period written into the contract rather than promised |
| Total cost in scope (15%) | Per user per month on the same term, plus transition, plus a priced out of scope list |
Two lines in that table usually decide it, and neither is price. A provider that hands over three months of real reporting without being chased has told you how it will behave in month seven. A provider that negotiates exit terms openly at the start has told you the same thing.
Five Mistakes That Cost the Most
These five come up again and again when businesses evaluate managed IT service providers in a hurry, and all of them are avoidable in an afternoon.
- Buying on the headline price. The gap between quotes usually closes once the out of scope rate card is priced in.
- Taking a certificate at face value. A valid ISO 27001 certificate whose scope excludes your service is worth nothing to you, and five minutes on CertCheck would have shown it.
- Not taking a reference in your own sector. Ask for a client with your regulatory position and your systems, and ask them what went wrong rather than what went well.
- Leaving exit terms until last. By the time you need them you have nothing left to trade.
- Choosing without the people who will use the service desk. The buyer evaluates the proposal. The team lives with the queue. Put two of them in the room.
How Transputec Answers These Questions
Transputec has been delivering IT services in the UK for over forty years, and we would rather be checked than believed.
Our Managed IT Services and Managed IT Service Desk cover service desk, infrastructure, network and endpoint operations, with 24/7 cover where the business needs it.
On the measures above, Transputec publishes its customer satisfaction data live and refreshes it every month rather than quoting a number from a good year. Our Net Promoter Score consistently sits in the world class band above 70, against a typical cross industry average of around 31. On credentials, the full list sits on the certifications page and every item on it can be verified independently, using the same UKAS checks set out above. On exit, our guide to switching MSP providers sets out what a handover should actually produce, because a lot of our time goes on inheriting estates where nobody documented one.
If you are putting a shortlist together and want a straight answer to the ten questions above, talk to our team about the service design work behind Transputec Managed IT Services. The useful conversation at this stage is about scope and evidence, not price.
FAQs
How do you evaluate managed IT service providers objectively?
The short answer is to evaluate managed IT service providers against a requirements list you wrote yourself, scored and weighted, with price as one line rather than the headline. Capture your current performance on three or four measures first, because without a baseline you cannot tell afterwards whether the change worked. Ask each provider for three months of redacted performance reporting for a client of comparable size, and treat a case study offered in place of real numbers as a finding in itself.
What certifications should a managed IT service provider have?
For a UK provider holding administrative access to your estate, Cyber Essentials Plus and an accredited ISO/IEC 27001 certificate are the two that matter most, and ISO 9001 tells you something about process discipline. The NCSC describes Cyber Essentials as the Government’s recommended minimum standard, covering firewalls, secure configuration, security update management, user access control and malware protection. The Plus level assesses the same five controls but adds independent technical testing, so it is the level that has been checked in practice rather than declared.
How do I check an ISO 27001 certificate is genuine?
Ask for the certificate, read its scope statement, and confirm the scope covers the service you are buying rather than just the provider’s head office. UKAS sets out three checks: that the accreditation came from an internationally recognised accreditation body that signs the EA or IAF multilateral agreements, that the certification body holds valid accreditation covering the standard, and that the certification body actually issued the certificate. UKAS CertCheck is a free online database that lets you verify a prospective supplier’s current accreditation status in a couple of minutes. The Transputec certifications page lists every certificate so it can be checked the same way.
What questions should I ask before signing a managed IT contract?
Ask who will hold administrative credentials and whether you keep your own global administrator account, whether multi factor authentication is enforced on their admin accounts that reach your systems, which parts of the service are subcontracted, where your data is processed, what your audit rights are, what is out of scope and at what rate, how the price can change during the term, what the notice period is and whether it auto renews, and what the provider owes you at the end of the contract. Exit terms are far easier to agree before you sign than when you are leaving.
How long should it take to choose a provider?
Six to ten weeks is normal for a mid sized organisation: a week or two to write requirements and capture a baseline, three or four weeks for proposals and clarification, and two or three weeks for references, certificate verification and contract review. Rushing it tends to move the cost rather than remove it, because the time saved in selection reappears as scope disputes in the first quarter of the contract.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
