Choosing a provider before defining what the business needs can leave a growing team trying to fit its operations around the contract. A clear managed IT services plan reverses that order and puts you in control of scope, cost, risk and timing.
Table of Contents
Stop Shopping and Start Scoping
Break/fix feels cheap until something breaks at the wrong hour. You call, someone comes and you pay. That model struggles once you have 20 or 50 people who depend on email, file sharing, chat and line-of-business apps all day. The pattern is familiar: tickets pile up, small issues become downtime and no one has time for prevention.
Total cost of ownership tells the fuller story. Individual break/fix bills may look small, but downtime, repeat visits, lost staff time and rushed purchases add up quickly. A subscription plan for managed IT services spreads that cost and funds routine work intended to reduce incidents and improve recovery, including patching, monitoring, backups and documentation. You trade surprise invoices for steady coverage and fewer late-night calls.
The plan is the product.
Write down what must be covered and how quickly help must arrive, then let every MSP bid on the same scope. You’ll compare like for like rather than picking a winner based on sales slides. Growth makes gaps more painful. A new hire without a laptop on day one can’t sell or support. A server that runs out of space during month-end close can’t wait until Monday. Vague promises are no help when payroll and customer orders are on the line.
Run a Discovery Audit Before You Ask For Quotes
You cannot manage what you haven’t documented. An audit gives you that list and prevents you from paying for coverage you don’t need. It also keeps providers honest because they must price your actual environment instead of a generic bundle that may leave holes.
Start with hardware. List laptops, desktops, servers and network gear by age and primary user. Then list software and cloud logins, along with owners and renewal dates. Once you have 30 people across two sites with a mix of office and remote work, informal memory fails. No one remembers which laptop missed backup or which licence is still billed to a past project.
Pull user accounts from email and file systems, then flag shared logins and stale accounts belonging to past staff. Walk the office and note printers and badge readers. Flag every device plugged into the network that no one claims. Those unknowns can become an entry point or an unexpected outage, and they make audits much harder than necessary.
Check security basics without guessing. Confirm whether patching is current on workstations and servers, whether multi-factor authentication is enabled for email and remote access and whether endpoint protection is installed on every device holding business data. Write down yes or no for each control so gaps are visible and easy to price into the plan.
Note how you handle monitoring and user changes today. Remote monitoring and management, or RMM, lets an MSP see patch status and alerts without waiting for your call. If you don’t have that visibility now, record it as a gap. Document onboarding and offboarding steps too, since leavers with active access and newcomers without access create different costs.
Define What Is Managed and What Is Not
Once the audit is complete, draw clear lines around what the MSP will own. Fully managed means the MSP handles day-to-day IT and becomes the first call for almost everything. With co-managed IT, your internal lead retains strategy and projects while the MSP covers night and weekend monitoring plus help desk overflow. On-demand means paying by the hour for specific help while keeping everything else in house.
Spell out help desk expectations by tier. L1 through L3 should have clear handoffs so a password reset doesn’t sit with a senior engineer and a server outage doesn’t remain with a junior technician. Response time is not resolution time, so define both plainly. Cover after-hours and holiday support too, including who answers the phone and how tickets are raised when email is unavailable.
Onboarding and offboarding deserve their own section because growing businesses often feel headcount pressure first. Once hiring accelerates, informal support starts to fail because no one remembers which laptop has a current backup or which shared mailbox still forwards to a former employee. Your plan should state who creates accounts and who removes access within 24 hours of an exit. It should also explain how equipment is collected and wiped so devices do not leave with data on them.
Put Security and Recovery Targets In Writing
Build security into the base plan rather than treating it as an add-on to buy later. Patch management and endpoint protection should be standard on every covered device. Multi-factor authentication enforcement and email filtering should cover every mailbox. If any device or inbox is excluded, name it and explain why so a quiet exception does not become an incident.
People need training as much as devices need tools. Short, recurring security awareness sessions keep common phishing tactics visible instead of treating security as a once-a-year exercise. For detection, consider endpoint detection and response on workstations and servers, with managed detection and response where you lack staff to monitor alerts around the clock. Assign alert duty clearly because an alert only helps when someone is responsible for assessing it.
Backups alone don’t keep a business running. Business continuity and disaster recovery plans should state where copies live, how often they are tested, how failover works and who can declare it. Set recovery time objective and recovery point objective targets by workload so the provider knows what must return first. Your order system may need a four-hour recovery time objective and a one-hour recovery point objective, while file archives can wait longer without damaging sales or service.
Don’t skip this detail. Cyber insurance applications may ask about controls such as multi-factor authentication, backups and access management, although requirements vary by insurer and policy. Include test dates and available evidence in the monthly report so the business can respond efficiently when an insurer, customer or auditor requests proof.
Score MSP Candidates on More than Price
Use a short request for proposal and score answers instead of presentations. Ask about the MSP stack, toolset maturity and local support capacity. Growing businesses that need on-site help at short notice may favour a Houston-based provider such as JustMSP because local presence can shorten response times when someone must work on the equipment. Proximity cannot repair a poor process, but it helps when a switch fails or a new office needs its cabling checked in person.
Examine security depth before discussing price. Ask who tunes detection rules and handles after-hours alerts. Request sample reports showing patch compliance and backup test results. If the answers are vague or every question becomes an upsell, move to the next candidate on your shortlist.
Test for growth capacity and practical advice. Can the MSP add new sites and staff without resetting the arrangement? Does it include vCIO guidance for roadmaps and budgets? Hiring plans and IT spending should be linked so systems keep pace with headcount. A provider that cannot address staffing, licences and hardware in one plan will struggle to keep up.
Compare Pricing Models and SLAs Side by Side
Choose a pricing model that won’t punish growth. Per-user pricing bundles support and security for each person regardless of how many devices they use. Per-device pricing charges for every endpoint and may suit shared workstations or shift work. Model both against your headcount plan for the next 24 months to see which remains predictable if you add 10 or 20 staff during a busy quarter.
Check what the per-unit price excludes. Projects, after-hours work, new site setups and hardware resale are often billed separately from the monthly fee. That’s reasonable when the contract lists rates and caps. A one-page rate card for extras can prevent arguments over what counts as a project after work has begun.
Set service level agreements with numbers you can verify. Define response and resolution times for every priority level, along with uptime or availability for core systems such as email and file access. State what credit or remedy applies when targets are missed and how to claim it. A service level agreement without a remedy is only a wish, which offers little help when systems are down.
Downtime cost makes the issue concrete, but a generic industry average is less useful than your own figures. Estimate the payroll, delayed orders, missed appointments and recovery work associated with an hour-long interruption to each critical system. Every promise needs a metric and a monthly report to support it, rather than kind words in a proposal.
Plan the Move and the First 90 Days
Migration is where a good plan earns trust. Ask for a dated cutover plan naming who moves email and files, who installs agents and who remains on call during each step. Keep old access live until the new tools show that they report correctly. Rushing a cutover is pointless if half your devices remain invisible to monitoring on Monday morning.
Use the first 90 days to close audit gaps in order. Patch what is behind, remove stale accounts, enable multi-factor authentication where it was missing and test one backup restore to prove recovery works. Hold a 30-day check to review ticket volume and slow responses. At 90 days, confirm that asset lists match what RMM sees and that onboarding follows the same steps each time.
Make Compliance and Governance Part of the Contract
Map service tasks to the audit trail you’ll need later. If you handle patient data, explain how the MSP supports HIPAA controls. If clients request SOC 2 reports, state who gathers logs and maintains change records. Include GDPR duties in the same table if you store data for people in regions where it applies, allowing evidence to build month by month.
Insist on a governance schedule that survives busy quarters. A quarterly business review should cover incident history, ticket trends, the project roadmap and budget forecasting. This four-part review prevents small problems from growing unnoticed and lets leaders fund replacements before failure forces the expense. Reviews work best when they end with two lists: what the MSP will do next and what you must approve.
Plan the ending at the start so you retain options. State that your data belongs to you and explain how admin credentials will be returned. List data ownership, return format, the timeframe for outbound help and orderly handover steps so you retain leverage if you switch. Without that language, even good service can become difficult to leave when a merger or new direction requires a quick move.
A good plan won’t choose the MSP for you, but it will make the right choice clear. Start with the audit and hire against the targets you wrote.