Most guides on choosing a managed IT provider hand you a checklist. Certifications, response times, years in business, tick the boxes and you’re done.

The problem is every provider on your shortlist can check those same boxes convincingly in a sales conversation. The real signal isn’t in what they claim. It’s in how they answer five specific questions, and whether their answer matches what a genuinely strong provider would say versus what a mediocre one hopes sounds close enough.

Here’s how to actually tell the difference.

Do you have a current SOC 2 Type II report?

This is the single fastest filter available, and most business owners never ask it directly.

A good answer is immediate. “Yes, here it is,” followed by a report dated within the last twelve months. Anything else, a self-assessment, an internal audit summary, a vendor compliance questionnaire, is not a substitute. Those are the provider grading their own homework.

For any business handling customer data, financial records, or regulated health information, an MSP without a current, independently verified SOC 2 Type II or ISO 27001 certificate isn’t a minor gap. It’s disqualifying.

What’s actually included in this monthly price versus billed separately?

Muddy pricing is one of the most consistent red flags across provider reviews. A strong provider can put the full breakdown in writing on the spot, what’s covered under the flat rate, what triggers an additional charge, and what those charges look like.

If a provider can’t produce that in writing immediately, that’s not an oversight. It’s a preview of every invoice conversation you’ll have for the life of the contract.

What does your actual SLA guarantee, in writing?

“We respond quickly” is marketing language, not a commitment. A real service level agreement specifies response time in minutes or hours for each severity tier, defines exactly what separates a critical issue from a standard one, and includes a penalty or service credit when that commitment gets missed.

Picture a specific scenario. It’s 3am, and a server goes down. What happens next, precisely, according to the contract you’re about to sign? If the answer is vague, the SLA is vague, and vague SLAs are the ones that quietly stretch during an actual emergency.

How do you manage vendor and third-party access to our systems?

This question tends to catch providers off guard, which is exactly why it’s useful. A strong answer includes named access control procedures, time-limited credentials rather than standing access, and audit logs for every access event.

A provider who hesitates or gives a general answer about “following best practices” without specifics is telling you something important. Access management isn’t a marketing bullet point for them, it’s not a built process they can describe confidently.

What happens in the first 90 days if we sign with you?

Long-term partnerships compound in value. A provider who has worked inside your environment for years catches anomalies faster and understands your specific priorities without needing an explanation every time. But that value only shows up if the onboarding itself is handled well.

A confident answer here is specific and sequenced, discovery, documentation, a defined cutover plan, and a clear point of contact throughout. A vague answer, “we’ll get you set up,” suggests onboarding is improvised rather than practiced.

Why this framework works better than a checklist

Every one of these questions has a version that sounds fine on the surface and a version that’s actually true. The gap between those two versions is where the real evaluation happens, and it only surfaces when you ask directly rather than reading it off a services page.

The businesses that end up satisfied with their MSP choice aren’t the ones who found the cheapest bid or the flashiest pitch deck. They’re the ones who asked these five questions early enough to walk away from a weak answer before signing anything.

Running this evaluation across even three or four providers takes real time most business owners don’t have. It’s exactly the kind of comparison a good technology partner can shortcut for you, connecting you directly with providers who’ve already been vetted against standards like these, matched to your size, your industry, and your specific requirements.

If you’re currently evaluating IT providers, or wondering whether your current one would survive this conversation, that’s worth finding out. One request gets you in front of the right specialists instead of running this vetting process alone.