How we vet an IT provider, and the checks you can run yourself
We vet a provider in two passes. Six checks that need nobody's permission, then four questions only a conversation answers. The star rating is not one of the six, because 61.8 percent of rated providers in our directory sit at exactly 5.0. Verify what a third party can confirm first.
- Verify before you ask. Six checks on a provider need nobody's cooperation, and each is faster than a sales call.
- A star rating cannot separate providers in this market. In our directory 11,153 rated providers sit at exactly 5.0, which is 61.8 percent of every rated row.
- A claim on a provider's own website counts as evidence only when a third party can confirm it. A founding year, an address, a partner badge and a credential all can be.
- Only 50.6 percent of the US private-sector establishments born in March 2013 were still operating five years later, so years in business is a real filter rather than a vanity line.
- Our own data has gaps. Four roster rows in ten carry no usable founding year, and you can close that gap for one firm in two minutes.
What do you check before you ever contact an IT provider?
Before you contact an IT provider, check six things a third party can confirm. The review count, the address, the years in business, the named leadership, the credentials, and the services the firm actually sells. None of the six needs the provider's cooperation, and together they take about twenty minutes.
Our researchers run those checks on every firm in this directory before anyone asks a question. The order is deliberate. A verifiable fact costs you ten minutes and no obligation. A sales call costs an hour and hands the agenda to the person selling.
The star rating is not on the list, and our own data is the reason. Across the directory 11,153 rated providers sit at exactly 5.0, which is 61.8 percent of every rated row. A signal that most of a market shares cannot separate that market. We publish the rating because buyers look for it, and we rank on more than the rating because it cannot carry the decision alone.
Two companion guides cover the metric itself. Rating against review count shows how far one review moves a score, and what 24,491 provider records say about star ratings covers every band in the distribution. This guide is the method around the metric, which is the part you can reuse.
One thing cannot be checked in advance at all. Whether the firm answers at 7am on a Monday with your server down. That belongs in the second pass, and it is where most of the decision actually gets made.
Why we verify a claim before we ask about it
We verify first because a claim on a provider's own website is evidence only when somebody else can confirm it. Sort every statement on a provider's site into three tiers, and the tiers tell you where your time is worth spending.
- Self-asserted and uncheckable. Proactive, responsive, trusted, enterprise-grade, a true partner. Every competitor writes the same words, so they separate nobody. Score them zero.
- Self-asserted and third-party checkable. A founding year, a street address, a partner badge, an engineer's certification, a client logo. Each one has a registry, an issuer or a platform behind it that will confirm it or contradict it.
- Asserted by somebody else. Google reviews, state incorporation records, a vendor's own partner directory, a certification body's register. Nobody drafted these to win your business.
The middle tier is the whole job, and it is the tier most buyers skip. Our published method sorts the same evidence into three tests, covering presence and credibility, legal and operational standing, and competency and track record. The second of those is almost entirely middle tier, and the whole method sits on our evaluation process page so you can borrow it rather than trust it.
The effort is proportionate to what you are handing over. A managed IT provider holds administrator access to your systems, and Verizon reports a third party involved in 48 percent of breaches, with third-party supply chain breaches up 60 percent in a year. This is due diligence on a key to your own building, not on a stationery supplier.
Is the address a real office, and how long has the firm been there?
To test an address, read the provider's Google Business Profile against Google's own eligibility rules. Google states that P.O. boxes or mailboxes located at remote locations aren't acceptable, that a rented mailing address where a business does not operate isn't eligible for a Business Profile, and that a listed location should be staffed by your team and able to receive customers during its stated hours.
Two tells follow from that. Google asks a business showing an address to maintain permanent fixed signage of their business name at the address, so a suite number in a shared building with no exterior photo is worth one phone call. And Google's own instruction to a business that travels to its clients is that it should hide your business address from customers. A hidden address is a legitimate answer rather than a dodge. It tells you there is no walk-in office, not that there is no office.
Years in business is the harder number and the more useful one. The Bureau of Labor Statistics followed every US private-sector establishment born in March 2013 and found 50.6 percent still operating five years later and 34.7 percent still operating in 2023. A provider that has traded for ten years sits inside the minority that reached its tenth year.
Check the date in the state business registry rather than on the website, because the registry records the incorporation date, the registered agent and whether the entity is still in good standing. Our own method calls this legal and operational standing, and confirmation that the business is registered and properly incorporated sits at the top of it.
Here is the first gap in our own data, and the first place a buyer beats us. 14,931 of our roster rows carry a usable founding year, which is 61.0 percent, so four rows in ten cannot answer how long a firm has been going. We cannot phone 24,491 companies. You only need to check three.
Does a named person stand behind the firm?
A named leader on a provider's own site proves two things. Somebody is accountable in public, and the firm is confident enough to put a name beside the work. An about page that names nobody proves neither, and that is the most common about page in this market.
This is why we never create an executive profile from an inference. A profile exists only when a real full name and title appear in text we read on the company's own website, and a company that names nobody is left without one. That gap stays visible rather than getting filled. Across the directory we publish 2,308 executive profiles against 22,027 company profiles, and the distance between those two numbers is the honest shape of this market.
Run the check in three steps. Find the leadership page. Search that person's name against the company name on a professional network and see whether the tenure matches. Then ask whether the named person is the one who will own your account, or somebody you will never speak to again after the pitch.
Leadership stability is its own signal and our method scores it. A firm whose named leaders have been in place for years behaves differently in a crisis from one that changed hands last quarter. A provider can also be acquired without telling you, which makes the question fair rather than rude, and what happens to your IT contract when a provider is acquired covers the consequences.
How do you verify a certification or a partner badge?
To verify a credential, take it to the body that issued it rather than to the website that displays it. Every real credential has a register behind it, and the register is the only thing that knows whether the credential is current.
Expect that to be slower than it sounds, which is itself worth knowing. ISC2, which issues the CISSP, provides verification in writing only and states that no verification will be provided over the phone. A batch check needs each person's first and last name, certification exam taken, and ISC2 unique identifier, plus a signed consent and release form for each result verification, returned within five business days.
So the practical move is to ask the provider for the holder's name and credential identifier, then check the public badge yourself or ask the provider to produce the issuer's written confirmation. A provider that cannot name the person holding a credential it advertises has answered the question. Our guide to which MSP badges are real credentials carries the renewal rules and the difference between a company partner badge and one person's qualification.
One trap sits underneath all of this. A logo in a footer is a design element. A qualification belongs to a person who can resign on a Friday, and a vendor partner badge belongs to a company whose status is renewed on a schedule. Neither survives on the website's say-so.
Why a high review count is not a pass
A high review count is not a pass, because a strong local profile often belongs to a business that does not do the work you are buying. We reject candidates carrying hundreds of reviews every week.
The categories we drop after reading a firm's own site are consistent. Consumer computer and phone repair shops. Print, copier and toner resellers. Residential-only home support. Pure telecom and VoIP resellers. Web agencies, app developers and business coaches that a mapping category filed under IT services. A glowing rating from walk-in consumers measures something real and measures the wrong thing.
One check settles it in about a minute. Open the services page and look for the words a business buyer needs, such as help desk support, network monitoring, data backup, cybersecurity and a service level agreement. A firm that sells to businesses says so on its own homepage. Read who the case studies are about, too, because a page of residential testimonials is an answer.
Then look at who wrote the reviews. Federal rules make it an unfair or deceptive practice for a business to procure a consumer review from its officers, managers, employees, or agents, or their immediate relatives, where the review misrepresents the reviewer's experience, with reviews from generalized solicitations to real customers carved out. Compare the reviewer names on a thin five-star profile against the names on the team page. It takes two minutes and sometimes it answers everything.
We also cross-check the city and state a firm claims against the city and state its own Google Business record reports, because an office in the next metro is a different response time. That check reports rather than drops automatically, since a twin-city metro is a real thing, and we label the location honestly when we keep the firm.
The four questions only a conversation answers
Four questions have no public answer, so they are the only ones worth spending a call on. Who owns which task, who you reach at 2am, who else touches your data, and what you get back when you leave. Judge each answer by whether it names a document, a person, a number or a date.
| What to ask | A good answer sounds like | A deflection sounds like |
|---|---|---|
| Which security tasks are yours and which stay ours, in writing? | Offers a responsibility matrix naming each task and its owner. | We take care of security for you. |
| Who answers at 2am, and who can authorize taking a system offline? | Names two people per level and two ways to reach each one. | We have 24/7 support. |
| Which subcontractors or offshore teams will touch our systems? | Names them and their countries, and points to the contract clause. | Everything is done in-house. |
| If we leave in a year, what do we get back and on what date? | Lists the artifacts, gives a date, and shows you an export. | We would hate to lose you. |
The first question is not ours to invent. CISA and its international partners tell MSP customers to ensure their contractual arrangements meet their specific security requirements, to make the contract specify whether the MSP or the customer owns specific responsibilities, to detail how and when MSPs notify the customer of an incident, and to understand the supply chain risk associated with their MSP. That advisory is free, government-published, and names the gaps for you.
A federal rule tells one whole industry to do exactly this. The FTC Safeguards Rule requires a covered firm to oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards, requiring your service providers by contract to implement and maintain such safeguards, and periodically assessing your service providers based on the risk they present. Most small firms sit outside its scope. Borrow the three-step shape anyway, because a regulator with nothing to sell chose it.
A good answer names a document, a person, a number or a date. A deflection names a value.
Document the answers in the provider's own words while the call is fresh, then compare the four sets side by side. Our guide to testing an escalation path covers the 2am question in full, including what escalation does and does not promise.
Where our data stops, and where yours is better
Our data stops in four places, and naming them is more useful than claiming it does not. These limits apply to our own listings as much as to anybody else's.
- Rating coverage. 18,059 of 24,491 roster rows carry both a rating and a review count, which is 73.7 percent. A further 6,431 rows, 26.3 percent, carry no rating at all, and an unrated row is unmeasured rather than weak.
- Founding year. 14,931 rows, or 61.0 percent, carry a usable founding year, so four rows in ten cannot answer how long a firm has been going.
- Firm size. 2,048 rows, or 8.4 percent, carry an unknown size band, so the head count behind a quote is sometimes missing from the page.
- Review depth. 6,262 rated rows carry a star distribution, which is 34.7 percent of rated rows, so most listings show an average without the spread behind it.
Three scope notes belong beside those numbers. The ratings are Google ratings, so they measure what reviewers chose to write rather than what a provider delivered. Each one was captured when its city was researched, so a live score moves after we record it. And no star average contains a ticket resolution time, a tested restore or a breach record.
Here is the part worth taking away. We run these checks across 24,491 roster rows in 730 city datasets, which forces us to automate and to accept a coverage gap. You are checking three firms. You can phone the office, read the registry entry, ask for the certificate holder's name, and end up knowing more about one provider than we hold about that provider. Scale is our advantage and depth is yours. Use an independent directory to build the shortlist, then out-research us on the three firms that survive it.
Run the checks in this order
To vet a provider in about twenty minutes, run the cheapest checks first and stop as soon as one disqualifies the firm.
- Read the review count before the star rating, and treat anything under ten reviews as unmeasured. 40.1 percent of rated providers hold fewer than 10 reviews.
- Open the Google Business Profile and look for a staffed address, exterior signage and a city that matches the website.
- Search the state business registry for the incorporation date and whether the entity is in good standing.
- Find the leadership page and confirm a real name, a real title and a tenure that matches.
- Scan the services page for help desk support, the tools that monitor a network, data backup and a written service level agreement.
- Ask for the credential holder's name and identifier, and for the vendor partner badge to be confirmed by the vendor.
Shortlist the firms that clear all six, then spend the call on the four questions nobody publishes. Twenty minutes of verification done beforehand changes what the call is for. You stop being pitched and start comparing four specific answers, which is the only comparison that has ever decided this purchase well.
FAQ
How do you vet an IT provider before contacting them?
Check six things a third party can confirm. The review count, the address against Google's eligibility rules, the incorporation date in the state business registry, the named leadership, the credentials with their issuing body, and whether the services page sells to businesses at all. None of the six needs the provider's cooperation.
Is a five-star rating a good sign when choosing an IT provider?
It separates almost nobody. In our directory 11,153 rated providers sit at exactly 5.0, which is 61.8 percent of every rated row. Read the review count first and treat a perfect score on a thin count as unmeasured. Then verify the address, the founding year and the credentials, which do vary between firms.
How can you tell whether an IT provider's address is a real office?
Read the Google Business Profile against Google's own rules. Google states that P.O. boxes or mailboxes located at remote locations aren't acceptable and that a listed location should be staffed by your team and able to receive customers during its stated hours. A hidden address is legitimate for a firm that travels to clients.
How do you verify an IT provider's certifications?
Take each credential to the body that issued it. Expect a slow, formal process. ISC2 confirms a certification in writing only, states that no verification will be provided over the phone, and returns results within five business days. Ask the provider for the holder's name and credential identifier, then check the issuer's register.
What should you ask an IT provider that you cannot look up yourself?
Four things. Who owns which security task in writing, who answers at 2am and who can authorize taking a system offline, which subcontractors touch your data, and what you get back when you leave. CISA tells customers to make a contract specify whether the MSP or the customer owns specific responsibilities.
Best IT MSP is the independent directory of vetted managed IT providers across the US and Canada. Organic ranking is earned on verified rating and firmographic data, and paid placement is always labelled. Pull three local firms from your city page, run the six checks, then spend your call on the four questions.