What MSP stands for, and what it means.
MSP stands for managed service provider. It is a company that takes ongoing responsibility for another organisation's IT, for a recurring fee, rather than being called in per incident. The defining feature is not the list of services. It is who carries the risk. Under a managed agreement the provider is paid the same whether your systems break or not, which is the only arrangement in which their incentive to prevent problems matches yours.
That single structural difference is what separates an MSP from the model it replaced. A break-fix contractor earns more when more things break. An MSP earns more when fewer things break, because every ticket they prevent is an hour they do not spend. It is worth being blunt that this is a commercial incentive rather than a virtue, but it is the incentive you want pointing at your infrastructure.
In practice an MSP monitors your systems continuously, patches them, runs a helpdesk your staff can call, manages your security tooling, handles vendor escalations on your behalf, and plans your technology spending far enough ahead that hardware is replaced on a schedule instead of after it fails.
What is actually inside a managed services agreement.
Scope varies, but a credible agreement covers these six. If a proposal is missing one, ask why rather than assuming it is implied.
Monitoring and patching.
Agents on every server and workstation reporting disk, memory, backup status, security posture and failed updates, with patching applied on a defined cycle rather than whenever someone remembers. This is the part that runs whether or not anyone raises a ticket, and it is where most of the prevented downtime comes from.
Helpdesk.
A route for staff to get unstuck, with a response time written into the agreement. Ask specifically whether the number reaches a technician or a queue, what the after-hours arrangement is, and whether the response target is time-to-first-response or time-to-resolution. Those are very different promises.
Security.
Endpoint detection and response, enforced multi-factor authentication, email filtering, and awareness training. Note that "we install antivirus" is not this. The distinction matters at renewal, because insurers now ask for the specific controls rather than a general assurance.
Backup and recovery.
Backups that are tested by restoring from them. The question worth asking is not whether backups run, it is when the provider last performed a test restore and how long a full recovery took. A provider who cannot answer that from memory has not done it recently.
Vendor management.
Someone else sitting on hold with your internet provider, your line-of-business software vendor and your phone carrier. Unglamorous, and frequently the single largest time saving for the person who currently absorbs it, who is usually the owner or the office manager.
Planning.
A budget and a refresh cycle, so hardware is replaced on a schedule you funded rather than in an emergency you did not. At the larger end this is delivered as a vCIO function, which is the strategic half of an IT director without the salary.
How MSPs charge.
Three common models. The one a provider uses tells you a lot about how they will behave.
| Model | How it works | Suits | Watch for |
|---|---|---|---|
| Per user | A flat monthly fee for each person supported, covering all their devices. | Most SMBs. Predictable, and it scales with headcount rather than hardware. | Whether shared machines, contractors and seasonal staff count as users. |
| Per device | A fee per endpoint, server or network device under management. | Businesses with few staff and many machines, such as manufacturing or labs. | Costs rising when you add hardware, even if headcount is flat. |
| Block hours | Hours bought in advance and drawn down as used. | Businesses with real internal IT wanting overflow capacity. | It is not managed services. Nobody is monitoring anything between calls. |
Across the Canadian SMB market, per-user managed IT commonly lands between $100 and $250 per user per month depending on the depth of the security stack and whether licensing is included. Our own plans start at $89 per user per month, and our hourly rates are published rather than quoted on request: $95 standard, $143 emergency, $720 for a full day on site. If you want to model your own number before speaking to anyone, the IT budget calculator does it without an email gate.
MSP, MSSP, VAR and consultant.
These get used interchangeably in sales conversations and they are not interchangeable.
Managed security service provider.
Security only, usually a security operations centre watching alerts around the clock. An MSSP will not fix a printer or migrate your mail. Larger organisations run both an MSP and an MSSP; most SMBs are better served by an MSP whose agreement includes genuine security rather than by contracting the two separately.
Value-added reseller.
Sells and installs hardware and software, and makes its margin on the product. A VAR can be excellent at a project and has no structural reason to care what happens in month seven. If the proposal is mostly a bill of materials, you are talking to a reseller regardless of what the letterhead says.
Independent IT consultant.
One person, usually excellent, and a single point of failure. Fine for a business of five that needs occasional help. The exposure is holidays, illness and retirement, and the question worth asking early is what the documented handover looks like if they are unavailable for a fortnight.
Co-managed IT.
An MSP working alongside your existing internal IT rather than replacing them. Common once a business passes roughly 50 staff and has one internal person who cannot be on call permanently, cover holidays, and also do project work. See co-managed IT.
When an MSP is the right answer, and when it is not.
The honest threshold is somewhere around ten staff, or earlier if you handle client data, carry cyber insurance, or have a regulatory obligation. Below that, a competent independent consultant is usually better value and the overhead of a managed agreement is hard to justify.
The clearer signals that you have outgrown your current arrangement: nobody can say when backups were last restored from; the same problem recurs and nobody owns fixing the cause; your insurer or a client is asking for evidence of controls you cannot produce; hardware is replaced only when it dies; or one person who is not in IT has quietly become the person everyone asks. That last one is the most common and the most expensive, because the cost is hidden in someone else's job.
An MSP is the wrong answer if what you actually need is a single project delivered, such as an office move or a migration. That is project work, and paying a monthly fee for it is worse value than paying for the project. See IT project services for that, and break-fix versus managed services for the cost comparison in detail.
Quick answers.
What does MSP stand for?
Managed service provider. It is a company that takes ongoing responsibility for another organisation's IT for a recurring fee, rather than being called in per incident. The term is sometimes written as managed services provider; they mean the same thing.
What does an MSP actually do?
Six things, in a credible agreement: continuous monitoring and patching of your systems, a helpdesk your staff can reach with a defined response time, security tooling including endpoint detection and enforced multi-factor authentication, backups that are tested by restoring from them, vendor management so someone else sits on hold with your carriers and software vendors, and budget and refresh planning so hardware is replaced on a schedule rather than after it fails.
How is an MSP different from break-fix IT?
Who carries the risk. A break-fix contractor is paid per incident, so they earn more when more things break. An MSP is paid the same whether your systems break or not, so every problem they prevent is an hour they do not have to spend. It is a commercial incentive rather than a virtue, but it is the incentive you want pointing at your infrastructure.
How much does an MSP cost in Canada?
Per-user managed IT commonly lands between $100 and $250 per user per month across the Canadian SMB market, depending on the depth of the security stack and whether licensing is bundled. Our own plans start at $89 per user per month, and our hourly rates are published: $95 standard, $143 emergency response, $720 for a full day on site as a day rate.
What is the difference between an MSP and an MSSP?
An MSSP is a managed security service provider and does security only, typically a security operations centre watching alerts around the clock. It will not fix a printer or migrate your email. Large organisations run both. Most small and mid-sized businesses are better served by an MSP whose agreement includes genuine security than by contracting the two separately.
At what size does a business need an MSP?
Around ten staff, or earlier if you handle client data, carry cyber insurance, or have a regulatory obligation. Below that a competent independent consultant is usually better value. The clearest signal regardless of size is that someone whose job is not IT has quietly become the person everyone asks, because that cost is real and hidden in another role.
What should I ask an MSP before signing?
When they last performed a test restore and how long a full recovery took. Whether the helpdesk number reaches a technician or a queue, and what happens after hours. Whether the response target is time-to-first-response or time-to-resolution, because those are very different promises. What is explicitly excluded. And what the exit looks like: who holds the administrative credentials, and how they are handed back.
Can an MSP work alongside our existing IT person?
Yes, and that arrangement is called co-managed IT. It is common once a business passes roughly 50 staff and has one internal person who cannot simultaneously be on call permanently, cover holidays, and deliver project work. The MSP takes the monitoring, after-hours and specialist load, and the internal person keeps the relationships and the institutional knowledge.
More guides
Have a specific situation in mind?
Book a free 30-minute scoping call with a North Star engineer. We will walk through your environment, your questions, and what good looks like for your team.
Get a Free Assessment More guides