How to Evaluate a Managed Cloud, DevOps & Security Provider

Most disappointment with a managed provider traces back to scope, not skill. "Managed cloud" can mean anything from patching a few servers to running your whole AWS account, and "managed security" can mean an antivirus license or a staffed security operations center. Before you compare prices, ask each provider to write down what they will operate, what they will only advise on, and what they will not touch.

For a 10–200 person business without an IT team, the gaps usually sit at the edges: Microsoft 365 or Google Workspace administration, laptops and phones, the practice-management or accounting software the business runs on, the website, and the vendors behind each of them. Ask who owns each one. If the answer is "you do", decide now whether you can live with that or need a second provider.

Also ask where operations end and project work begins. A monthly fee normally covers monitoring, patching, backups, incident response and small changes. Migrations, new environments and audits are usually quoted separately. That is reasonable, as long as the line is written down before you sign.

Every provider quotes a response time. The number only means something once you know three things: what counts as a P1, what "response" means, and how the clock is measured.

A P1 (priority 1) incident should be defined in the contract in business terms, such as a production system or company email being down for everyone, or an active security incident. It should not be left to the provider's judgment on the night. Lower priorities (P2 to P4) cover degraded service, single-user problems and routine requests, and carry longer targets.

Response time is usually the time until a qualified engineer acknowledges the incident and starts work, not the time to fix it. Ask whether the clock starts when their monitoring fires or when you open a ticket, whether it runs 24/7 or only in business hours, and whether an automated reply counts. Resolution targets, where they exist, are usually goals rather than guarantees, because root causes vary.

Uptime guarantees deserve the same scrutiny. Ask which systems the percentage covers, whether planned maintenance is excluded, and what you receive when it is missed. Service credits are the norm, so check how they are calculated and whether they are applied automatically or only when you claim them. Then ask for measured response times from recent months, not just the targets.

Monitoring tools raise alerts around the clock. The real question is whether a person looks at them at 3am on a Sunday, or whether they wait in a queue until Monday. For a business with no IT staff, that difference decides whether a compromised mailbox is contained quickly or discovered after invoices have been redirected.

Ask whether the provider runs its own security operations center (SOC) or managed detection and response (MDR) service, or resells someone else's. Either can work, but you need to know who has authority to act. Can the analyst disable a compromised account, isolate a laptop or block a suspicious sign-in without waiting for you to answer the phone? Get the escalation path in writing: who they call, in what order, and what they do if nobody answers.

Finally, ask what the SOC actually watches. For small businesses the usual sources are cloud accounts, Microsoft 365 or Google Workspace sign-ins, endpoints and email. If one of them is out of scope, that is the one an attacker will use.

If you handle patient records, client funds or card payments, or you sell to companies that send security questionnaires, compliance will come up. Providers use the word loosely, so separate three things.

Readiness is a gap assessment: where you stand against HIPAA, SOC 2, PCI DSS or ISO 27001, and what has to change. Evidence is the technical proof an auditor asks for, such as access reviews, encryption settings, backup tests, patch records and logs, produced as a by-product of running your systems well. Compliance management is the ongoing program: policies, risk assessments, vendor reviews, scheduled evidence collection and working with the auditor. Many providers include the first two and price the third separately, so ask which one you are buying.

Healthcare organizations need one more check. Under HIPAA, a provider that can access systems holding protected health information is a business associate, and you need a signed business associate agreement (BAA) with them before they get access. Your cloud provider has its own BAA as well; on AWS, for example, you accept it in AWS Artifact. A provider that hesitates to sign a BAA is not ready to work with patient data.

The time to plan the end of a contract is before it begins. Your business should own its cloud accounts, domain registrations, Microsoft 365 or Google Workspace tenant and software licenses, with the provider working through named accounts that you can revoke. If a provider opens the AWS account on its own card or registers your domain in its name, leaving later becomes slow and risky.

The same applies to the work itself. Infrastructure as code (the templates that define your servers and networks), runbooks, network diagrams and credentials should live in systems you control and be handed over in a usable form when you leave. Agree the notice period, what the provider does during the handover, and how quickly it removes its own access. Confirm that every engineer signs in with an individual login and multi-factor authentication, so that offboarding one person never means rotating a shared password.

A monthly retainer covers ongoing operations for a fixed fee, usually tiered by level of coverage. It suits businesses that want one team accountable for everything and a predictable bill. Ask what moves the price within a tier, and what would push you into the next one.

Per-project pricing covers a defined piece of work, such as a migration, an audit readiness sprint or an email security fix, for a fixed or estimated price. It is a low-risk way to test a provider before a longer commitment, provided the deliverables are specific.

Per-device or per-user pricing is common with traditional MSPs that support laptops and a help desk. It is easy to forecast against headcount, but read what each seat includes, because cloud infrastructure, security monitoring and compliance are often extras. Whichever model you choose, compare the total annual cost, including onboarding fees, tool pass-throughs and add-ons, rather than the headline monthly figure.