We’re a managed IT provider, so read everything below with the appropriate grain of salt. We also spend a surprising amount of our time cleaning up after other managed IT providers, which is why we’d rather give you the honest version of how to choose one than the brochure version.
Choosing a managed IT provider: the short answer
Pick the provider that can name the people who will answer your phone, puts response and exit terms in writing, hands you network documentation you own, and gives you a current client to call. That’s the whole list. Everything else here is just how to test those four things before you sign.
The list applies to us too, so hold us to it.
What to look for in an IT support company
Start with people, not platforms. We’re a family-run shop with thirty years in Metro Atlanta, serving law firms, healthcare practices, churches, nonprofits and growing small businesses from Buckhead to Decatur to Woodstock. Our technicians answer the phone directly, with no ticket queue and no overseas desk in between, and the ones who learn your setup stay on your account for years. That’s the standard we’d measure any provider against, including ourselves.
Then look at the paper. A provider can be lovely on the phone and still write a contract that leaves you with no documentation, no admin access and no clean way out. You’ll find that out about eighteen months too late if you only judge by the sales call.
One honest limit: no checklist tells you whether a provider’s technicians are actually good at the work. References and a few months of watching them do that. The checklist just keeps you from signing something you can’t leave.
What we find when we take over a botched account
The pattern is depressingly consistent. A new client calls because something broke, and within the first week we’re finding the same four things.
The network is undocumented, so nobody can say which switch feeds which office or where the firewall rules came from. The admin credentials live with the old provider, sometimes in one technician’s personal password manager. The backups report “success” every night, but nobody has ever restored a file from them to see whether they work. And the contract auto-renewed last month because nobody read the renewal clause.
Any one of those is fixable. Together they mean you’ve been paying for a service you couldn’t verify. If the backup item is the one that worries you, we’ve written up what a real recovery plan costs for a small business, and a test restore is part of it.
Admin logins that left with the last provider
This one stings the most. The global admin on the Microsoft 365 tenant is an email address at the old provider. The domain registrar account belongs to a technician who left that company two years ago. The firewall password is, as far as anyone can tell, in someone’s head.
Getting control back means proving to each vendor that you own the organization, and that takes days of phone calls and paperwork while your staff keep working on a network you can’t change. You can prevent all of it by making sure the credentials were yours from the start.
Contract red flags to catch before you sign
Most burns happen in the paperwork, not in the technical work. You can read a managed IT agreement in an hour, and that hour is the cheapest insurance you’ll buy this year.
Who holds the admin keys and the documentation
Your admin credentials and your network documentation belong in a vault you control. That means a password manager or documentation system registered to your organization, with you as the owner and the provider as a user who can be removed. It does not mean a provider’s personal login, a shared spreadsheet or “we keep that on file for you.”
Documentation means a current network diagram, the list of licenses and who holds them, vendor contacts, and the logins to everything. Ask to see a sample from an existing client with the details blacked out. A provider with real documentation is usually a little proud of it.
Renewals, exits, and out-of-scope fees
Lock-in rarely looks like a trap. It looks like an auto-renewal with a notice window of a few days, or an exit clause that says nothing about what you get back. A fair contract gives you a notice window you can realistically meet, and a fair exit returns your records, your documentation and your admin access without a fee for your own data.
If you’re already holding a contract that fails that test, we’ve laid out the steps for moving off a provider that left you stuck.
Then look at what hides behind “all-inclusive.” Ask in writing whether project work, after-hours calls and hardware are covered, and whether the monthly price can escalate during the term, because those four exclusions are where the surprise invoices come from. To sanity-check any quote, compare it with what managed IT in Atlanta really costs.
Healthcare practices have one more question: will the provider sign a business associate agreement? If the answer is anything but a plain yes, stop there. Our piece on what HIPAA-compliant support should actually cover goes through the rest.
Response-time guarantees to demand in writing
“We’re very responsive” is not a contract term. You want numbers, split by priority, written into the agreement, so that a Friday-afternoon outage doesn’t depend on anyone’s good mood.
Response is not the same as resolution
Response time is how long until a qualified person is working on your problem. Resolution time is how long until it’s fixed. Providers love to quote the first and stay quiet about the second, because an automated “we’ve received your ticket” email can technically hit a response target in four seconds.
An acknowledgement isn’t a response. Watch for “best effort” wording too, which commits the provider to nothing, and ask who picks up after hours and whether that person can actually log into your systems. We think this is the single clearest difference between providers, and it’s why we keep making the case for an IT company in Woodstock that picks up the phone instead of a queue.
Benchmarks worth writing into the contract
The UK National Cyber Security Centre publishes guidance on choosing a managed service provider that gives useful numbers. It describes a response time of under 1 hour as standard for urgent issues. For routine, medium-priority issues, it calls a resolution time of 2–3 business days a good starting point.
Treat those as a floor to negotiate from, not a legal requirement, and note that they come from a UK body, not an American regulator. They’re still a better anchor than whatever the provider’s template says, and you can ask for tighter terms if your practice can’t tolerate a slow Monday.
If a provider won’t put any number in writing, you’ve learned how they’ll behave when something breaks. For a closer look at how a named local team compares with a distant desk, see what a local IT company gives you versus a national MSP.
Technician turnover: who will actually be on your account
Managed IT is a people business wearing a software costume. If the technician who understood your office leaves every year, you re-teach the next one at your own expense, and your documentation had better be good.
The turnover question, and what a good answer sounds like
Ask how long the technicians who will touch your network have been with the company, in years. Don’t ask for a turnover percentage. A percentage averages the junior help-desk seat that churns every few months with the senior engineer who’s been there a decade, and it hides which of them you’ll actually get.
Then ask who the named lead on your account is and what happens when that person is out. A good answer gives a name, a backup who also knows your setup, and a straight explanation of how the handoff works. A bad answer says “our team” a lot.
Our answer is that the people who learn a client’s setup stay for years. Don’t take our word for it. Check it against references, because a claim like that is only worth what the clients say about it.
Reference checking that goes past the glowing testimonials
Every provider has a page of testimonials, and none of them were chosen at random. A useful reference call is a different exercise from reading a quote on a website.
Ask for references in your own industry. A law firm’s idea of a bad day (a conflict-check system down before a filing deadline) is nothing like a church’s, and a provider that’s good at one isn’t automatically good at the other.
Then ask each reference about the worst month the provider has had with them. A glowing reference who can’t describe a bad month either hasn’t had a real problem yet or isn’t being straight with you. What you want to hear is what broke, how fast someone called, and whether anyone owned it afterward.
Ask for the client who left
Ask for one client who has left, and why. Every provider loses clients, and sometimes the reason is fair: the client got acquired, or outgrew the service. How the provider talks about a departure tells you more than any case study.
If confidentiality rules out names, ask for an anonymized call. A provider that refuses both has told you something.
Walk-away signals and an MSP vetting checklist
Not every flaw is fatal. Some mean leave the meeting; others only mean you ask a sharper follow-up. Knowing which is which keeps you from either signing a bad deal or rejecting a decent provider over an awkward answer.
Red flags that point to a bad IT provider
Walk away when the pitch is jargon instead of specifics. If someone calls themselves a “trusted digital transformation partner” and promises “synergy,” ask what they would actually do in your first thirty days. If the answer is more of the same vocabulary, you’re done.
Walk away when a ticket queue or an overseas desk is the only route to a human. Walk away when security answers skip patch timing; the same NCSC guidance recommends fixing critical or high-risk vulnerabilities within 14 days of the update’s release, and a provider should be able to tell you their number without hesitating. And walk away when they push an enterprise package you didn’t ask for, because a ten-person office does not need a 24/7 operations center it will never look at.
Other things call for a follow-up, not an exit. “Best effort” wording is often a template that can be rewritten with real targets. A young firm with short technician tenure may have a good reason, so ask who the named lead is and how long that person has worked on accounts like yours. A slow reference isn’t fatal; a refused one is.
Questions to ask an MSP on the first call
Here’s the vetting checklist we’d use ourselves, in the order we’d ask it.
Begin with who will be on the account: names, years of tenure, and the backup when the lead is out. Then ask how response is measured, what the written targets are for urgent and routine issues, and who answers at 9 p.m. on a Saturday. Next, ask what happens on exit, specifically what you get back and in what format, and where the admin credentials and documentation live today. Finally, ask whether a current client in your industry will take your call, and whether a former one will too.
A provider who answers all of that without flinching has earned a second meeting.
You can run this list with us. Talk to a technician, have these questions in front of you, and see whether a real person gives you a real answer on the first call.
Frequently asked questions
Who should own our admin passwords and network documentation?
You should. Keep them in a password manager and documentation system registered to your organization, with the provider added as a user you can remove. If a provider insists on holding them in its own system or a technician’s personal login, you’re renting access to your own network.
Is a one-hour response time realistic for urgent issues?
Yes, when a person answers the phone instead of a queue. The UK National Cyber Security Centre describes under 1 hour as standard for urgent issues. It’s guidance to negotiate from, not a legal requirement, and it only counts if it means a qualified person is working on the problem, not an automated acknowledgement.
What should a fair exit from a managed IT contract return to us?
Your records, your network documentation and your admin access, without a fee for your own data. The contract should also give you a notice window you can realistically meet. The term length matters less than whether those exit terms are written down.
Does a healthcare practice need a business associate agreement with its IT provider?
If the provider can touch patient information, ask whether it will sign a business associate agreement before onboarding starts. A plain yes is the only acceptable answer. Hedging at this stage is a reason to walk away.
Which red flags mean walk away, and which just need a follow-up question?
Walk away from pure jargon with no specifics, a ticket queue or overseas desk as the only route to a person, patch answers that skip timing, and enterprise packages you didn’t ask for. Ask a sharper follow-up about “best effort” wording, short technician tenure and slow reference calls, because those can have fair explanations.
