A managed IT services checklist is the short list of things you confirm in a provider’s scope and contract before you sign. The 10 that matter most are a written scope, SLA response and resolution times, watched security, restore-tested backups, SOC 2 or ISO 27001 proof, a named strategist, callable references, disclosed onboarding costs, an exit clause, and documentation you own. Verify those and you are comparing managed IT services honestly instead of guessing.
TL;DR. Most managed IT proposals look alike on the cover page and diverge wildly underneath. This checklist gives you 10 things to verify, a set of questions to ask, and the red flags that should end a conversation. Run any provider through it before you sign, and the cheap quote with a thin scope stops looking cheap. Get every answer in writing.
Two proposals land on your desk. One is 110 dollars a user, the other is 89. The cover pages promise the same thing, more or less, so the cheaper one wins. Six months later you are paying for after-hours support that was never in scope, waiting three hours on a ticket, and discovering the backups have never once been restored. That gap did not show up in the price. It showed up in the fine print nobody read. This is the checklist that reads it for you.
What is a managed IT services checklist?
A managed IT services checklist is a short, repeatable set of criteria you use to evaluate and compare providers before signing a contract. It covers the scope, the service guarantees, the security, the contract terms, and the exit. The point is to score every provider on the same items so the differences that a polished sales deck hides become obvious. If you want the checklist applied to two real providers, read our Uprite vs Dataprise comparison.
Here is the thing about buying IT support. You are not really buying a list of tools. You are buying a promise about the worst day your business will have this year, and whether someone competent picks up when it happens. A checklist forces that promise into the open. If you want the companion piece that breaks down what actually sits inside the monthly fee, read what is included in managed IT services. This guide is about how to judge the provider offering it.
The managed IT services checklist, point by point
Ten items separate a real managed IT partner from a help desk with a nice logo. The table is the fast scan. The sections under it explain the ones people get wrong, and each has a green flag to look for and a red flag to walk from.
| What to verify | Green flag | Red flag |
|---|---|---|
| Written scope | Line-item scope plus an explicit out-of-scope list | “Everything is covered,” nothing in writing |
| SLA response and resolution | Time targets by priority for both | The word “fast,” no numbers |
| Watched security | A team monitors the EDR 24/7 | Antivirus installed and forgotten |
| Restore-tested backups | A restore test in the last 90 days | “We back everything up,” never tested |
| Security certification | Current SOC 2 or ISO 27001 | No third-party audit at all |
| Named strategist | An assigned vCIO and a planning cadence | Reactive support only |
| References | Clients in your industry you can call | Vague testimonials, no names |
| Onboarding and hidden costs | Onboarding fee and add-ons disclosed up front | “Onboarding TBD” in the contract |
| Exit clause | A termination for convenience clause and offboarding steps | Auto-renew, no way out |
| Documentation ownership | You own credentials and network docs | Docs live only in their system |
1. A written scope with a real out-of-scope list
Start here, because everything else hangs off it. A serious provider hands you a scope that lists what they cover, which devices, which users, which hours, and then lists what they do not. That second list is the honest one. TechTarget defines a managed service provider as a third party that runs your systems against a defined agreement, and the word “defined” is doing a lot of work. If the scope is a paragraph of marketing and the salesperson keeps saying everything is included, you have found the problem before you signed it.
2. Response and resolution times, in actual numbers
This is where most proposals quietly commit to nothing. Response time is how fast they acknowledge your ticket. Resolution time is how fast they fix it. A contract that promises a 15-minute response and says nothing about resolution has promised to say hello quickly and then leave. Louisville Geek’s SLA guide lists the common industry targets, roughly 15 to 30 minutes for a critical issue, 1 to 2 hours for high priority, and longer for the rest. Look for both numbers, broken out by priority level, plus a service credit if they miss. “Fast” is not a commitment. A number is.
3. Security someone actually watches
Almost every provider will tell you security is included. The question that matters is whether a human is watching it. CrowdStrike explains the difference between EDR, the detection tool sitting on each device, and MDR, that same tool with a security team watching it around the clock. A dashboard nobody looks at is not protection, it is a receipt. Ask them point blank who reviews the alerts, when, and what happens at 2 a.m. on a Saturday. This connects to the broader cybersecurity solutions that should wrap the whole environment, not just the laptops.
4. Backups that have actually been restored
Everyone backs your data up. Far fewer have ever tested a restore, and an untested backup is a guess wearing a safety vest. Two numbers define this in a real contract. Your recovery time objective is how fast you must be running again. Your recovery point objective is how much data you can lose, measured in time. TechTarget walks through RTO and RPO with examples worth reading. The single best question you can ask is when they last ran a live recovery test on an account like yours. If they hesitate, you have your answer.
5. Independent proof they secure their own house
You are about to hand a provider the keys to every system you run. It is fair to ask what independent auditor has checked their security, not just yours. ScalePad explains why SOC 2 and ISO 27001 have become table stakes for MSPs, since insurers and regulators now expect a recognized, auditable framework behind the vendor. A provider with a current SOC 2 report has paid an outside firm to poke holes in their controls. One with nothing is asking you to take security on faith, right at the moment they want admin rights to your network.
6. A named strategist, not just a ticket queue
Good IT is not only fixing what breaks. It is someone who knows your business well enough to tell you the aging server should be replaced this quarter, before it fails on a Friday. That role is usually called a virtual CIO, and a plan without one is maintenance dressed up as partnership. Ask whether a specific person owns your account and how often you sit down to plan. If the answer is a shared inbox and a promise to be responsive, you are buying reaction time, not direction.
7. References in your industry you can actually call
Testimonials on a website are marketing. A phone number for a business like yours is evidence. A provider who supports firms in your industry already understands your compliance rules, your busy season, and the software your team lives in. Ask for two or three references you can reach, ideally in the same field, and then actually call them. Ask what breaks, how the provider handles a bad month, and whether they would sign again. The ones who hedge on giving you references are telling you something.
8. Onboarding and hidden costs, disclosed up front
A one-time onboarding fee is normal. It pays for the provider to audit your environment, install their agents, and document how everything is wired. ITsasap breaks down typical onboarding costs, which usually run a few hundred to a few thousand dollars depending on size. What is not normal is finding that fee for the first time after you sign, or discovering that on-site visits, after-hours calls, and new-user setup all bill separately. Ask for onboarding and every common add-on in writing before you commit. Vague “onboarding TBD” language in a contract is not a placeholder, it is a blank check.
9. Contract flexibility and a real exit clause
The length of the term is not the red flag. The absence of an exit is. A confident provider will give you a termination for convenience clause and a defined offboarding process, because they plan to keep you with good work, not a locked door. Push for a first term that converts to month-to-month after year one and a notice period you can live with. The moment you have the most leverage to negotiate all of this is before you sign, never after.
10. Documentation and credentials you own
This is the one almost nobody checks, and it is the one that turns a breakup ugly. Some providers build your network diagrams, passwords, and runbooks inside their own tools and will not hand them over when you leave. CyberSheath’s offboarding checklist is blunt about it, your organization, not the outgoing provider, should own and control every credential and admin account. Get a written line in the contract confirming your documentation and administrative access are your property, with a defined handover if the relationship ends. Ask this while they are still trying to win you, because you will never have more leverage than right now.
Questions to ask before you sign
Print these and take them into the meeting. The answers, and how comfortable the provider is giving them, tell you most of what you need to know.
- Who picks up when I call? A trained technician on first contact, or a dispatcher who takes a message.
- What are your response and resolution targets by priority? Both numbers, in writing, with a credit if you miss.
- When did you last test a restore for a client like me? A recent, specific answer, not a shrug.
- Who is my named strategist and how often do we plan? A person and a cadence, not a shared inbox.
- What is explicitly out of scope? Projects, hardware markups, licensing, and after-hours rates, spelled out.
- How do I leave, and what do I take with me? A clear exit clause and documentation you own.
If you want the flip side of these questions, the exact line items that should sit inside the fee they quote you, our breakdown of what is included in managed IT services pairs directly with this checklist.
Red flags that should end the conversation
Some signals are bad enough on their own to walk away, even if everything else looks great. If you see these, keep shopping.
- No numbers in the SLA. Time commitments replaced with adjectives like fast and responsive.
- Security treated as an upsell. If they never raise it first, they see it as an add-on, not a foundation.
- Surprises already on the sample invoice. Charges you were told were included, appearing anyway during the trial.
- One hero technician. Every hard problem routes to a single person, which means one resignation is your outage.
- They will not put the scope in writing. The clearest tell of all. Treat it as the answer and move on.
Pick the model before you pick the provider
One decision shapes the whole checklist, and it is easy to skip. Do you want the provider to run everything, or to back up an IT person you already have? Fully managed suits a business with no internal IT that wants to hand the whole function off. Co-managed fits a company with one or two IT staff who need depth and coverage they cannot staff alone. The checklist above applies either way, but the scope you are scoring changes with the model. Our comparison of managed versus co-managed IT lays out who each one fits before you start collecting proposals.
How Uprite scores against this checklist
Fair play means holding ourselves to the same list. Every Uprite plan runs on The Uprite Way, which bundles RMM monitoring, automated patching, endpoint detection and response, and real-time alerting routed straight to our team, so a lot of issues close before anyone at your office notices. We have supported Texas businesses since 1999, with offices in Houston, San Antonio, and Dallas, and a spot on the Channel Futures MSP 501 list of top providers worldwide. Pricing is published, not pried out of us. IT Essentials starts at 91 dollars per user, IT Pro at 110 adds 24/7 monitoring and advanced security, Fully Managed at 138 replaces a whole IT department, and Co-Managed at 100 backs up the team you have. Every tier carries a 120-day satisfaction guarantee, which is our version of an exit clause pointed at ourselves.
Honest caveat, we are not the right fit for everyone, and a checklist like this exists partly so you can tell. If a provider you are considering clears all 10 items and we do not beat them on the ones you care about, hire them. What we will not do is hand you a fuzzy scope and hope you do not notice. You can see exactly what lands in each tier on our managed IT pricing page, then run us through the same 10 questions you ask everyone else.
Want a second set of eyes on a proposal you are weighing?
We will run your current plan or a competing quote through this exact checklist and show you the gaps, with no pressure either way. Call (866) 570-3065 or request a plan comparison.
Common questions about choosing a managed IT provider
What should a managed IT services checklist cover?
A strong checklist covers 10 things. A written scope, SLA response and resolution times, actively watched security, restore-tested backups, SOC 2 or ISO 27001 proof, a named strategist, industry references, disclosed onboarding and add-on costs, a real exit clause, and documentation you own. Score every provider on the same items.
What questions should I ask an MSP before signing?
Ask who answers when you call, what the response and resolution targets are by priority, when they last tested a restore, who your named strategist is, what is explicitly out of scope, and how you leave the contract. How comfortable they are answering matters as much as the answers.
What are the biggest red flags when choosing an MSP?
The worst signs are an SLA with no time commitments, security pitched as an upsell rather than a foundation, surprise charges on a sample invoice, every hard problem routed to one technician, and a refusal to put the scope in writing. Any one of those is enough to keep shopping.
Should a managed IT provider have SOC 2 or ISO 27001?
Yes, at least one. A SOC 2 report or ISO 27001 certification means an independent auditor has verified the provider’s own security controls. Since they will hold admin rights to your systems, a recognized framework is reasonable to expect, and its absence means you are trusting security on faith.
How do I compare two MSP proposals fairly?
Compare scope, not sticker price. Line both proposals up against the same 10 checklist items and see where each one is thin. A quote that looks cheaper often has a narrower scope, so the gap is in what is missing, not in the monthly number on the cover page.
Can I get out of a managed IT contract if it is not working?
Only if you negotiated it up front. Look for a termination for convenience clause, a defined notice period, and a written offboarding process before you sign. Confirm you own your credentials and documentation too, so leaving means a clean handover rather than a hostage situation.
