Choosing a managed service provider (MSP) is one of those decisions that looks simple from the outside and gets harder the closer you look — every provider’s website says roughly the same thing about proactive support and expert teams. The differences that actually matter show up in the details: how they measure response times, what they will and will not put in writing, and what happens the first time something goes seriously wrong.
This guide covers what to evaluate, the red flags that matter more than price, and how to run the evaluation process so you are comparing providers on substance rather than sales pitch.
What is a managed service provider
A managed service provider takes on ongoing, proactive management of your IT systems for a fixed monthly fee, rather than billing per incident. That includes monitoring, patching, cybersecurity, and helpdesk support, and typically extends to strategic planning and disaster recovery. The distinction that matters in practice is proactive versus reactive: an MSP’s fee structure gives them a direct incentive to prevent problems rather than bill for fixing them.
For a closer, practitioner-level look at what this involves day to day, see our guide to what an MSP actually does.
The criteria that actually separate providers
Most shortlists come down to five things. Everything else is detail underneath these.
Scope matched to your actual needs
Before comparing providers, get clear on what you need: cybersecurity, cloud management, disaster recovery, compliance support, or some combination. A provider offering a wide service range is only useful if it overlaps with what your business actually requires — evaluate against your needs first, then check fit, rather than being sold on a feature list you will not use.
Start with an honest inventory: how many devices and servers, how many users, which line-of-business applications you cannot afford to lose, and which industry regulations apply to your data. This list is what you compare every provider’s proposal against — without it, a proposal is just a list of features with no way to judge whether they are the right ones.
Documented response times and SLAs
Ask for the provider’s service level agreement in writing, not a verbal assurance. It should state response and resolution targets by priority level, and — just as importantly — the provider should be able to show their actual performance against those targets, not just the target itself. A provider that will not share real numbers is telling you something.
Security and compliance built in, not bolted on
MFA, endpoint protection, regular patching, and compliance support for standards relevant to your industry should be standard inclusions, not upsells you have to negotiate for separately. If your business handles regulated data — legal, finance, insurance, health — ask specifically how the provider supports the compliance obligations that apply to you.
A verifiable track record
Ask for references you can actually call, not just quotes on a website. A provider with a genuine track record will connect you with an existing client in a similar industry or size bracket without hesitation. Hesitation on this point is itself useful information.
Scalability and industry fit
Your IT needs in three years will not match today’s, and a provider whose services cannot flex with growth becomes a problem later rather than now. Industry experience compounds this: a provider who already understands the compliance rules and workflows common in your sector will be faster to onboard and less likely to make avoidable mistakes.
MSP evaluation scorecard
Score each shortlisted provider out of 100 against these five weighted criteria, then compare totals side by side rather than relying on gut feel after a sales call.
| Criterion | Weight | Full marks only if |
|---|---|---|
| Documented SLAs and response times | 25 | They supply written response and resolution targets by priority level, plus actual performance data against them, not just the target. |
| Security and compliance built in | 20 | MFA, patching, and relevant compliance support are standard inclusions, not upsells you negotiate for separately. |
| Verifiable track record | 20 | They connect you with a reference client in a similar industry or size bracket within a day or two, without hesitation. |
| Scope matched to your needs | 20 | Their proposed services map directly to the device, user, and compliance inventory you documented before contacting them. |
| Exit terms in writing | 15 | Data portability, documentation handover, and notice periods are confirmed in writing before you sign, not after you need them. |
Score interpretation: 80 to 100 means shortlist with confidence. 60 to 79 is workable but negotiate the gaps before signing. Below 60 is a red flag zone, keep looking regardless of price.
What questions get you a real answer, not a sales answer
| Question to ask | What a vague answer sounds like | What a real answer sounds like |
|---|---|---|
| What is your average response time? | “We respond quickly” | An actual figure, with a source (ticketing system report, not a claim) |
| Can I speak to a current client? | “We’ll send you a testimonial” | A direct introduction, arranged without delay |
| How often do you test backup restores? | “Backups run every night” | A stated testing cadence with evidence from the last test |
| What happens if we want to leave? | “That won’t be an issue” | A written exit clause covering data portability and timeframes |
Red flags worth walking away from
- Vague or undefined SLAs. If response times are described in general terms rather than committed to in writing, treat that as the actual answer.
- No test restores. A provider offering backup without ever testing a restore is offering unverified insurance.
- Reluctance to share references or reporting samples. A confident provider shows you real reports, not descriptions of what reports could look like.
- Unclear exit terms. Ask what happens to your data and access if you switch providers, and get the answer before you sign, not after you need it.
What should I ask an IT provider about cyber security before hiring them?
Ask for specifics, not reassurance. “We take security seriously” is not an answer, and a provider who cannot get more specific than that under a direct question is telling you something. The table below covers six questions that separate a provider with real security controls from one that is only describing intentions.
| Question to ask | Why it matters |
|---|---|
| Is multi-factor authentication enforced on every account by default, or optional? | A stolen password should not be enough on its own to open email or your core systems. “Optional” or “we recommend it” is a materially weaker answer than “enforced.” |
| Do you run endpoint detection and response, or antivirus alone? | EDR watches for ransomware behaviour on a device. Antivirus alone is signature-based and misses new attacks by design, not by accident. |
| When did you last test a full restore from backup, not just confirm the backup job ran? | A backup nobody has restored from is not a backup. Ask for the date of the last test, not a description of the backup schedule. |
| Do you keep an offline or immutable copy of our backups? | A backup an attacker can also reach and encrypt is not a recovery path, it is a second copy of the same problem. |
| What is your incident response plan, and has it been tested? | The first hour after a suspected compromise decides most of the damage. A written plan that has never been rehearsed is a document, not a capability. |
| Do you hold or support a recognised security certification such as SMB1001 or ISO 27001? | A certification a director attests to annually is evidence you can show your own insurer or a corporate client, not just a claim on a website. See what to look for in any provider’s certifications for the full checklist. |
None of these six questions is specific to any one industry. A law firm, an accounting practice or an ordinary SMB should all expect the same six real answers, in writing, before signing.
How to run the evaluation process
- Assess your own needs first. Document your current environment, pain points, and compliance obligations before contacting any provider — this stops you being sold a solution to a problem you do not have.
- Shortlist on scope and SLAs, not price alone. Compare providers against the criteria above before comparing quotes, so price differences are meaningful rather than reflecting different levels of coverage.
- Call the references. Ask specifically about response times in practice, how the provider handled a real incident, and whether reporting matches what was promised.
- Ask what the first 90 days look like. A provider with a documented onboarding process, not an improvised one, is a strong signal for how the rest of the relationship will run. See our guide to the first 90 days with a new IT provider for the milestones worth demanding.
- Negotiate the exit terms before you sign, not after you need them. Confirm in writing what happens to your data, documentation, and admin access if you switch providers later, and how much notice either side needs to give. This is the clause that gets skipped under time pressure and matters most when a relationship has already gone wrong.
A provider who has been through this process from the other side — onboarding a client who is unhappy with their previous MSP — will usually be direct about what that transition actually involves. Ask them to walk through a real example rather than describing the process in the abstract.
If you are specifically comparing providers in Christchurch, our IT services Christchurch comparison guide covers local-market criteria — response times, local presence, and a side-by-side scorecard — in more depth than fits here.
How managed services work day to day
Understanding what a provider is actually supposed to be doing behind the scenes makes it easier to judge whether they are delivering on the SLA you signed. A properly run managed service follows a consistent day-to-day pattern, not just a response to whatever comes in.
Setting outcomes and monitoring
The relationship starts with agreed targets for response and resolution, then remote monitoring and management (RMM) tools are deployed across your devices, network, and cloud systems. These tools run continuous health checks, raise alerts before a fault becomes an outage, and log events for compliance reporting. Routine patching and scheduled maintenance windows should already be running in the background, not triggered by a complaint.
Support, escalation, and review
Day-to-day helpdesk requests get triaged and resolved against agreed priorities, with on-site support available when a remote fix will not cut it. Behind that, your provider should be reporting on key performance indicators, maintaining a risk register, and running quarterly reviews so IT stays aligned with what your business actually needs, not just what broke last month.
How to choose an MSP: frequently asked questions
What is a fully managed IT service?
Fully managed means the provider handles all aspects of your IT environment, from daily support through to long-term planning, effectively acting as your outsourced IT department. Compare this against co-managed IT, where an external provider works alongside an internal team rather than replacing it.
What is the difference between IT services and managed services?
Traditional IT services are typically reactive — a provider that helps when something breaks. Managed services are proactive, with a fixed monthly fee covering ongoing monitoring and maintenance intended to prevent problems before they happen. See our full IT support guide for how the two models compare on cost and outcomes.
How much should managed IT services cost?
Pricing usually runs per user, per device, or bundled into a flat monthly fee, and varies with the scope of security and compliance coverage included. Our 2026 managed IT pricing guide covers NZ benchmark ranges by business size.
What questions should I ask on the first call with a provider?
Ask exactly what is included and excluded from the plan, how onboarding and escalations work, and whether they can share sample reports and asset registers. A provider who answers these directly and specifically, rather than in general terms, is worth shortlisting.
How long should it take to switch to a new MSP?
A properly run onboarding typically takes 30 to 90 days depending on environment complexity, and should follow a documented plan rather than being figured out as it goes. Our first 90 days guide sets out what should happen at each stage.
Which managed IT provider is best in New Zealand?
No credible answer to this exists on any single provider’s website, including this one, because every provider has an obvious incentive to name itself. What actually works instead is scoring two or three shortlisted providers yourself against fixed criteria: documented SLAs and response times, security and compliance built in, a verifiable track record you check by calling the reference yourself, scope matched to your needs, and exit terms in writing, then comparing the totals.
Two sources are worth more than any single vendor’s claim. Ask each shortlisted provider for a current client reference in a similar industry or size bracket, and call it. Then check independent, provider-neutral signals for each one, such as their Google Business Profile review history over time, not just the star rating on the day you look. A provider that scores well on the framework above and produces a real reference without hesitation is, in practice, as close to “best for your business” as an honest answer gets.
Choosing an MSP with OxygenIT in Christchurch
OxygenIT is Christchurch based and has operated here since 2005. We are ISO 27001 and ISO 42001 certified, and we run a single-provider model covering managed IT, cybersecurity, professional services, and infrastructure under one accountable contract. We publish our own numbers as the benchmark to evaluate us against: a sub-11-second average phone response during business hours, a 98% client retention rate, and a 90 day money back guarantee covering our own fees on any new engagement.
Contact us if you would like to discuss how tailored IT support can fit your business, or call us on 0800 101 095.
Ready to stop comparing and start getting reliable support? Explore our managed IT services in Christchurch.
