Outsourcing your day-to-day technology management responsibilities to a Managed Service Provider (MSP) may be a good strategy for improving service levels and cutting costs. Evaluating a Managed Service Provider should not be taken lightly. Your new partner will have access to your systems and will directly affect the service levels you provide to your customers.
Here are 10 areas to consider when evaluating providers.
#1 – Services
Do they offer ALL of the services that you need?
Do they have a formal services delivery methodology?
Have they implemented ITIL (Information Technology Infrastructure Library) or some equivalent approach? [updated 10/28/2014]
Are they meeting their current Service Level Agreements (SLA’s)? Do they have the bandwidth?
Do they have formal processes for Project Creation, Project Management, Operations, Incident Response, Escalation, etc.?
Is everything documented? Logged? Tested?
Do they provide services when you need them? Multiple Time Zones, Holidays, After-hours, etc.
Do they have a Network Operations Center (NOC) or equivalent?
Do they have any Self Service tools (Ticketing, Knowledge Base, etc)? Get a demo!
Do they have any sales materials or other analysis comparing the cost of their services to in-house solutions? [added 10/28/2014]
#2 Engagement
How do they begin the engagement? What level of participation is required by your staff?
How will they gain access to your environment?
Who is responsible for the Service / Systems Catalog?
How is Change Control managed? Documentation? Reporting? Approvals? [updated 10/28/2014]
How is Configuration Management managed?
What reports do they generate? How often? Get a sample!
How much control do you retain over the infrastructure? Get specific!
#3 – Business Health and Customer Base
How long have they been in business?
Are they growing?
Are they investing in their business?
Who are the principals in the business? History?
Any positive or negative press?
Are their customers staying with them?
What is the average life of an account?
What reasons have the last few customers given for leaving?
Can you speak with several current and past customers?
Do they compete with you in any markets?
Are they providing services to your competitors or other companies in your vertical or industry? [updated 10/28/2014]
Will they provide any financial information demonstrating the health of the business? [added 10/28/2014]
#4 – Staff
Do you require the MSP to have Domain expertise or Subject Matter Experts (SME)?
How large is the staff? Can they share the organizational structure with you?
Do they have open positions? Are they adequately staffed? [added 10/28/2014]
How long have their project managers, engineers, and support staff been with them?
What certifications do they have and when was the last certification awarded?
Is the staff in the office daily, virtual, etc?
Is the staff willing to come to your office to render services?
Are they full-time employees or sub-contractors?
Will you have dedicated sales, support, and engineering people that know your account?
#5 – Culture, Integrity, Approach, and Knowledge
Will your staff get along with these people?
Can your staff communicate effectively with the outsourced team? Do they speak the same language?
Do they do business in a manner that fits well with your organization?
Is integrity an important part of the MSP’s culture? Ask them for direct examples.
Do they have a Knowledge Base? Do you have access? Will they use your tool?
#6 – Partnerships
Are they partnered with product and service companies?
Are the partnerships in alignment with your technology roadmap? Does this bring you added value?
Can you leverage their partnerships to further optimize your business and reduce costs?
Do they resell hardware and software?
Do they have partnerships with Telecommunications companies?
How about colocation, hosting, and other outsourced infrastructure?
Do they outsource any of their core services to third parties?
At any point, do they register your company with any of their third party relationships? Is there any “lead” sharing?
#7 – Security, Confidentiality, and Governance
How do they safeguard your confidential information and systems?
Who has access? Physical and Logical?
Do they run background checks on all individuals with access to your confidential information and systems? [added 10/28/2014]
How will the MSP access your physical assets? [added 10/28/2014]
How will administrative accounts on third party services be managed? [added 10/28/2014]
Do they have a Security Operations Center (SOC) or equivalent?
Is everything (General Computer Controls) documented? Logged? Tested?
Are they ISO, SSAE-16, HIIPA, or PCI certified?
Have they been audited by a Qualified QSA? If so, when?
Do they have a Business Continuity and Disaster Recovery Plan?
#8 – Facilities and Infrastructure
Can you spend a day in their facility?
Does the facility need to be local to you?
Do they have the necessary technology to guarantee their ability to provide you with services?
Do they have expertise in fault tolerance and redundant infrastructures? Have they implemented these technologies and related best practices in their own environment? [added 10/28/2014]
Do they have a lab environment with equipment that represents some or all of your infrastructure?
#9 – Contracts
Is the pricing clear and detailed?
Do they require a long commitment?
Do they have the appropriate levels of insurance?
Do they guarantee confidentiality?
Do they indemnify you of any harm?
Do they guarantee Service Levels?
Do they offer a performance based agreement? [added 10/28/2014]
Do they have penalties for failure to meet SLA’s or provide services?
Do they guarantee Reporting and Transparency?
Is there a clear mechanism to track performance and enforce accountability? [added 10/28/2014]
Does the contract prohibit them from hiring your staff?
Do you own all of the documentation, processes, knowledge base, etc?
#10 – Billing
How do they track services? What supporting evidence is available and/or provided?
Are you paying for “On the Job Training”?
Will they give you a real bill from a real customer? If not, examples?
Are they charging different rates for different people, functions, and skill levels?
Can they give you actual hours billed for five or six special projects?
Conclusion
As you can see, evaluating Managed Service Providers requires a lot of discussion, fact gathering, analysis, and judgements. Selecting a Managed Service Provider is a long term relationship. Invest the time upfront to mitigate issues in the future.