By Megan Sullins, Chief Strategy Officer, MIS Solutions
The best way to choose a managed IT provider is to score every finalist on the same five categories (support, security, scalability, strategy and contract terms), weighted by what matters most to your business. Do the weighting before the first sales call, so the most polished pitch doesn’t set your priorities for you.
Here’s why that matters. Most of the business leaders we meet aren’t shopping for their first IT provider. They’re shopping for their second or third. The last partnership usually looked fine at signing. The problems showed up months later: a ticket sat for a day, a security gap surfaced after an incident, or a “low monthly fee” turned into a stack of project invoices. For a company with 20 to 200 employees, one bad choice costs real money and months of disruption.
The scorecard below gives you a repeatable way to compare providers side by side.
Step 1: Set your weights before you talk to anyone
Give each category a weight out of 100 based on your situation. A healthcare practice may weight security heavily. A company planning an acquisition may weight scalability and strategy. Then rate each provider from 1 to 5 in every category, multiply by the weight, and add up the totals.
| Category | Example weight | What a 5 looks like | What a 1 looks like |
|---|---|---|---|
| Support and responsiveness | 25 | A live technician engages fast, the SLA has remedies, the help desk is in-house | “Response” means an auto-reply, no remedy clause, outsourced call center |
| Cybersecurity | 25 | Layered security included and owned by the provider, monitored 24/7 | Tools are sold separately and you configure them |
| Scalability | 15 | Proven onboarding process, both fully managed and co-managed options | “We’ll figure it out as you grow” |
| Strategic IT leadership | 20 | Dedicated vCIO from day one, quarterly reviews, a written roadmap | Strategy only for top-tier accounts or at extra cost |
| Contract and pricing | 15 | Fixed monthly fee, clear scope, fair exit terms, you own your data | Long lock-in, vague scope, surprise invoices |
Step 2: Test support with the questions sales teams avoid
Every provider says it’s responsive. The difference is in how they define and measure “response.” Ask:
- When your SLA says “response,” does that mean a technician is working the issue or that a system confirmed the ticket?
- What are your targets for critical, high, normal and low-priority issues? Common targets are 15 to 60 minutes for a critical outage and the same business day for normal requests.
- What happens contractually when you miss a target? An SLA without a remedy is a promise, not a commitment.
- How many endpoints does each engineer support?
- Is your help desk your own employees, or a third party?
- Can I see your satisfaction scores, and are they tracked by an outside platform?
Step 3: Find out who owns your security
A 20 to 200 person company rarely has a full-time security analyst, so your provider effectively becomes your security team. The key question isn’t which products they use. It’s who is accountable when something gets through. Score providers on five layers:
- Endpoints: managed detection and response on every device, not just antivirus
- Email: phishing and threat filtering for Microsoft 365 or Google Workspace
- Identity: multi-factor authentication, conditional access and Zero Trust practices
- Monitoring: 24/7 coverage with defined escalation, including nights and weekends
- People: ongoing security awareness training, not a one-time onboarding video
Also ask whether security is included in the monthly fee or billed as a separate line item.
Step 4: Check whether they can grow with you
Your headcount today won’t be your headcount in three years. Growth usually arrives in bursts, such as a new location, an acquisition or a hiring push. Ask how quickly they can get a new hire fully set up, how they’d support a second office or a hybrid team, and whether they’ve onboarded companies your size before.
Also ask whether they offer co-managed IT. If you hire an internal IT director later, a good partner should be able to shift from running everything to supporting your team, without forcing you to choose between them.
Step 5: Look for strategy, not just support
A provider that only closes tickets is a help desk. A partner helps you plan. That role usually belongs to a virtual CIO (vCIO), who meets with your leadership, builds a technology roadmap, plans the IT budget and manages vendors.
Many providers reserve a vCIO for their biggest accounts or charge extra for one. Ask: Is a vCIO assigned from the start? How often do they meet with leadership? Will I get a written roadmap, and how often is it updated? A good vCIO pays for itself in moments like a compliance change, a cyber insurance renewal, or sizing up the technology at a company you’re acquiring.
Step 6: Read the contract like a buyer, not a signer
The contract shows whether a provider expects to earn your business or to lock it in. Check four things:
- Pricing: Is the monthly fee fixed? What triggers extra charges, such as after-hours work, security tools, onboarding or projects?
- Term and exit: Can you leave with 30 to 60 days’ notice? What’s their average client tenure?
- Scope: Can you tell from the written agreement exactly what’s included?
- Ownership: If you part ways, do you keep your documentation, network diagrams and data?
Red flags that should cost a provider points
- “Response time” quoted with no definition
- Security sold as an add-on bundle
- Strategic planning only in a “premium” tier
- Three-year auto-renewing contracts with no exit terms
- A generic proposal that never mentions your environment
- References only from companies much larger or smaller than yours
How MIS Solutions scores itself
We built our managed IT service around the same criteria we just asked you to use.
| Category | How MIS Solutions delivers |
|---|---|
| Support | Average help desk response of about 5 minutes, measured as a live technician working your issue, not a ticket confirmation. Tracked publicly through our Crewhu-powered satisfaction dashboard. Our help desk is 100% in-house. |
| Security | Layered cybersecurity included in every managed IT engagement: endpoint protection, email security, identity protection, dark web monitoring, security awareness training and threat response |
| Scalability | Fully managed and co-managed IT options, with on-site onboarding included. We support nearly 140 businesses across Greater Cincinnati and Indianapolis. |
| Strategy | A dedicated vCIO from day one, as standard rather than a premium tier, with quarterly business reviews and a written IT roadmap |
| Contract | Predictable fixed monthly pricing with no surprise fees. Our average client partnership lasts 11 years. |
FAQ
What should I look for in a managed IT services provider?
Look at five areas: how support is defined and measured, who owns cybersecurity, whether the provider can scale with you, whether strategic guidance (a vCIO) is included, and how transparent the contract and pricing are.
What is a good response time for managed IT support?
The definition matters more than the number. Ask whether “response” means a technician is actively working the issue or that a system acknowledged it. Common SLA targets are 15 to 60 minutes for critical outages and the same business day for normal requests.
Should a vCIO be included in managed IT services?
It should be for most growing businesses. Some providers include a vCIO as standard, while others charge extra or reserve it for large accounts. Ask when the vCIO is assigned and how often they meet with your leadership.
What’s the difference between fully managed and co-managed IT?
With fully managed IT, the provider handles all of your IT. With co-managed IT, the provider supports an internal IT person or team, covering gaps like after-hours support, security or specialized projects.
How many providers should I compare?
Three or four finalists is usually enough. Ask each for references from companies your size and industry, and request a proposal scoped to your environment.
Put the scorecard to work
Treat this decision like hiring a senior leader, not buying a product. The team you choose will be inside your systems, protecting your data and shaping your technology plans.
If you’re comparing providers in Cincinnati or Indianapolis, we’ll walk through your scorecard with you, even if we aren’t on your shortlist. Book a free discovery consultation and see how each provider measures up.