Buyer's Guide · Free Resource

How to Evaluate an IT Vendor Before You Sign

10 questions to ask before signing an MSP contract, what the red flags actually mean, and what a fair contract looks like. Save this page or print it (Ctrl/Cmd+P).

What's your average response time for a critical issue — in writing?

A verbal promise isn't an SLA. Get the number in the contract.

Flat monthly fee, or hourly/reactive billing?

Reactive billing means every problem is also an invoice — incentives don't point toward prevention.

What's included versus billed separately?

The most common source of "surprise invoices" is a vague scope, not bad faith.

Can you name 3 current clients in my industry I can call?

Industry experience that can't be verified with a real reference isn't experience yet.

What does onboarding actually look like — timeline and what you need from us?

A vague answer here usually means an equally vague first 90 days once you sign.

Who actually does the work — your team, or subcontractors?

Know who has hands on your systems, not just who's on the sales call.

What happens to our data and access if we switch providers later?

Ask this before you sign, not on the way out the door.

Do you carry your own liability / errors-and-omissions insurance?

If something they manage goes wrong, this determines whether there's any recourse.

What compliance frameworks have you actually implemented for clients?

"We know HIPAA" and "we've built and documented HIPAA Security Rule programs for practices like yours" are very different claims.

What's your average client tenure — and can I talk to someone who left?

A vendor confident in their retention will let you ask. One who deflects is telling you something too.

Red Flags

No written SLA — response times are "usually" or "typically"
Reluctant to share references, or only offers ones they hand-pick without context
Hourly billing with no cap or estimate
Can't clearly explain what happens to your data on offboarding
No cyber liability insurance of their own

General NY Metro Market Pricing (directional only)

Basic managed IT, per user/month~$100–150

Compliance-tier managed IT (HIPAA/SEC/FINRA-aligned), per user/month~$150–250

Fractional vCIO/vCISO engagement, monthly~$1,500–4,000+

General market ranges, not a P-Bon Consulting quote — actual pricing depends on environment complexity, headcount, and compliance requirements. Ask any vendor you're evaluating for a number specific to your firm.

This page is yours to keep — bookmark it, print it, or bring it to your next vendor call.

Free Consultation

Already Have a Vendor? Get a Second Opinion.

Book a free 30-minute Risk Review. Wlad will tell you honestly whether your current setup holds up — even if that doesn't point to switching.

Schedule My Free Risk Review →

Questions first? Send us a message or call (516) 734-1515