How do I know if my MSP is doing its job?

Ask for evidence instead of reassurance. A good outside IT company (MSP) can show you what's protected, how fast tickets get handled and what your contract covers, and if yours can, it's probably doing its job.

Most MSPs aren't bad. Most MSP relationships are unmanaged, and most gaps come from scope nobody wrote down, not from bad intent. These checks give you something specific to talk about.

Seven things to ask for

1. A device list. Every desktop, laptop and server, showing that each one is managed, patched and protected.
2. MFA status. Is it on for every user and admin? Who's excluded, and why?
3. Proof of your last restore test. A backup job that ran isn't the same as a backup that restores. Ask whether Microsoft 365 is covered too.
4. A 90-day ticket report. Compare response and resolution times to your agreement, and look for the same issues repeating.
5. Your license list. Compare it to active users. Are you paying for people who left?
6. Your documentation. Do you own your admin credentials, network diagram, asset list and vendor list?
7. Your incident response plan. If something goes wrong, does your team know who to call and what happens next?

Good signs

• They meet with you on a set schedule and bring real guidance
• They explain things in plain English
• They tell you about problems before you find them
• They send the reports without getting defensive

Signs it's worth a closer look

• You sign the invoice every month and couldn't say what it covers
• Tickets sit for days and nobody tracks how long they take
• You only hear from them when something breaks or the contract renews
• You're answering your cyber insurance application on their word alone

How to bring it up

Keep it simple: "We want to make sure we're getting full value. Can you send these reports and walk us through them?" A clear, specific conversation fixes most gaps, and replacing your MSP is rarely the first step.