MSP Selection Checklist Template

Owned by the selection lead. Enter the target start date for the new MSP on the first task: every due date counts back from it in working days. Say who supports your IT now, and the tasks for leaving another provider or for your own IT staff appear. Say where the business is based for the Cyber Essentials check and the data protection notes.

• Set up the selection: the business, the start date and the people — the business choosing an MSP, the target date for the new MSP to start, who supports your IT now, where the business is based, and the people; later tasks are assigned from these fields
• Record why you are changing how IT is supported — what has prompted the change (a contract ending, problems with the service, growth, someone leaving, a security incident, or an insurer, customer or regulator asking for more) and what must be better afterwards; the requirements and the scoring start from this
• Agree who has a say and how the decision is made — who gives requirements (each team that relies on IT, finance, and whoever looks after personal data), who scores the responses, who checks the security evidence and the contract, and who approves; CISA’s guidance for MSP customers says every business unit should give input on its IT requirements
• Read the current IT contract for notice and exit terms — if another provider supports you now: the notice period and how notice must be given, the minimum term and any automatic renewal, the latest date to give notice so the contract ends when you want (and before any automatic renewal), what the provider must hand back or help with when you leave, any exit fees, and what the contract says about who owns the accounts, licences and equipment; if that date falls before the decision in Phase 8 (13 working days before the target start date), bring the start date forward on the first task, or ask the outgoing provider in writing to accept notice later
• Plan what changes for your own IT staff — if your own staff support IT now: which of their work moves to the MSP and which stays, what that means for each person, and who will tell them and when

Write down what the MSP will look after, which accounts your business owns and who controls them, what stays in-house, the security and service levels you need, and what you can spend. Together they become the requirements list every MSP is scored against.

• List the users, sites, devices and systems the MSP will support — the number of users and devices, each site and who works remotely, the main systems (email and files, line-of-business software, phones, network, backups and security tools), and anything that needs support out of hours
• Record who owns and who controls each account — for the email and file tenant, the domain names and DNS, software licences, backups, security tools and line-of-business systems: whose name each is registered in, who holds its top-level admin account, and who pays for it; owning an account and having admin access to it are different things, and the exit terms depend on both
• Decide which services you need and what stays in-house — the services to buy and, for each area, what the MSP does, what you keep and what is shared; the NCSC’s guide calls a matrix of responsibilities, showing what the MSP does and what you do, good practice
• Write down your security requirements — what you need the MSP to do and show: security updates (the NCSC recommends patching within 14 days of an update being released where it fixes a critical or high-risk vulnerability), tested backups, 2-step verification, security logs you can see, incident notification times, and least-privilege access for the MSP itself, plus anything your insurer, customers or regulator require
• Set the service levels you need — support hours, response and resolution times by priority, on-site visits, and the reports you want each month; the NCSC’s guide gives starting points (a response within 1 business day for minor issues and under 1 hour for urgent ones, and 2 to 3 business days to resolve routine medium-priority issues) and notes that quicker times are likely to cost more
• Set the budget and the pricing you can accept — what IT support costs now, the budget for the new contract, the pricing model you prefer (per user, per device or a fixed fee), one-off onboarding fees, and the cost of paying two providers while one hands over to the other
• Agree the requirements list and the scoring weights — one list of must-haves and nice-to-haves drawn from this phase, with a weight for each area, agreed before any MSP is contacted; CISA’s guidance for MSP customers suggests keeping a master list of requirements as the baseline for the choice

Find MSPs that could meet the must-haves, screen them, and cut the list to three to five that will receive the questionnaire. Record why each one was cut, so the choice can be explained later.

• Build a long list of MSPs — names from people you trust in similar businesses, your industry body, your software suppliers’ partner lists and your own search, with each one’s location, size and the services it says it offers
• Screen the long list against the must-haves — each MSP checked against the must-haves: the services you need, on-site cover if you need it, experience with businesses of your size and sector, the systems you use, and the certifications you require; a short call can settle what a website does not
• Cut the list to three to five MSPs — the shortlist that will receive the questionnaire, with the reason each other MSP was cut
• Tell the shortlist the timetable and sign NDAs where needed — one contact on your side, the dates for questions, responses, demos and the decision, how questions are answered (to every MSP at once), and a non-disclosure agreement before you share network details or documents

Send every shortlisted MSP the same questionnaire, answer their questions fairly, then score the responses against the weights agreed in Phase 2 and compare the prices like for like. The first task of this phase lists the questions to ask.

• Write the questionnaire — the same questions for every MSP, grouped by area: the company and its stability, the services and what is excluded, the team and how escalation works, security and its own tools, service levels and reporting, the onboarding and transition plan, exit terms, pricing, subcontractors and references
• Send the questionnaire to the shortlist — the same questionnaire, requirements summary and timetable sent to every MSP on the same day, through the one contact
• Answer questions and share the answers with every MSP — each question logged, answered once, and the answer sent to every MSP without saying who asked, so all of them respond to the same information
• Score each response against the weights — each response checked for completeness, then scored area by area by the people agreed in Phase 1, each on their own first, with the scores compared and the reasons recorded
• Compare the prices like for like — each MSP’s price over the full term for the same users, devices and services: monthly fees, onboarding fees, anything charged outside the fixed fee, price rises during the term, and fees on exit
• Choose the finalists — the two or three MSPs that go on to the security review, references and demos, with the reasons, and a short note to the others

An MSP holds privileged access to your systems and data, so check what each finalist says against evidence: its certificates, reports and insurance, how it secures its own tools and remote access, how it will reach your systems, its backups, logging and incident response, its subcontractors, and how it will handle personal data.

• Collect each finalist’s certificates, reports and insurance details — the certifications the questionnaire asked about (for example Cyber Essentials Plus, an ISO/IEC 27001 certificate or a SOC 2 report), with the scope written on each and its date, and the MSP’s insurance cover; check that each scope includes the services you are buying
• Check each finalist’s Cyber Essentials certificate — for a business in the UK: each finalist looked up on the Cyber Essentials website, as the NCSC’s guide suggests, with the level (Cyber Essentials or Cyber Essentials Plus) and the organisation named on the certificate; Cyber Essentials Plus adds independent testing of the same five technical controls
• Ask how each finalist secures its own tools and remote access — how its remote management and remote access tools are protected, whether 2-step verification is on every account that can reach customers, whether admin credentials are ever reused across customers, how a technician’s access is removed when they leave, and how it watches its own systems; the joint advisory from CISA, the NCSC and their partners says contracts should require MFA on all MSP accounts used to access customer environments, tells MSPs not to reuse admin credentials across customers, and says customers should make sure their contracts specify that the MSP implements these measures
• Agree how the MSP will reach your systems — a named account for each technician rather than a shared one, only the permissions the work needs, MSP accounts kept out of your own administrator groups, a secured connection, and a log of the MSP’s access that you can see
• Check backups, logging and incident response — how often backups run and are test-restored, where they are stored and who can reach them, which security logs are kept, for how long and whether you can see them, and how and how fast the MSP will tell you about an incident, including one on its own systems; the joint advisory recommends keeping the most important logs for at least six months
• List the subcontractors and suppliers that could reach your data — each finalist’s subcontractors, any outsourced help desk or monitoring, and the software suppliers whose tools would run on your systems, and how the MSP answers for them; the NCSC and CISA both ask customers to look at the MSP’s own supply chain
• Check how the MSP will handle personal data — what personal data the MSP will be able to reach (about staff, customers, patients or clients), where it will be held and from where it will be reached, and the data protection terms each finalist offers

Hear from current clients, see how each finalist works day to day, and check that it is likely to be there for the length of the contract. A trial, where you chose one when picking the finalists, runs alongside the security review and the references and ends before the preferred MSP is chosen.

• Speak to at least two references for each finalist — current clients of a similar size and sector, asked how support works day to day, how an incident was handled, how onboarding went and whether promises were kept; the NCSC’s guide suggests asking for references from other clients, particularly SMEs
• Hold a demo with each finalist — the people who would support you, the help desk and how a ticket is raised and followed, a sample monthly report and health report, and a walk-through of the onboarding plan for a business like yours
• Run the trial or proof of concept — only where you chose one when picking the finalists: started then and run alongside the security review and the references, with a limited scope agreed in writing, the success criteria set before it starts, the MSP’s access kept to what the trial needs and removed afterwards, and the result recorded
• Check each finalist’s financial health and track record — the latest accounts on the company register where it is registered, how long it has traded, who owns it, any legal disputes it discloses, and how it would tell you about a change of ownership; CISA’s guidance suggests asking for documentation of the MSP’s financial health, its performance record for other clients and any previous legal issues
• Choose the preferred MSP and a reserve — the preferred MSP and a reserve, with the scores, references, security review and prices behind the choice; contract talks start with the preferred MSP, and the reserve is kept informed until the contract is signed

Agree the terms with the preferred MSP before anyone approves the choice: the SLA, what is included, the security measures, the data processing terms, the exit terms and the price. Where your business does not yet own or control every account, this phase puts that right first.

• Agree the SLA — response and resolution times for each priority, the hours they apply, how they are measured and reported, and what happens when they are missed (service credits or another remedy)
• Check the contract says what is and is not included — the services, users, devices and sites covered, the responsibilities matrix from Phase 2, what costs extra and at what rate, and who tracks end-of-life systems and advises on replacements; the NCSC’s guide says the contract should clearly specify what is and what is not included
• Put the security measures in the contract — the measures from Phase 5 written in: 2-step verification on every MSP account, least-privilege access, no admin credentials reused across customers, logging you can see, backup and restore testing, incident notification times, regular health reports, and liability for incidents; the joint advisory says customers should make sure their contracts specify that their MSP implements its baseline security measures
• Agree the data processing terms — the terms for the personal data the MSP will reach: processing only on your instructions, confidentiality, security, subcontractors, help with requests and breaches, audits, and deletion or return at the end; check them against the note on the Phase 5 data protection task
• Agree the exit terms — the notice period, the minimum term and any automatic renewal, help with the handover to the next provider, your data returned in a usable format and then deleted, the documentation and admin credentials handed back, the tenant, domains and licences confirmed as your business’s, any exit fees, and the dates for each
• Put every account in your business’s name, with its top-level admin account — only where Phase 2 found an account your business does not own or control: each registration moved into your business’s name and its top-level admin account held by someone in the business, leaving the current provider’s own access as it is until the handover; finish this before you sign or give notice
• Have the contract reviewed — the whole contract, the SLA, the data processing terms and the exit terms read by the contract reviewer, with the changes you asked for and the MSP’s answers; CISA’s guidance suggests a legal review of MSP contracts
• Agree the final price and the dates — the final price for the term, any onboarding fee, when billing starts, and the start date and transition dates the MSP has agreed; if the start date moves, change it on the first task

The approver reads the recommendation and approves, approves with conditions or does not approve the choice and the contract. Nothing after the decision can be completed until it is recorded. Not approved leaves the decision open and adds a task, before it, to go back to the reserve or the shortlist. Then the contract is signed and the other MSPs are told.

• Prepare the recommendation for the approver — the preferred MSP, its scores and price against the others, the security review, the references, the contract and exit terms, the risks that remain and the budget
• Go back to the reserve or the shortlist — after Not approved only: what the approver objected to, then talks with the reserve MSP or a return to the shortlist, a new recommendation, and the start date moved on the first task if it has to. The approval task below stays open, so nothing after it can be completed; when the new recommendation is ready, the approver changes the decision and completes the approval task. If the approval task was completed with Not approved, un-complete it first
• Approve the choice of MSP and the contract — Approved, Approved with conditions or Not approved for signing with the preferred MSP on the terms agreed, with the reasons, recorded by the decision approver alone. Complete this task for Approved or Approved with conditions. For Not approved, record the decision and the reasons and leave this task open: the task above it to go back to the reserve or the shortlist appears, and signing, notice and the transition plan stay locked until a new decision is recorded and this task is completed
• Meet the conditions before signing — after Approved with conditions only: each condition the approver set, met and recorded, or the approver told in writing that it is not
• Sign the contract — the final contract, SLA and data processing terms signed by both sides, with the signed copies kept where your business can always reach them
• Tell the MSPs that were not chosen — each finalist and shortlisted MSP told, with brief feedback if they ask, and any of your documents they hold returned or deleted as the NDA says

Give notice to the outgoing provider or plan the handover from your own IT staff, agree the transition plan with the new MSP, and hold the kick-off. The new MSP’s own onboarding starts there.

• Give notice to the outgoing provider — if another provider supports you now: notice given in the way its contract requires, by the latest date from Phase 1, asking for the exit help the contract provides and confirming the date its service ends
• Agree the exit plan with the outgoing provider — if another provider supports you now: the documentation, network diagrams and admin credentials it hands over and how, your data and backups returned, licences bought through it moved to you or the new MSP, and the date its access ends; set that date only once your business holds the top-level admin account for every system, and pass the plan to the new MSP
• Plan the handover from your own IT staff — if your own staff support IT now: the documentation, passwords and admin accounts they hold, the open issues and known problems, and the time they will spend with the new MSP during onboarding
• Agree the transition plan with the new MSP — the dates for discovery, installing the MSP’s tools and the switch of support, any downtime at a time you choose, who does what on each side, and what your staff will be told and when; CISA’s guidance suggests asking for a transition plan before the contract is signed, and says any downtime should ideally be at a time of the customer’s choosing
• Hold the onboarding kick-off with the new MSP — the requirements list, the accounts table, the responsibilities matrix, the exit plan with any outgoing provider and the contacts on both sides handed to the new MSP, and the date of the first service review set; the new MSP’s own onboarding starts here