How to choose a managed IT services provider

Who this guide is for

This guide is written for executives, CFOs and IT managers of SMEs and mid-sized companies who need to choose or replace a managed IT provider. It starts from a simple observation: offers look alike on paper but differ widely in practice. A good choice depends less on the sales pitch than on precise, written and verifiable answers.

Three situations come up often:

• First outsourcing: IT was handled in-house by one person or a small team, and the workload or the risk has become too high.
• Changing provider: the current contract no longer works (delays, lack of visibility, dependence on one person, no documentation).
• Growth or reorganisation: new sites, a merger, stricter security requirements, a cloud migration, a request from a customer or an insurer.

In each case, the question is not "which provider is best?" but "which provider will take on my scope, with commitments I can check?".

The four managed IT service models

Before comparing companies, choose the service model. It defines who is responsible for what and how the price is structured.

Fully managed IT

The provider runs the whole agreed scope: servers, network, backups, endpoints, accounts, security and end-user support. You manage through service levels and reporting. This is the clearest model when you have no internal IT team.

Co-managed IT

Your internal team keeps some topics (business applications, user relations, projects) and the provider takes the rest (infrastructure, monitoring, on-call, security). It works well provided you write down exactly who does what: most problems come from the grey areas between the two teams.

Partial managed services

The provider takes a single area: monitoring, backups, cybersecurity, endpoint support or hosting. Useful to address a specific risk, as long as you check the interfaces with other parties.

Time and materials, prepaid hours

You buy engineering time by the hour or day, with no commitment to results on a scope. Useful for one-off projects or extra capacity; poorly suited to day-to-day operations, because no one is accountable for the result between interventions.

SKILLSYS offers fully managed IT, co-managed IT and single-service engagements; the choice is made with you during the initial assessment and written into the proposal.

18 questions to ask a provider

Ask these questions in writing and ask for written answers. A vague answer is already useful information.

Scope and organisation

1. What exactly is in scope? The list of devices, services, users and sites, with exclusions.
2. Who is my contact, and who covers for them? A name, a role, a backup. Be wary of contracts where "the team" answers with no named owner.
3. Is any work subcontracted? If so, to whom, for which activities, and with what access to your systems?
4. How does the takeover of the existing environment work? Inventory, recovery of access, documentation, duration, cost, and what happens if the outgoing provider does not cooperate.

Service levels

5. How are incident priorities defined? A "critical" incident should be defined by its business impact.
6. What is the response time per priority? The time between the report and the actual start of work.
7. What is the restoration or workaround target? The time to get the service working again. It is often a target rather than a guarantee: ask which.
8. Is there an availability target, and how is it measured? For which service, over what period, with which exclusions (planned maintenance, external causes).
9. What exactly does "24/7" cover? Automated monitoring, a human on-call engineer, or end-user support? For which priorities?
10. What happens if a commitment is missed? Review, action plan, possible penalties: what matters is that it is written down.

Hosting and security

11. Where are my systems and data hosted, and who owns the equipment? Name and location of the data centre, owner of the servers, country of the backups.
12. Do the certifications quoted belong to the provider or to the data centre? A building's ISO 27001 or HDS certification does not certify the services of the provider operating inside it.
13. How is access to my systems managed? Named accounts, multi-factor authentication, logging, access reviews.
14. Are backups tested? How often, with what report, and with what retention period?

Governance, exit and price

15. What reporting will I receive? Frequency, indicators, steering meetings, access to ticket history.
16. How does the contract end? Handover of configurations, documents, inventories, data and access: timing, format and cost.
17. What is the billing unit? Per user, per device, per asset, fixed fee; what is included, optional and out of scope.
18. How does the price change over time? Adding users or servers, indexation, commitment period, notice.

Reading an SLA correctly

Service levels are the most misread part of managed IT contracts. Three notions are often confused:

A 30-minute response time does not mean the problem is fixed in 30 minutes. It means an engineer starts working on the incident within that time. Check the coverage hours too: a time expressed in "business hours" does not run at night or at weekends.

As an example, the grid proposed by SKILLSYS sets four priorities, from P1 (critical service down, 30-minute response, around the clock) to P4 (planned change). It is detailed on our service commitments page with the measurement method and exclusions. The times that apply are those in the signed contract.

Red flags

• A price without an inventory. A firm quote made without knowing your estate is either oversized or incomplete.
• "Everything is included". Ask for a document setting out exclusions and out-of-scope services; without a written list, you may only discover them later.
• An SLA without defined priorities, or expressed only as "best efforts".
• Certifications presented without their holder or scope.
• No exit clause, or an exit plan "to be defined when the time comes".
• Shared administrator accounts, or a refusal to give you the passwords and documentation of your own environment.
• Dependence on a single person at the provider, with no backup or documentation.
• A long commitment period with no way out after repeated failures.

A five-step selection process

1. Describe the need. A short brief is enough: number of users and sites, list of critical servers and applications, business hours, regulatory constraints, what stays in-house, current budget. Two to four pages beat a fifty-page document nobody reads.
2. Build a shortlist. A short list of about three providers makes an in-depth comparison easier. Send each the same brief and the 18 questions above.
3. Run an assessment. A technical session on your real environment shows how the provider works: quality of questions, understanding of risks, ability to say what it does not do.
4. Test on a limited scope. A pilot takeover (one site, monitoring, backups) lets you judge documentation, responsiveness and reporting before committing to everything.
5. Sign the contract. Check that it includes the scope, priority grid, measurement method, exclusions, reporting, exit clause and price-change terms. What is not written is not committed.

For the budget side, our guide to managed IT services pricing explains billing models and how to compare quotes.

How SKILLSYS answers these questions

For transparency, here are our answers to the main points. They describe how we work by default; the contract sets out your specific case.

More common questions are answered in our managed IT FAQ.