Cybersecurity

There are a lot of managed service provider (MSP) options available to help you with your technology needs. Here are some tips for finding the right one.

Look for someone who understands your business and wants to learn more. 

Your MSP should understand the needs of both your wider industry and your unique organization. An MSP can’t develop appropriate strategies for your business to grow and thrive unless it fully understands your organization and is nimble and experienced enough to work with any specialized software and regulatory compliance that may apply to your business. There are no one-size-fits-all solutions in IT. Even companies with the same number of employees in the same industry can have completely different IT needs. 

Don’t be the only one asking questions. 

The most effective managed services provider is one who probes for more information about your company, your needs, your challenges and your goals. That process is key to formulating the right IT strategy for your business. To successfully oversee your technology and grow your business, an MSP needs to know where you are and where you want to go. 

Does the MSP understand your regulatory compliance issues?

Whether your company is regulated to ISO 27001, the National Institute of Standards and Technology (NIST), the Health Insurance Portability and Accountability Act (HIPAA), Cybersecurity Maturity Model Certification (CMMC) or others, make sure your MSP understands the controls and can provide documentation and show that they are helping your company meet the necessary controls. Ask to see their internal procedures such as Change Control, Incident Response, Backup and Recovery and User Account Provisioning.

What cybersecurity services do they provide?

Can they help prevent ransomware attacks that could disrupt your business? While they don’t need to be a Managed Security Service Provider, they should be able to help secure your environment with tools such as endpoint management, threat detection, firewalls, multi-factor authentication. They should understand what Security Technical Implementation Guides (STIGs) are and how to use them if installing tools and network hardware.

Ask a potential MSP if they offer anything beyond managed IT services.

If they do, the scope of their business may not be as laser focused as is necessary. Watch for MSPs that are trying to do too much. 

Seek an MSP with a proactive approach that goes beyond break-fix services. 

Forward-thinking MSPs utilize proactive remote monitoring so they can spot and prevent problems before a crisis causes downtime, data loss or other disruptions. Fully realized disaster recovery plans that include regular on-site and off-site backups are crucial. 

Ask any MSP you’re considering if they outsource any part of their support. 

If you can’t look their technicians in the eye, they won’t regularly be available to come to your place of business. If this is the case, that provider isn’t worth your money. While remote monitoring and service is great for many problems, there are times where you’ll need your IT provider to come on-site for a fix or audit. Make sure these situations will be accounted for in your plan. Lastly, ask to go visit their office. You can get a good feel for the company by how busy they are, how efficient does the office look and do employees look happy.

Be certain that provider accountability is written into any service level agreement (SLA). 

You have the right to expect that the MSP you choose will be held accountable if they don’t meet the level of network performance they promise. Ask how the service provider will make good on any failures. 

Some specifics for an SLA:

• Scope of services
• Service goals
• Immediate response for emergencies in one to two hours
• Normal responses from four hours to one day
• Network availability or uptime
• Other agreed upon key performance indicators (KPIs)
• Enforcement — ability to cancel and/or monetary penalties for missing SLAs
• Customer responsibilities
• Legal language

Avoid providers who strictly bill by the hour. 

One of the biggest benefits of partnering with an MSP is that your IT spending is controlled and predictable. Providers who charge flat fees for defined services benefit themselves by doing work right the first time—and by preventing problems from happening in the first place.

 Recognize that the up-front cost of managing your network should not be the only deciding factor in choosing your MSP. 

The financial benefits of reliable security, regulatory compliance, minimized downtime and averting spendy network disasters should lead you to carefully weigh all the considerations listed here. One metric to ask an MSP is for their managed service renewal rate. That will help indicate how satisfied their customers are with their services.

Request references and use them. 

Current clients can help you determine if an MSP has experience in your industry or (at minimum) with businesses similar in size to your own. A company should be able to provide you with references, testimonials and endorsements. Look for a provider who has been around for a while and has a solid reputation. You’ll have greater peace of mind knowing that your network will be properly managed and that your MSP will work hard to preserve their good name. They are more likely to view you as a partner because their success relies in part on yours. 

BONUS TIP: Look for experience managing remote-work, work from home and hybrid work environments as well traditional office workplaces. There’s a lot more to setting an employee up to work reliably outside the office than just giving them a computer and having them plug into their home network. Given the paradigm shift brought on by the COVID-19 pandemic, it’s vital that the managed service provider you partner with has deep knowledge about the special challenges that remote work presents—especially when it comes to additional cybersecurity risks—and have a history of providing solid remote work and hybrid solutions.