How to Evaluate Managed IT Service Providers: A UK Buying Guide

Choosing a provider is one of the few IT decisions that is hard to reverse cheaply. The contract runs for a year or three, the provider ends up holding your administrator credentials, and unpicking a bad choice costs a transition project. So it is worth more than a feature comparison and a price.

The problem is that most buyers evaluate managed IT service providers on the things providers choose to show them. A capability deck, a logo wall, a list of certifications, three references who were picked because they will say the right thing. All of it is true and none of it tells you whether the service desk will answer at 4pm on a Friday.

This guide sets out what to ask for instead, how to check the credentials rather than read them, and how to compare proposals that have been written to be incomparable. Transputec sits on the other side of this table most weeks, so it reflects what buyers actually get wrong when they evaluate managed IT service providers, rather than a template.

Start With What You Are Buying, Not Who You Are Buying From

A requirements document you wrote beats a comparison table a provider wrote. Before you evaluate managed IT service providers, or even shortlist them, write down six things.

• Users and sites. How many people, in how many locations, on what devices, and how many of those are field or home based.
• Hours. The hours you actually need cover, not the hours you work. If your finance team closes the month at 10pm, say so now.
• Systems in scope. List them, including the awkward line of business application nobody wants to own.
• What stays in house. Co-managed arrangements work well, and they fail when the boundary is vague. Name what your own team keeps.
• What good looks like. Pick three or four measures you would actually hold a provider to. Resolution time on a P2, first time fix rate, patch compliance, user satisfaction.
• Your current baseline on those measures. Without it you cannot tell afterwards whether anything improved.

On the fifth point, the measures that separate providers in practice are narrower than most scorecards suggest. Resolution time by priority rather than response time. First time fix rate. The proportion of tickets raised by users against those caught by monitoring, which tells you whether the service is proactive or reactive. Patch compliance as a percentage of the estate inside a defined window. User satisfaction collected per ticket rather than per year. Pick four, define them precisely, and hold every provider to the same four.

That last point is the one people skip, and it is the one that makes the whole exercise measurable. If you cannot get the numbers out of your current provider, the ICO guidance on what needs to be included in the contract is worth reading first: a processor has to give you the information needed to show its obligations have been met, and has to allow for and contribute to audits.

What the Certifications Actually Prove, and How to Check Them

Credentials are the most quoted and least examined part of any proposal. Two of them are worth understanding properly, because the difference between them is the difference between a claim and a test.

Cyber Essentials and Cyber Essentials Plus are not the same thing

The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the Government for organisations of all sizes. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The scheme was developed by the NCSC and is delivered by IASME.

Both levels assess those same five controls. Standard Cyber Essentials uses a combination of self-assessment and independent audit. Cyber Essentials Plus adds more rigorous independent technical testing, to check the controls work in practice rather than on paper. If a provider is going to hold administrative access to your estate, the Plus level is the one that means something, and it is reasonable to ask which one they hold and when it was last assessed.

An ISO 27001 certificate is only as good as its scope

Ask for the certificate itself, then read the scope statement on it. A certificate can be entirely valid and still exclude the service you are about to buy, because scope is defined by site, service and system. A provider certified for its head office information management has not told you anything about the data centre your servers would sit in.

Then verify it rather than trusting the PDF. UKAS sets out three steps: check the accreditation came from an internationally recognised accreditation body, a signatory to the EA or IAF multilateral agreements; check that the certification body genuinely holds valid accreditation covering the relevant standard; and check that the certification body actually issued the certificate. UKAS also runs CertCheck, a free online database of accredited management systems certification, which it describes as a quick and simple way to verify the current accreditation status of certification claimed by prospective suppliers.

It takes about five minutes and almost nobody does it. For the record, Transputec’s certifications page lists ISO 9001, ISO/IEC 27001, ISO 14001 and a Cyber Essentials Plus Certificate of Assurance, alongside G-Cloud 15, TePAS 2 under RM6098 and JOSCAR registration. Check ours the same way you check anyone else’s.

How to Evaluate Managed IT Service Providers on Service Rather Than Promises

Service level agreements are written by the people who will be measured against them, which is why they tend to measure the easy thing. Four questions get past that.

• Is that a response time or a resolution time? A fifteen minute response target is trivially met by an automated acknowledgement. Resolution targets by priority are the ones that cost a provider money, so they are the ones that reveal confidence.
• How is a priority assigned, and by whom? If the provider grades its own tickets, it controls its own scorecard. Ask how a P1 is defined and who can overrule the grading.
• What exactly do business hours mean? Get the hours, the out of hours arrangement, the public holiday position, and whether out of hours is a staffed desk or an on call rota.
• What happens when the target is missed? Service credits are a weak remedy, but the absence of any remedy tells you the targets are decorative.

Then ask for evidence. Request the last three months of performance reporting for a client of comparable size and shape, redacted. A provider that measures itself properly will have it to hand. One that does not will offer a case study instead, and that answer is itself the finding.

Look for experience level agreements alongside service levels too. Transputec contracts on experience level agreements because a ticket closed inside target that left the user unable to work is a pass on the SLA and a failure in the business. If you only evaluate managed IT service providers on SLA attainment, that is the gap you will not see until you are six months in.

The Questions to Ask Before You Sign

Most of the risk in a managed services contract sits in clauses nobody reads until there is a problem. These are the ones worth a direct answer in writing.

• Who will hold administrative credentials for our systems, and will we retain our own global administrator account?
• Is multi factor authentication enforced on your own administrative accounts that reach our estate?
• Who are the named people on our account, and what happens when they leave?
• Which parts of the service are subcontracted, and to whom?
• Where will our data be stored and processed, and by which sub-processors?
• What are our audit rights, and will you contribute to an audit if we ask?
• What is defined as out of scope, and what is the rate card for it?
• How and when can the price change during the term?
• What is the notice period, and does the contract auto renew?
• What do you owe us at the end of the contract: documentation, configuration exports, a handover period?

The last two matter more than their position in a proposal suggests. Exit terms are far easier to negotiate before you sign than when you are leaving, and our guide to how to switch MSP providers sets out what a handover should actually produce. Read it while you still have a choice of providers rather than when you need one.

Take the Reference Call Properly

The reference call is the most underused tool available when you evaluate managed IT service providers, mostly because buyers treat it as a formality. Three changes make it worth the half hour.

• Ask for a client that looks like you. Same size, same sector, same regulatory position, and ideally the same awkward application. A glowing reference from an organisation a tenth of your size tells you nothing about whether the provider can carry your estate.
• Ask what went wrong. Not whether anything went wrong, which invites a no. Ask what the worst incident was in the last year, how the provider handled it, and what changed afterwards. Every real relationship has one.
• Ask the service desk users, not only the sponsor. The person who signed the contract and the person who raises tickets will give you different answers, and the second answer is the one you will live with.

Two more checks cost almost nothing. Ask how long the provider has held its current client base, because churn is the clearest signal there is. And ask about the transition in: how long it took, what the previous provider failed to hand over, and what nobody had documented. A provider that answers that question in detail has done it often.

How to Compare Proposals That Are Not Comparable

Three providers will quote three different shapes, and the cheapest headline is rarely the cheapest contract. Normalise first, or you will evaluate managed IT service providers on how well they format a spreadsheet. Transputec quotes against a client requirements list for exactly this reason.

• Put everything on the same unit. Per user per month, for the same user count, over the same term.
• Add transition and onboarding separately. Some providers bury it, some waive it, some charge it honestly. You want it visible either way.
• Price the out of scope list. Take three things you did last year that each proposal marks out of scope, and ask what they would have cost. That number is often the real difference between two quotes.
• Separate licences and hardware from service. Resale margin is legitimate, but it should not be hiding inside a service fee you cannot benchmark.
• Score against your own requirements list, weighted. The one you wrote at the start, before anybody presented to you.

A weighted score with price as one line among several is harder to argue with internally than a gut feel, and it protects you from the proposal that is excellent at the things you did not ask for.

Five Mistakes That Cost the Most

These five come up again and again when businesses evaluate managed IT service providers in a hurry, and all of them are avoidable in an afternoon.

• Buying on the headline price. The gap between quotes usually closes once the out of scope rate card is priced in.
• Taking a certificate at face value. A valid ISO 27001 certificate whose scope excludes your service is worth nothing to you, and five minutes on CertCheck would have shown it.
• Not taking a reference in your own sector. Ask for a client with your regulatory position and your systems, and ask them what went wrong rather than what went well.
• Leaving exit terms until last. By the time you need them you have nothing left to trade.
• Choosing without the people who will use the service desk. The buyer evaluates the proposal. The team lives with the queue. Put two of them in the room.

How Transputec Answers These Questions

We have been running managed services for more than thirty years, and we would rather be checked than believed.

Our Managed IT Services and Managed IT Service Desk cover service desk, infrastructure and cloud, with 24/7 cover where the business needs it, and co-managed arrangements where your own team keeps part of the estate.

On the measures above: we publish our customer satisfaction data monthly rather than quoting a number from a good year, and our Net Promoter Score has consistently sat in the world class band above 70 against a typical cross industry average of around 31. On credentials, the list is on the certifications page and every item on it can be verified independently. On exit, we write handover obligations into the contract because we spend a lot of our time inheriting estates where nobody did.

If you are putting a shortlist together and want a straight answer to the ten questions above, talk to our team about the service design work behind our Managed IT Services. The useful conversation at this stage is about scope and evidence, not price.

FAQs