Managed Service Providers in Canada

List what the provider will manage and what remains with the customer or another vendor. Include users, endpoints, servers, networks, cloud tenants, SaaS, backup, security monitoring, projects, procurement, compliance support, and on-site work. Ambiguous ownership becomes delay during an outage.

• Name an owner for every system and control
• Separate recurring work from billed projects
• Document supported devices, applications, locations, and hours
• Identify third parties and customer responsibilities
• Write escalation and decision authority

A Canadian provider can deliver remote support nationally while limiting on-site work to defined regions or partners. Ask where staff, systems, data, backups, and sub-processors are located. Confirm hours, languages, travel terms, dispatch targets, and whether after-hours monitoring includes human response.

• Separate response from resolution time
• Check every location and time zone
• Ask who answers and who can make changes
• Confirm employee and subcontractor roles
• Test escalation during references or a pilot

MSPs hold trusted access to customer environments and are attractive targets. Government guidance recommends explicit requirements for identity, privileged access, logging, vulnerability management, incident notification, continuity, supply-chain risk, data protection, and customer visibility.

• Require named accounts and strong MFA
• Review role approval, expiry, and access certification
• Ask how remote tools, scripts, and service accounts are secured
• Define incident-notification timing
• Confirm protected backups and provider continuity
• Review evidence proportionate to risk

Convert proposals into a common three-year model. Include per-user or per-device fees, minimums, onboarding, projects, after-hours work, travel, licences, backup storage, security tools, hardware margin, increases, taxes, and exit assistance. A lower fee can exclude important work.

• Compare the exact included stack
• State user, device, site, and data growth
• Confirm ownership of domains, tenants, data, and documentation
• Negotiate exports and transition assistance
• Record renewals outside the provider’s system

Ask for evidence that matches the promised service, including patch and backup reports, restore tests, metrics, asset inventory, access reviews, training, exercises, vulnerability remediation, and sample documentation. References should resemble the customer’s size, complexity, geography, and industry.

• Ask what changed after a serious failure
• Request executive reporting examples
• Confirm how recurring tickets are reviewed
• Ask about onboarding, escalation, billing, and transitions
• Validate certifications instead of relying on logos

Use mandatory requirements first, then weighted criteria. A provider that fails a critical legal, security, compatibility, or coverage requirement should not win through a high total score. Pilot the relationship or conduct detailed discovery before a multi-year commitment.

• Score the same evidence for every candidate
• Document assumptions and exceptions
• Require business and technical reviewers
• Record residual risks and owners
• Set a review date before renewal

• Confirm which users, devices, cloud services, networks, vendors, backups, and security tools are included
• Separate response acknowledgement from the time required to contain or resolve an issue
• Ask for evidence of backup monitoring and completed restore tests
• Identify project work, travel, after-hours response, onboarding, and offboarding charges
• Keep ownership of domains, tenants, administrator accounts, documentation, configurations, and business data
• Require a documented transition process if the relationship ends

Compare the checklist with North Star's managed IT service scope and published managed IT pricing.

A local address does not describe the service model. Ask every provider which work is handled remotely, where staffed support is located, whether on-site work uses employees or subcontractors, which communities receive routine coverage, and how travel or dispatch is priced.

For Vancouver organizations, compare the provider's actual response model with the needs of head-office, branch, field, and remote users. North Star documents its remote-first approach and scheduled travel on the Vancouver managed IT services page and separates day-to-day support intent on the Vancouver IT support page.

• Canadian Centre for Cyber Security: managed-service considerations
• Canadian Centre for Cyber Security: contracting with MSPs
• CISA: MSP customer risk considerations
• Joint MSP security advisory