Ask
Read each question to the provider word for word.
Listen
Compare their answer with the signals for each question.
Rate
Mark it strong, partial or weak. Your score updates live.
Contract & commitment
Set the terms of the relationship before anything else.
Question 1
“How long is the agreement, and what exactly does it cover?”
The agreement sets the foundation for everything else — scope, commitments and how the relationship works.
Strong answerAn annual agreement with a clear scope, published pricing and service commitments in writing — plus a written way out: a satisfaction exit early in the term, and the right to leave if commitments are missed and not fixed.
Walk away ifMulti-year lock-ins, vague scope, or an agreement that doesn’t spell out response commitments and what happens if you leave.
Question 2
“Who owns our data, documentation and admin credentials?”
If you leave, you need everything — passwords, network diagrams and licensing — handed over.
Strong answerYou own it all, it’s documented in an IT runbook you can access, and handover is part of the process.
Walk away ifVague answers, “proprietary” documentation or fees to release your own information.
Question 3
“How do you take over from our current provider?”
A messy transition is where outages and security gaps happen.
Strong answerA defined onboarding plan: they coordinate directly with your current provider, document everything and deploy their tools alongside before cut-over.
Walk away if“We’ll figure it out” — or expecting you to play go-between.
Response & support
How fast real help arrives — during the day, after hours and on-site.
Question 4
“How fast is the phone answered — and by whom?”
Speed means little if the first person can only open a ticket.
Strong answerAn engineer answers in under a minute during business hours, with measured, published numbers.
Walk away ifPhone trees, voicemail, call-backs or an offshore dispatcher.
Question 5
“What’s your response time on emailed or portal tickets?”
Most requests arrive electronically; they deserve a committed response, not just urgent calls.
Strong answerA real engineer responds within minutes during business hours, for every issue.
Walk away if“Within one business day,” or fast response only on premium tiers.
Question 6
“What happens after hours and on weekends?”
Outages and attacks don’t keep office hours.
Strong answerThe same local engineers on call 24×7 for emergencies, plus 24×7 network and security monitoring.
Walk away ifAfter-hours support billed hourly, or “monitoring” that only sends an email.
Question 7
“Are on-site visits included, and how quickly can someone get here?”
Some problems need hands on hardware.
Strong answerOn-site support for regular issues is included, from a local office nearby.
Walk away ifTrip charges, hourly on-site rates or a subcontractor you’ve never met.
Security & compliance
Your MSP holds the keys to everything. Make sure they guard them.
Question 8
“Which security tools are included in the base price?”
“Security add-ons” are how low headline prices turn into high invoices.
Strong answerA named stack — endpoint detection and response, 24×7 SOC, SIEM, vulnerability management, email security, MFA, DNS filtering and security awareness training — all included.
Walk away ifAntivirus only, or every security layer priced separately.
Question 9
“Has your own security been independently audited?”
An MSP holds the keys to your whole environment.
Strong answerYes — a SOC 2 Type II report from an independent CPA firm, available to review.
Walk away if“We follow best practices” or “SOC 2 compliant processes” with no report.
Question 10
“What exactly happens during a security incident?”
The first hour of an incident decides how bad it gets.
Strong answerA documented incident response plan, 24×7 containment by a SOC and clear communication to your leadership.
Walk away ifNo written plan, or incident response billed as an emergency project.
Question 11
“Can you support our compliance and cyber insurance requirements?”
Auditors, customers and insurers increasingly ask detailed security questions.
Strong answervCISO guidance, help with questionnaires and audits, and experience with frameworks such as CMMC, SOC 2, HIPAA and ISO.
Walk away if“That’s your responsibility,” or compliance help only as a separate consulting engagement.
Pricing & hidden costs
Find out how the provider really makes money.
Question 12
“How is pricing calculated — and is it published?”
You should be able to predict next year’s bill today.
Strong answerA simple per-user price, ideally published, that includes each user’s computer and mailbox.
Walk away ifPer-device, per-mailbox and per-site fees stacked on top of a per-user price.
Question 13
“What costs extra beyond the monthly fee?”
The answer tells you how the provider really makes money.
Strong answerA short, written list — typically licensing, hardware and clearly defined optional services.
Walk away ifOnboarding fees, “out of scope” hourly work, or new workstation setups and moves billed as projects.
Question 14
“How are projects quoted?”
Hourly projects put all the risk of overruns on you.
Strong answerA fixed-fee quote, agreed in writing before work starts.
Walk away ifOpen-ended time-and-materials estimates.
People & process
Who does the work, and how quality is measured.
Question 15
“Who will actually support us day to day?”
The sales team rarely does the work.
Strong answerA local team of engineers who learn your environment, with leadership directly involved and reachable.
Walk away ifA rotating call center, offshore tier-one or heavy subcontracting.
Question 16
“How do you measure and report on service quality?”
What isn’t measured isn’t managed.
Strong answerLive response metrics, satisfaction surveys on every closed ticket, and regular strategy meetings (vCIO) to review them.
Walk away ifNo reporting, or a quarterly PDF that no one reviews with you.
Question 17
“How many engineers support how many users — and what happens when you’re busy?”
A help desk staffed to exactly its average workload falls behind every busy Monday, every outage and every vacation.
Strong answerDeliberately staffed above the workload, with a written internal assignment target, published response numbers and a clear escalation path when things get busy.
Walk away ifVague answers about headcount, “it depends on the day,” or callback queues and voicemail during peak times.
Proof & track record
Evidence beats promises.
Question 18
“Can we read reviews and case studies from businesses like ours?”
Independent reviews are harder to fake than testimonials on a website.
Strong answerPlenty of recent Google and Clutch reviews, plus case studies in your industry.
Walk away ifOnly hand-picked quotes, or reluctance to share examples.
Question 19
“What happens if our main contact leaves your company?”
Your IT shouldn’t depend on one person’s memory.
Strong answerEverything is documented, the whole team knows your environment, and processes are audited.
Walk away ifKnowledge that lives only in one engineer’s head.
Question 20
“Have you grown by acquisition, been acquired, or are you planning to be?”
Acquisitions bring new account teams, new tools, price and contract changes, and less access to the people you chose.
Strong answerIndependent and grown organically, with the same founders and leadership running the company today.
Walk away ifA recent or pending acquisition, private-equity roll-up plans, or vague answers about who owns the company.
Our answers, in writing
How CAL IT Group answers the kit
Contract
A straightforward annual agreement with a clear scope, published pricing, no onboarding fee and service promises in writing — plus a 90-day satisfaction exit and the right to leave if we miss our promises.
Response
An engineer on our local Huntington Beach team answers 96%LIVE of calls in under 60 seconds, and every email or portal ticket gets a real engineer within 20 minutes (Mon–Fri, 5 AM–6 PM).
Coverage
Service desk staffed Monday–Friday 5 AM–6 PM — not 8 to 5 — the same local team on call 24×7 for emergencies, with 24×7 NOC & SOC monitoring and on-site support included.
Security
SentinelOne MxDR, 24×7 SOC, managed SIEM, Qualys vulnerability management, email security, MFA, DNS filtering, DefensX browser security and security awareness training — all included.
Audited
SOC 2 Type II across all five Trust Services Criteria, attested by an independent CPA firm.
Pricing
Published online: one per-user price that includes each user’s computer and mailbox. We never bill extra time to support your existing environment, and projects are fixed-fee.
People
Every engineer is technically assessed by our co-founders, Kevin Nichols and Joe Kemp, and background-checked. Our culture.
Proof
Rated 5.0 on Google and Clutch, with case studies across industries.
Ask us these questions on a call See our pricing Download the kit (PDF)