Choosing a managed service provider in Burnaby is not simply a comparison of monthly prices. The provider may receive administrative access to Microsoft 365, computers, servers, firewalls, backups and other systems that keep the business operating. The right questions should therefore test service quality, security, accountability and the provider’s ability to support change—not just how quickly someone answers the phone.

This checklist gives Burnaby business owners and operations leaders a practical way to compare providers. It is also useful when reviewing an existing IT relationship that has become reactive, poorly documented or difficult to measure.

1. What is included in the monthly service?

Ask each provider to define the service in operational terms. Does the agreement include helpdesk support, monitoring, patching, Microsoft 365 administration, endpoint security, vendor coordination, backup oversight and onsite visits? Which items are billed separately?

Clarify support hours, after-hours procedures and what qualifies as a critical incident. A phrase such as “24/7 monitoring” does not necessarily mean that users can call the helpdesk at any hour or that an engineer will automatically contain a security incident.

The proposal should also explain which users, devices, locations and cloud services are covered. If exclusions are necessary, they should be visible before the agreement begins.

2. How are response and resolution measured?

A useful service-level agreement distinguishes between acknowledgement, active response and resolution. A provider may respond to a ticket quickly while the underlying problem remains unresolved for days.

Ask how incidents are prioritized and what targets apply to each priority. Also ask for regular reporting that shows ticket volume, recurring issues, response performance and unresolved risks. The purpose is not to demand that every technical issue be solved instantly; it is to establish clear expectations and make persistent problems visible.

For Burnaby businesses that sometimes need onsite assistance, confirm the provider’s coverage model and how onsite work is scheduled when remote support is not enough.

3. Who owns the accounts, licences and documentation?

Your business should retain ownership of its domains, Microsoft 365 tenant, cloud subscriptions and important vendor accounts. Administrative access may be delegated to the provider, but the organization should not become dependent on credentials or subscriptions held only in the provider’s name.

Ask whether the provider maintains a current inventory of computers, servers, network equipment, applications, warranties, licences and administrative accounts. The Canadian Centre for Cyber Security recommends that small and medium organizations define which systems and assets are in scope and understand the value and risk associated with them.

Documentation should be updated during the relationship, not assembled for the first time when the contract ends.

4. How is privileged access secured?

An MSP can hold powerful access across many customer systems, so its own security practices matter. Ask whether technicians use named accounts, multi-factor authentication, least-privilege access and separate identities for administrative work.

Also ask how access is approved, logged, reviewed and removed when a technician changes roles or leaves the provider. Shared administrator passwords make accountability difficult and should not be the default operating model.

A joint cybersecurity advisory issued by Canadian, US, UK, Australian and New Zealand authorities encourages transparent discussions between MSPs and customers about protecting sensitive data. Your contract and onboarding process should clearly assign security responsibilities instead of assuming the provider handles everything.

5. What does the security service actually include?

“Cybersecurity included” is too broad to evaluate. Ask which controls are deployed, who monitors them and what happens when an alert is generated.

The discussion should cover endpoint detection, email protection, multi-factor authentication, device encryption, patching, firewall management, Microsoft 365 security settings and security-log retention. Ask which controls are standard, which require an additional licence and which remain the customer’s responsibility.

The Canadian Centre for Cyber Security advises organizations to research an outsourced provider before signing an agreement and confirm that its measures meet the organization’s security and business requirements. A credible provider should explain its control set in plain language and identify meaningful gaps without relying on fear. Learn more about SOS cybersecurity services.

6. How are updates and vulnerabilities managed?

Patching should be a managed process, not a vague promise that devices are “kept current.” Ask which operating systems and third-party applications are covered, how failed updates are identified and how urgent vulnerabilities are handled outside the normal schedule.

Reports should show coverage, exceptions and devices that have stopped checking in. Unsupported systems should have an owner and a replacement or risk-treatment plan.

This is especially important for laptops used away from the office. A device that is rarely connected to the corporate network still needs updates, monitoring and policy enforcement.

7. Can the provider demonstrate recovery readiness?

Backup success notifications show that a job ran; they do not prove that the business can restore usable systems and data within an acceptable timeframe.

Ask what is protected across servers, workstations, Microsoft 365 and critical applications. Confirm backup frequency, retention, encryption, administrative access and whether at least one recovery copy is isolated from production credentials.

Most importantly, ask when representative restores were last tested and how the results were documented. Recovery priorities should reflect business needs: payroll, customer records or production systems may need to return before less critical services. Review SOS backup and disaster recovery approach.

8. What happens during a security incident?

The provider should explain who validates an alert, who can isolate a device or disable an account, when business leaders are contacted and which actions require approval.

The Canadian Centre for Cyber Security’s baseline controls recommend that organizations assume incidents will occur, create response and recovery plans, and know who is responsible for each action. The plan should include the customer, the MSP and any external legal, insurance or specialist resources.

Ask whether the provider conducts incident exercises or tabletop reviews. A short exercise often reveals missing contact details, unclear authority and recovery dependencies before a real emergency creates pressure.

9. What will we review each quarter?

A quarterly business review should convert technical activity into decisions. Useful topics include:

• Devices missing critical updates or security coverage
• Microsoft 365 licence usage and inactive accounts
• Backup performance and the latest restore test
• Recurring support problems affecting productivity
• Hardware approaching replacement
• Security risks with assigned owners and deadlines
• Projects, budgets and business changes expected next quarter

NIST Cybersecurity Framework 2.0 helps organizations understand, assess, prioritize and communicate cybersecurity outcomes. Even a small business can apply that principle by requiring reports that show current risk, completed work and next priorities rather than pages of unexplained technical statistics.

10. How would onboarding—and a future exit—work?

A structured transition should cover account ownership, documentation, asset discovery, security-tool deployment, backup validation and communication with the outgoing provider. Ask for a written onboarding plan with responsibilities and target dates.

The agreement should also describe what happens when the relationship ends. Your organization should receive current documentation, credentials, configuration exports, licence information and cooperation during the handover. Any offboarding fees or notice periods should be understood before signing.

A provider confident in its service should not need to create technical dependence to retain a client.

Use the answers to compare accountability, not promises

The strongest proposal is not necessarily the one with the longest feature list. Look for clear scope, measurable service, secure administration, tested recovery, useful reporting and a transition process that preserves your ownership.

SOS Computer Experts provides managed IT services, cybersecurity, Microsoft 365 administration, backup oversight and local support for businesses in Burnaby. Ongoing managed IT services are available only in North Vancouver, Vancouver, Burnaby, Coquitlam, Richmond, Surrey and Langley.

Organizations in Victoria, Calgary, Edmonton and Toronto may engage SOS only for fixed-scope enterprise cybersecurity assessments and project-based enterprise security work—not MSP, general cloud, networking, infrastructure or helpdesk services.

Request a Burnaby IT baseline

If you are comparing providers or reviewing an existing IT arrangement, SOS can assess your environment, identify immediate risks and clarify what should be included in a managed-service plan.

Book a Free 15-Minute IT Baseline

Get a clear view of your current environment, immediate risks and the managed IT coverage your Burnaby business needs.