MSP due diligence
Questions to Ask an MSP Before You Sign or Renew
A service-level promise is useful only when someone can show who acts, how quickly, and with which authority.
Open the checklist
The interrogation playbook
Ask for the record.
A better vendor meeting starts with a question that cannot be answered with a slide. Ask for the record, the date, the accountable owner and the unresolved exceptions.
AI-generated editorial illustration. Not footage of an actual affected organization.
01 / Vendor accountability
Make the service promise hold up at 3 a.m.
Show us the last tested after-hours escalation, who had authority to contain the incident, and which systems your contract excludes.
Evidence to request
Every in-scope system has a documented service owner; unresolved exclusions and escalation gaps have an owner and a decision date.
See the review scope →02 / Identity & access
Know who can get in. Prove you can remove them.
Show us every vendor and application identity with privileged access, its owner, and the last successful test of revoking it.
Evidence to request
Privileged identities have accountable owners, defined scope and a documented method to revoke access; exceptions have explicit approval.
See the review scope →03 / Clinical continuity
Protect the work that happens in the exam room.
Show us how patient intake and clinical access continue when this vendor is unavailable, and the date that workflow was last exercised.
Evidence to request
Critical workflows have named owners, documented dependencies and an agreed downtime path; missing vendor evidence is tracked to resolution.
See the review scope →04 / Public safety resilience
Keep an administrative problem out of the dispatch room.
Show us the approved evidence that municipal administration and vendor support cannot bypass the dispatch network’s access boundaries.
Evidence to request
Mission-critical dependencies and vendor access paths have owners; readiness gates and outstanding risks are visible before project acceptance.
See the review scope →05 / Connectivity & recovery
A second circuit is useful only if the business can use it.
Show us a failover test that restored our actual critical applications, including the elapsed time and every shared dependency.
Evidence to request
Critical applications have an agreed failover target and a documented test result, or a recorded gap with an accountable remediation owner.
See the review scope →06 / AI governance
Buy useful capability with a boundary you can enforce.
Demonstrate which actions this AI cannot take, who approves exceptions, and how we stop it and revoke its access.
Evidence to request
Each in-scope use has an owner, permitted inputs and actions, an approval rule, and an evidenced way to stop or reverse work where feasible.
See the review scope →07 / Payment boundaries
Keep the payment environment clearly bounded.
Show us the payment-data flow, every remote-support path into it, and the evidence supporting your claim about our assessment scope.
Evidence to request
Payment flows and support paths are documented; scoping questions and missing evidence have owners before assessor review.
See the review scope →Before the next signature
Make the decision with someone on your side.
Start with the decision, the deadline and the evidence you need. We will define a practical scope from there.
Schedule a 20-minute scoping call →