Before hiring a managed service provider, ask how it will keep your staff working, protect access to sensitive systems, and recover the information your business depends on. Ask for clear service boundaries, response commitments, escalation steps, and a transition plan you can review in writing. Then test the answers against a real workday, not a sales presentation.
What happens when a normal workday depends on a system that stops working?
Start with a familiar interruption. A clinician cannot open a patient record, a receptionist cannot check in the next person, or a billing specialist cannot submit a claim. Ask the provider to walk through what happens from the first report to restored work.
Who can contact support, and how? Does the provider distinguish a single-user problem from an outage affecting a whole office? Who decides when to escalate, and how will staff receive updates if the usual phone or email channel is unavailable?
Ask for the service agreement's response targets and definitions. Response time is not the same as resolution time. Find out whether the target changes by severity, support channel, time of day, or whether the affected system is used by one person or many.
Clarify what is included in the monthly service and what triggers separate project work or fees. Ask how the provider handles recurring incidents, after-hours requests, and issues that involve a software vendor or internet carrier. If a third party owns the fix, who keeps your staff informed and tracks the case?
Ashlee, a commercial real estate client, described GDS Technology this way: "GDS Technology answers every question we throw at them and actually follows through to solve it. You get real answers, not deflection, and the problem gets fixed, not just talked about. They make it easy to bring them anything and walk away with a result." For any provider, ask for a reference who can speak to communication and follow-through, not only technical knowledge.
Ask for written response targets, escalation steps, and update expectations before you compare monthly fees.
Support is only useful when people know how to reach it and what will happen next.
How will the provider fit support around our actual workflow?
Do not settle for "we support healthcare" or "we support professional offices." Ask the provider to explain how it learns which systems staff use, when they use them, and which interruptions delay the next task. For a medical office, that might mean understanding the relationship between scheduling, electronic health records, imaging, billing, phones, and printers.
Ask how the provider documents applications, devices, user roles, and vendor contacts. Find out who confirms the information is accurate and how changes are recorded when staff join, leave, or change responsibilities. A support team that has to rediscover the setup during each outage can lose time while employees wait.
For legal practices, ask how support accounts for document management, case or matter systems, remote access, and the handoff between attorneys and support staff. For accounting firms, ask how it plans around seasonal workload and access to tax or client-file systems. These are questions about fit, not a claim that one technical design works for every organization.
Ask what the provider needs from your internal team. Which decisions require an owner or operations lead? Who approves access changes, software purchases, and planned downtime? If a change could affect a clinical, billing, or client-facing workflow, ask how the provider identifies the affected users and coordinates the timing.
GDS Technology serves organizations in multiple locations nationally, and its offices are in Norcross, Georgia and Carmel, Indiana. If your organization has several sites or remote staff, ask how the provider will deliver consistent support across them and what work requires an on-site visit. See the IT help desk service for an example of the support function to discuss.
A useful answer connects technical support to the work people need to complete.
What should we ask about sensitive information, access, and compliance?
Ask the provider to explain how it manages user access from onboarding through departure. Who requests a new account, who approves its permissions, and how are unused accounts found and removed? Ask how privileged access, such as administrator accounts, is limited and reviewed.
For a healthcare organization, ask how the proposed service supports your own security and privacy responsibilities, including the safeguards your organization has determined apply. Do not assume that hiring an MSP transfers those responsibilities or makes the organization compliant. Ask what documentation the provider can supply for your review and what remains your organization's decision.
Ask how security events are reported, who contacts your organization, and what information is needed to decide whether an event affects operations or sensitive data. Clarify the provider's role in investigation and response, how evidence is handled, and how your leadership participates in decisions. Ask for the process in writing rather than relying on broad assurances.
Discuss backup and recovery as operating questions. Which information and systems are covered? How often are backups made, how long are they retained, and who checks whether recovery is possible? Ask when the last recovery test occurred, what was restored, and what the test did not cover. A backup plan is more useful when the business knows which work can resume first.
Review the IT compliance services and data backup and recovery services pages as starting points for questions about scope, documentation, and recovery responsibilities. Request a clear description of what is included in your agreement.
Security answers should name owners, evidence, and decisions, not promise that risk disappears.
How can we tell whether the proposal is complete and sustainable?
Ask the provider to separate recurring services from one-time onboarding, remediation, equipment, licenses, and project work. Request a written list of assumptions, exclusions, and charges that may change when staff counts, locations, or requirements change. If pricing is based on users, devices, or sites, ask how each is counted and how changes are approved.
Ask what the onboarding plan will produce. Useful outputs may include a verified inventory, documented system dependencies, named contacts, open-risk items, and a prioritized work plan. Confirm who supplies existing credentials and records, how access is transferred securely, and what happens if the outgoing provider delays information.
Ask how the provider will measure whether service is working. Request examples of the reports you will receive and ask who reviews them with you. Reports should help your team make decisions: identify repeat problems, overdue work, unresolved risks, and changes that need business approval.
Before signing, have the provider explain the exit process. Ask how you receive your documentation, configurations, data, and administrative access if the relationship ends. Clarify notice periods, transition assistance, data return or deletion, and any charges. A workable exit plan is part of a responsible service arrangement.
GDS Technology offers a 15-minute discovery call, which can be used to outline your environment and determine what questions need deeper review. Keep the conversation focused on your needs, and ask for any important commitment to be reflected in the written agreement.
A complete proposal makes responsibilities and future decisions visible before they become urgent.
What questions should we use in the final MSP interview?
Bring a short list and ask each provider the same questions. Request direct answers, examples, and written follow-up where the detail affects cost, risk, or operations.
- What is included in the recurring service, and what is billed separately?
- What are the response targets for different priorities, and how are they measured?
- How do we report an issue, receive updates, and escalate a stalled case?
- How will you learn our workflows, software dependencies, and vendor responsibilities?
- How are user access, administrator permissions, and staff departures handled?
- What backup coverage and recovery testing are included, and what is outside scope?
- What will onboarding document, and what do you need from us to complete it?
- How do you handle incidents involving a third-party application, carrier, or equipment vendor?
- What do service reviews cover, and who is responsible for decisions arising from them?
- What happens to our records, access, and data if we change providers?
Compare the substance of the answers, not the confidence of the presentation. The right provider should make it easier to see who owns each task and what happens when a dependency fails.
Frequently Asked Questions
What is the most important question to ask an MSP?
Ask the provider to walk through a realistic outage affecting a system your staff need to work. Listen for who receives the report, how urgency is assessed, who coordinates with vendors, how employees are updated, and how restoration is confirmed. This reveals the operating process more clearly than a broad promise of responsive support.
Should an MSP guarantee HIPAA compliance?
No provider should be treated as a substitute for your organization's compliance decisions and responsibilities. Ask how the proposed services support the safeguards your organization has identified, what documentation is available, and which tasks remain yours. Review the agreement and any relevant privacy or security documentation with the people responsible for compliance.
What should an MSP onboarding plan include?
Ask for a written plan covering discovery, access transfer, system and vendor documentation, open issues, priorities, and the people responsible for each step. Confirm what your team must provide and how unresolved risks will be recorded. The plan should show how the provider will learn the environment before relying on assumptions.
How do I compare MSP proposals fairly?
Give each provider the same description of your users, locations, key applications, support needs, and business constraints. Compare service boundaries, response targets, onboarding outputs, security responsibilities, recovery scope, exclusions, and exit terms alongside price. Ask providers to explain differences in writing so you can distinguish included work from assumptions.
