How to Choose a Managed IT Service Provider: Minimums and Contracts

Here is how to choose a managed IT service provider: before any sales call, check three things. First, the provider's stated minimum engagement. Second, whether it already works for firms in your industry. Third, whether its contract says who owns each security duty, as the joint CISA advisory on MSPs recommends. Every provider promises 24/7 support, so that promise tells you nothing. These three checks show real differences, and you can confirm them from a profile and a draft contract.

Updated November 2026. Edverise listing figures were read on 28 October 2026.

Most buyers compare proposals on help desk hours and response times. Those are the easiest things for a provider to promise and the hardest for you to test before you sign. The listing data and a government advisory give you two harder tests.

What 13,100 managed IT listings say about minimums

As of October 2026, about 13,100 firms are listed on Edverise under Managed IT Services. The directory's search count stops at 10,000, so that figure is rebuilt from the minimum-project-size bands. Every listing in the category falls in exactly one band, and the bands add up to 13,063. Here is how those floors are spread:

Stated minimum project size, Managed IT Services listings on Edverise, as of October 2026

Stated minimum	Firms listed	Share of the category
No minimum ($0)	4,097	31.4%
$1,000	4,752	36.4%
$5,000	2,230	17.1%
$10,000	1,064	8.1%
$25,000	453	3.5%
$50,000	245	1.9%
$75,000	35	0.3%
$100,000	117	0.9%
$250,000	70	0.5%

Two readings matter for a buyer. The largest single group sets a $1,000 floor, not zero. Together, the no-minimum and $1,000 bands hold 67.7% of the category. That is a market open to a 40-person firm. At the other end, only 15.2% of listed managed IT firms set a floor of $10,000 or more. Only 1.4% set $100,000 or more, and those firms are built for enterprise estates, not a single office.

Managed IT is also less open-ended than the rest of the catalogue. Across Edverise's 1,249 service categories, the median share of firms stating no minimum is 57.4%. In managed IT it is 31.4%. That fits the work. An MSP takes on monitoring, patching and help desk duty for months at a time, and few will do that for any fee you name. The general pattern is covered in the post on agency minimum project size. What it means here is plain. If a provider says it has no minimum, ask what the smallest contract it signed last year looked like.

How much should managed IT services cost?

Managed IT services cost what the scope requires, and the listing data cannot give you a monthly price. A stated minimum is the smallest engagement a firm says it will take on. It is not a per-user rate, and many MSPs quote per user or per device after an assessment. Public per-user figures come almost entirely from MSPs' own marketing pages, and none of the pages ranking for this query publish one with a source. So treat any quote as something to normalize. Ask each bidder to price the same user count, device count and service list. Then compare line by line.

Check industry fit before you check certifications

The industries managed IT providers name on their profiles show where experience is deepest. As of October 2026, 3,461 managed IT listings name information technology as an industry served. Another 3,030 name business services, 2,938 name financial services and 2,930 name medical. Manufacturing (2,074), ecommerce (2,005) and education (1,631) follow. A firm usually names several industries, so these counts overlap and cannot be added up or turned into shares.

Industry fit matters more for an MSP than for most vendors because the provider will operate your regulated tools day to day. A medical practice needs someone who knows its records system and its privacy rules. A finance team needs someone who has handled audit requests. A professional services firm needs someone who understands document management and client confidentiality. Legal is not among the eight industries named most often in this category. A law firm should therefore filter harder and ask for a reference from another practice.

How to choose a managed IT service provider in four checks

The checks below work in order. Each one removes bidders before you spend an hour in a demo.

1. Pick the service model first. Fully managed IT means the provider runs everything, from help desk to licensing. Co-managed IT means it works alongside your own staff, often on security or after-hours cover. On-demand means project work with no standing retainer. A firm whose part-time IT person is retiring usually needs fully managed IT. A firm keeping an internal administrator may only need co-managed cover.
2. Match the minimum to your size. Read the stated floor on each profile. A provider whose smallest engagement is many times your budget will either decline or give you its least experienced team.
3. Confirm industry experience with a reference. Ask for one current client in your industry and of similar headcount, and call them.
4. Read the contract before the proposal. The proposal tells you what the provider hopes to do. The contract tells you what it owes you, and that is where most providers differ.

Co-managed IT vs fully managed IT

Co-managed IT suits a company that already has someone who knows its systems and wants to keep that knowledge in-house. Its weakness is the boundary between the two teams. When a laptop is compromised at 2 a.m., both sides can believe the other one was watching. If you choose co-managed, the responsibility matrix in the next section matters twice as much, because there are two parties to name in every row.

If the gap you need to fill is security monitoring rather than day-to-day support, look at managed security services, which Edverise lists as a separate category with 181 firms as of October 2026. Some buyers pair a small internal team with one of those instead of a full MSP.

What a managed IT services contract should include, from CISA's advisory

In May 2022, CISA, the NSA and the FBI published an advisory with cyber agencies from the UK, Australia, Canada and New Zealand. It was titled Protecting Against Cyber Threats to Managed Service Providers and their Customers. Most of its customer advice is written as things a contract should require. No MSP's own guide on this query turns it into a checklist, so here it is.

Contract clauses drawn from CISA advisory AA22-131A

Clause	What the advisory says	What to ask the provider for
Responsibility split	The contract should specify whether the MSP or the customer owns duties such as hardening, detection and incident response.	A one-page matrix naming the owner of each duty
Logging and visibility	Contracts should require security event monitoring and logging of provider-managed systems, and give the customer visibility into it.	Which logs you can see, for how long, and in what form
Multi-factor authentication	Contracts should require MFA to be enforced on all MSP accounts used to access customer environments.	A written statement that every technician account uses MFA
Backups	Customers should require a backup that runs automatically and continuously, stored somewhere easy to retrieve, such as cloud storage or an air-gapped location.	The backup schedule, where copies sit, and the date of the last restore test
Incident response	Contracts should include incident response and recovery plans that are tested at regular intervals.	The plan itself and the date it was last exercised
Incident notification	Contracts should detail how and when the MSP notifies the customer of an incident affecting its environment.	A notification deadline and a named contact, in writing
Account privileges	MSP accounts should not sit in internal administrator groups and should reach only the systems the MSP manages.	A list of the provider's accounts and what each can reach
Termination	Customers should disable MSP accounts that no longer manage their systems, which is easy to miss when a contract ends.	An offboarding schedule that includes account removal

Managed service provider security responsibilities in the contract

The responsibility split is the clause worth fighting for. The advisory also tells providers to explain clearly what the customer is buying and to name the services the customer is not buying. A provider that cannot list what falls outside its scope is leaving you to find out during an incident. Patch management and backup and disaster recovery are the two duties most often assumed rather than written down. Put both in the matrix by name.

Why an MSP's access is the risk you are buying

An MSP holds administrator access to every system it manages, often for dozens of clients through the same remote tools. In July 2021, attackers exploited a flaw in Kaseya's VSA remote management software and pushed ransomware through MSPs to their clients. CISA's guidance for affected customers told them to keep air-gapped backups, enforce MFA on every account and fall back to manual patching. Kaseya said fewer than 60 of its own customers were hit, but The Record reported Kaseya's estimate of fewer than 1,500 downstream businesses affected. One remote tool, a few dozen providers, and well over a thousand companies affected: that is the shape of MSP risk.

The strongest case against all this runs as follows. A 40-person firm cannot negotiate a custom contract with a provider whose floor is $1,000, and a responsibility matrix is enterprise paperwork. That case is half right. You will not rewrite a small provider's master agreement. But a matrix, a notification deadline and an account list are not custom terms. A competent provider already has them, and one that cannot produce them in a week has told you something.

Few small buyers ask at all. The UK government's Cyber Security Breaches Survey 2025/2026 found that 22% of small businesses and 30% of medium businesses review the cyber security risks posed by their immediate suppliers. For an MSP, the supplier is the one holding your admin keys.

What SOC 2 and Cyber Essentials prove, and what they don't

Certifications answer a narrower question than buyers assume. A SOC 2 report is an auditor's examination of a service organization's controls. The AICPA organizes it around security, availability, processing integrity, confidentiality and privacy. Ask which of those the report covers, whether it is Type 1 or Type 2, and which dates it covers. A report that covers only the provider's own office, not the tools it uses on your network, tells you little.

In the UK, Cyber Essentials is the government-backed baseline. It covers five controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus checks the same controls through independent technical testing. Either one is worth asking for, but neither replaces the contract clauses above. A certified provider can still leave incident notification undefined.

Switching managed IT service providers: a checklist for the exit

Write the exit into the contract before you need it. None of the guides ranking for this query cover termination, yet a weak exit is what keeps buyers stuck with a provider that disappoints. Ask for these in writing:

• Who owns the domain registrar account, the cloud tenant and the software licenses. They should be in your company's name, with the provider added as an administrator.
• A current network map, password vault export and system documentation, handed over at termination.
• Removal of every provider account and remote-access agent, as CISA's advisory advises, with written confirmation.
• The notice period, any early-termination fee, and what the provider must do during the handover.

If you are replacing a provider rather than an in-house person, use this list in reverse. Get the outgoing provider's handover done before the new one starts. Then have the new provider confirm that the old provider's accounts are gone.

Red flags in a managed IT provider's proposal

Some proposals tell you what is missing by what they avoid. Watch for a price with no list of excluded services, the gap the CISA advisory asks providers to close. Watch for a backup promise with no restore test date, and for an incident response plan the provider will show only after you sign. Be wary of a contract that leaves admin accounts and licenses in the provider's name. And be wary of an MSP that gets vague when you ask whether its technicians use MFA on your systems.

Frequently asked questions

How do I choose a managed IT service provider?

Choose a managed IT service provider by checking three things before any demo: whether its stated minimum fits your size, whether it serves firms in your industry, and whether its contract names who owns each security duty. Then ask for a reference of similar headcount. Response-time promises matter less, because nearly every provider makes the same one.

What should a managed IT services contract include?

A managed IT services contract should include a responsibility matrix, MFA on all provider accounts, a backup and restore schedule, and a tested incident response plan. It should also set an incident notification deadline and say what happens at termination. The joint CISA advisory on MSPs, AA22-131A, recommends each of these as a contract term.

What is a typical minimum for a managed IT provider?

The most common stated minimum among managed IT firms listed on Edverise is $1,000, set by 36.4% of the category as of October 2026. Another 31.4% state no minimum. A minimum is the smallest engagement a provider says it will take on, not a monthly per-user price, so compare quotes on the same scope.

What questions should I ask an MSP before signing?

Before signing with an MSP, ask who owns each security duty, which provider accounts can reach your systems, and whether all of them use MFA. Ask when backups were last restored and how quickly you will be told about an incident. Ask what you receive at termination, and request a reference client in your industry.

Is co-managed IT better than fully managed IT?

Co-managed IT is better when you already have an internal IT person you want to keep. Fully managed IT is better when you have no one. Co-managed arrangements carry more boundary risk, because two teams share the work. Write down which one owns each duty, especially monitoring and patching outside business hours.

Does a SOC 2 report mean an MSP is secure?

A SOC 2 report means an auditor examined the MSP's controls against the AICPA criteria for the scope and dates in the report. It does not mean every system it uses on your network was covered. Read the scope section, check whether it is Type 1 or Type 2, and still insist on the contract clauses.

Start with the shortlist, then the contract

Filter the managed IT services listings on Edverise by minimum project size and industry served, and you will have a shortlist of providers built for a firm your size. Send each of them the eight-row clause table above with your request for a proposal. The ones that return a completed responsibility matrix are the ones worth a meeting.