How to Choose an MSP in Annapolis: 12 Questions That Matter

Sit through three MSP sales presentations and you will hear the same words three times: proactive, partner, responsive, secure. The pitches are interchangeable because the pitch is not where MSPs differ. They differ in what they will put in writing, who actually answers the phone, and what happens in month 14 when the honeymoon is over. These 12 questions surface those differences. Ask every one, in order, and write down the answers, because you will want to compare them side by side.

Response and support

1. What response times will you guarantee in writing, by severity?

Not "we usually respond fast." A real answer looks like: critical outage, 15-minute response, one-hour restoration target; standard request, 4 business hours. If it is not in the service level agreement with a remedy attached (usually service credits), it is a hope, not a commitment. Ask what percentage of tickets met the SLA last quarter; good providers track this and will show you.

2. Who exactly answers when we call, and where are they?

Some MSPs run their own local helpdesk; others outsource tier-1 to a third-party call center you were never told about. Neither is automatically wrong, but you should know which you are buying, whether the after-hours line reaches an engineer or an answering service, and how quickly a real problem escalates to a senior person.

3. What is your technician-to-client ratio, and how big is your team?

A five-person shop supporting 80 clients is stretched thin, no matter how talented. You are listening for whether they have depth to survive an engineer quitting, two clients having simultaneous emergencies, and a hiring market that is tight everywhere in the Baltimore-Washington corridor.

Fit and experience

4. How many clients our size, in our industry, do you support today?

An MSP whose sweet spot is 10-person offices will struggle with your 90-person firm, and vice versa. Industry matters just as much in Annapolis: a provider fluent in dental practices may be lost with a government contractor. Ask for the number, not an assurance.

5. Can we speak to two current clients and one former client?

Current references tell you what good looks like. The former client tells you what leaving looks like, and a provider's reaction to this request tells you plenty by itself. When you call, ask the references one question above all: what happens when something goes wrong?

6. What compliance frameworks do you actively support?

This question carries extra weight around Annapolis. The area's economy runs on defense and government contracting (with Fort Meade and its ecosystem just up Route 32), state government work, maritime businesses, and professional firms serving all of them. If you hold or want federal contracts, ask specifically about CMMC and NIST 800-171 experience: how many clients they have taken through an assessment, and whether their own house meets the standard. A provider who says "we can figure that out" is volunteering you as the tuition.

Security and operations

7. What is in your security stack, and what costs extra?

Minimum bar in 2026: endpoint detection and response, multi-factor authentication enforcement, email filtering, security awareness training, and managed backups with tested restores. Ask what is included in the quoted price versus sold as an add-on, and ask them to map their stack against a cyber insurance application, because that is the test your business will actually face.

8. How do you secure your own company?

MSPs are prime targets precisely because they hold the keys to dozens of businesses. Attackers who compromise one provider get all of its clients. Fair questions: Do you carry cyber liability insurance, and at what limit? Do you undergo third-party security audits? How is access to our systems controlled and logged inside your team?

9. If we are hit with ransomware, what happens in the first hour, and who pays for the recovery?

You want to hear a rehearsed incident response process, not improvisation. And the billing question matters: some agreements cover incident remediation, others bill it hourly on top of your monthly fee, which can turn a bad week into a five-figure invoice.

The relationship and the exit

10. Who owns our documentation, passwords, and licenses, and what does leaving look like?

The right answer: you own everything, and offboarding is defined in the contract, with credentials, documentation, and data handed over within a stated number of days, at a stated (or zero) cost. Providers that get this wrong hold clients hostage at the exact moment trust has already broken. Negotiate the divorce terms at the wedding.

11. What are the contract term, the escalators, and the auto-renewal terms?

One to three years is normal; watch for annual price increases (3 to 5 percent is common, uncapped is not acceptable) and auto-renewal clauses that quietly re-commit you for a full term unless you object in a narrow window. Calendar that window the day you sign.

12. How will you tell us what we are getting for the money?

The difference between a partner and a bill on autopilot is reporting and rhythm: a named account manager, quarterly business reviews that actually happen, ticket and SLA reports you can read, and a rolling technology budget so hardware refreshes stop being surprises. Ask to see a sample quarterly review deck from a real (redacted) client.

How to run the process

Questions only work if every provider answers the same ones under the same conditions. A workable lightweight process for an Annapolis business:

• Write one page describing your business: headcount, locations, servers, cloud services, compliance obligations, and what is driving the change.
• Send it to three to five providers with these 12 questions and ask for written answers plus pricing against that scope.
• Score the answers before you take any meetings, so the best salesperson does not beat the best provider.
• Interview the top two or three, and put their written answers in front of them.
• Check references last, when you know what you are verifying.

That is, in miniature, a request for proposal. For larger organizations, or anyone with compliance obligations, a formal RFP (or a price-focused RFQ) makes the answers binding and the comparison rigorous. And before you evaluate anyone, know what you should be paying: our managed IT pricing guide covers the real ranges. If you are earlier in the journey, start with What is a managed service provider?, or, if you have internal IT staff already, consider whether co-managed IT fits better than full outsourcing.

One last thing: trust the process over the demo. Every MSP looks competent in a conference room. The ones worth a three-year contract are the ones whose answers survive being written down.