NORTH STAR | MANAGED IT PROVIDER DUE-DILIGENCE WORKSHEET
Canadian business buyer worksheet. No provider score, recommendation, certification or compliance verdict is supplied.
Use the same questions and evidence standard for every proposal. Unknown is not zero or included.
Keep completed copies private. Do not include passwords, tokens, private exports or incident data.
This file submits nothing and performs no calculation or provider verification.

1. DECISION CONTEXT
Business / decision owner:
Review date:
Reason for review (RFP / renewal / transition / other):
Critical workflows and disruption concerns:
Target start date and decision deadline:
Approximate users / devices / locations:

2. OWNERSHIP AND ACCESS
Who owns the domains, cloud tenants, billing accounts and recovery accounts?
Which administrator accounts remain customer-controlled?
Which people and tools have access to the environment?
How are least privilege, MFA, emergency access and offboarding handled?
Evidence requested / received:
Open question, owner and due date:

3. SERVICE SCOPE AND RESPONSIBILITIES
Covered users, endpoints, servers, applications and locations:
Excluded systems, users, vendors or physical work:
Support channels, hours and response targets:
Who investigates incidents and who may take containment action?
What requires customer approval?
What work is quoted separately?
Evidence requested / received:
Open question, owner and due date:

4. SECURITY, PRIVACY AND SUPPLY CHAIN
How are credentials, secrets and sensitive data handled during support?
Which subprocessors, platforms and downstream providers are used?
Where is relevant data or security telemetry stored and for how long?
How are incidents communicated, documented and escalated?
Which legal, privacy, insurer or client requirements are in scope?
Evidence requested / received:
Open question, owner and due date:

5. CONTINUITY AND RECOVERY
What data and systems are backed up, and what is excluded?
What recovery objectives and dependencies are documented?
Who can delete or change backups?
When was a representative restore last tested, and what evidence exists?
Who restores systems and data after an incident?
Evidence requested / received:
Open question, owner and due date:

6. COMMERCIAL AND EXIT TERMS
Recurring service, project, onboarding and contingent charges:
Billing currency, taxes, minimums and renewal terms:
Contract term, cancellation and price-change terms:
How are data, configurations, credentials and documentation returned?
What export format, transition assistance and exit charges apply?
How is retention, deletion or return confirmed after termination?
Evidence requested / received:
Open question, owner and due date:

7. DECISION RECORD
Responsibilities with no named owner:
Clarifications required before signing:
Risks accepted by the decision owner:
Pilot or transition acceptance criteria:
Decision and approver:
Decision date:

This worksheet is procurement guidance, not legal advice, a certification, compliance determination, recovery guarantee or provider endorsement.
Guide: https://northstarit.ca/learn/managed-it-provider-checklist-canada/