How to Choose an MSP in Sydney: 12 Questions to Ask (2026 Guide)

1How do you measure client satisfaction?

Ask for a satisfaction score collected from every closed ticket, and for public reviews you can check. Hand-picked testimonials only tell you about the provider's best day.

Satisfaction is the closest thing to a measure of what working with a provider actually feels like. A score collected after every ticket shows how the service performs week to week, ordinary tickets included. Ask who does the rating, when the survey goes out, and whether the result is published.

2Who answers when we call, and will they know our setup?

Look for a consistent team working from written documentation of your systems, so you are not explaining your setup again on every call.

A small team who knows your business fixes problems faster than a queue routed to whoever is free. Ask what happens when your usual contact takes leave.

3Do you work with businesses our size and in our industry?

Ask what share of the provider's clients look like you, and ask for a reference in your industry.

A provider built for enterprise tends to be slow and impersonal for a 20-person firm. A very small operator often struggles with compliance. You want the one whose normal client is you.

4What happens in the first 90 days?

Expect a written onboarding plan: an audit, admin access and documentation gathered, urgent risks fixed first, and support handed over on an agreed date.

The first 90 days show you how a provider works. Ask what you will see improve, and by when. The strongest providers commit to measurable improvements in that window.

5What security is included as standard?

Multi-factor authentication, endpoint protection, email filtering, patching and tested backups should be the baseline in every plan, mapped to the Essential Eight.

Security sold as an optional extra usually means it is missing in practice. The basics do most of the work: Microsoft Research found multi-factor authentication cuts the risk of account compromise by 99.22%, and by 98.56% even when the password has already leaked.

The Essential Eight is ASD's baseline. Its eight controls are patching applications, patching operating systems, multi-factor authentication, restricting admin privileges, application control, restricting Microsoft Office macros, user application hardening and regular backups.

6What are your support hours, and what happens after hours?

Many good providers run the help desk in business hours and monitor security around the clock. Ask who sees an alert at 10pm and how urgent after-hours issues are handled.

Clear hours in writing beat a round-the-clock claim nobody can explain.

7What are your response targets, and what did you actually achieve?

Ask for response and resolution targets split by priority, then ask for the provider's measured results over the last few months.

A target is a promise. A measured result tells you whether the promise gets kept. Resolution time is the number to press on, because an automated "we got your ticket" email meets a response target without fixing anything.

8How do you protect your own access to our systems?

An MSP holds admin access to every client, so ask how it secures its own tools. The Australian Cyber Security Centre publishes five questions to ask managed service providers on exactly this point.

Suppliers are a growing route into businesses. Verizon found a third party was involved in 30% of breaches in its 2025 Data Breach Investigations Report, double the 15% of the year before.

9When did you last test a restore of a client backup?

Ask how often restores get tested and how long a full recovery takes. A backup only counts if it restores.

Ransomware was present in 44% of breaches in the 2025 Verizon report, up from 32%. Among small and medium businesses the figure was 88%. A tested backup is what lets you recover without paying, and most victims now refuse: 64% did not pay, and the median payment among those who did was US$115,000.

10How do you help if we have a data breach?

A good provider has a written incident process and helps you work out whether a breach is notifiable under the Notifiable Data Breaches scheme.

Under the scheme, an organisation covered by the Privacy Act must tell the OAIC and the people affected when a breach is likely to cause serious harm. The OAIC received 1,205 notifications in 2025, and 716 came from malicious or criminal attacks. Health service providers reported the most (225), followed by financial services (157). Legal, accounting and management firms reported 81.

11What do you take responsibility for, and what sits outside the agreement?

A good provider sets out in writing what it looks after day to day and what is handled as a separate project, so there are no grey areas later.

Clear scope protects the relationship. Ask how projects, new hardware, onsite visits and after-hours work are handled, and how they get approved before work starts.

12What are the contract terms, and how do we leave?

Check the minimum term, the notice period, and how admin access, passwords and documentation come back to you if you leave.

You should own your domain, your Microsoft 365 tenancy and your data, whoever runs your IT. Get the handover process in writing while everyone is still on good terms.