How Should an Insurance Agency Choose a Managed IT Service Provider?

What Should an Insurance Agency Look for in a Managed IT Provider?

An insurance agency should evaluate a managed IT service provider using at least 10 measurable criteria: insurance-industry experience, cybersecurity capabilities, response times, support coverage, Microsoft 365 expertise, backup and disaster recovery, vendor coordination, strategic planning, pricing transparency, and transition procedures.

For an agency with 25–50 employees, the best provider is usually not the least expensive bidder or the company with the longest list of tools. It is the provider that can demonstrate a repeatable process for protecting client information, supporting employees, managing insurance applications, reducing downtime, and planning technology costs.

A practical MSP evaluation should take approximately 30–60 days and include discovery meetings, proposal comparisons, reference checks, contract review, and a documented transition plan.

The 10-Part MSP Evaluation Framework

1. Confirm experience with insurance agencies.
2. Evaluate the provider’s cybersecurity program.
3. Review response times and escalation procedures.
4. Verify support hours and staffing depth.
5. Assess Microsoft 365 and cloud expertise.
6. Examine backup and disaster recovery capabilities.
7. Confirm insurance software and vendor coordination.
8. Review strategic planning and reporting.
9. Compare total pricing, scope, and exclusions.
10. Evaluate onboarding, documentation, and termination procedures.

Each category should be scored using evidence rather than promises. Statements such as “fast support,” “enterprise-grade security,” and “proactive service” are difficult to evaluate unless the provider explains exactly how those claims are measured.

1. Confirm Experience With Insurance Agencies

An MSP does not need to specialize exclusively in insurance, but it should understand how insurance agencies operate and which systems are essential to daily client service.

Relevant experience may include supporting:

• Independent insurance agencies
• Property and casualty agencies
• Employee benefits firms
• Commercial insurance organizations
• Insurance brokerages
• Remote producers and account managers

Why Industry Experience Matters

Insurance agencies depend on interconnected systems such as:

• Agency-management platforms
• Carrier portals
• Microsoft 365
• VoIP telephone systems
• Document-management platforms
• Electronic signature tools
• Accounting systems
• Quoting and comparative-rating applications
• Secure client communication tools

An experienced provider should understand that a problem involving identity, internet access, a browser, Microsoft 365, or a workstation may prevent employees from using an insurance application even when the application vendor reports no outage.

Questions About Insurance Experience

1. How many insurance agencies do you currently support?
2. What employee sizes do those agencies have?
3. Which agency-management systems have you supported?
4. How do you coordinate with insurance software vendors?
5. How do you support remote producers?
6. What insurance-specific security risks do you commonly identify?
7. Can you provide relevant client references?

Look for Specific Examples

A strong provider should be able to describe examples such as:

• Improving Microsoft 365 security for an insurance agency
• Reducing recurring application problems
• Replacing an aging server without major downtime
• Helping an agency prepare for cyber insurance renewal
• Supporting a merger, acquisition, or office move
• Recovering an agency after a security incident or system failure

The provider should protect client confidentiality, but it can still explain the problem, process, and measurable result.

2. Evaluate the MSP’s Cybersecurity Program

Cybersecurity should be integrated into managed IT services rather than treated as an optional collection of products.

A layered security program may include:

• Multi-factor authentication
• Endpoint detection and response
• Email security
• Security awareness training
• Phishing simulations
• Patch management
• Vulnerability management
• Firewall administration
• Microsoft 365 security
• Privileged-access controls
• Backup protection
• Security monitoring
• Incident response planning

Ask Who Responds to Security Alerts

Security tools are valuable only when someone monitors, investigates, and responds to their alerts.

Ask:

• Who reviews security alerts?
• What hours are alerts monitored?
• How are serious events escalated?
• Can the provider isolate a compromised device?
• Can the provider disable an account quickly?
• How are Microsoft 365 sign-ins investigated?
• Who contacts agency leadership?
• How does the provider coordinate with cyber insurance and legal counsel?

Verify the Provider’s Own Security

An MSP may have administrative access to client systems, making the provider itself an important part of the agency’s risk.

The provider should protect its operations through controls such as:

• Multi-factor authentication
• Separate technician accounts
• Role-based access
• Security monitoring
• Employee background screening where appropriate
• Documented onboarding and offboarding
• Secure remote-management tools
• Incident response procedures
• Cyber liability insurance

Learn more about layered protection through 911 IT’s cybersecurity services.

3. Review Response Times and Escalation Procedures

The agreement should define how quickly the provider begins meaningful work after receiving a request.

A practical support model may use:

Priority	Example	Suggested Initial Response
Priority 1	Agency-wide outage or active cyber incident	Approximately 15 minutes
Priority 2	Important employee or department unable to work	30–60 minutes
Priority 3	Limited-impact issue with a workaround	2–4 business hours
Priority 4	Planned change or low-urgency request	4–8 business hours

Actual commitments vary, but each provider should explain its definitions clearly.

Do Not Confuse Acknowledgment With Response

An automated email may confirm that a ticket was received. It does not necessarily mean a technician has reviewed the issue or begun troubleshooting.

Ask the provider to define:

• Acknowledgment time
• Technician response time
• Escalation time
• Resolution time
• Update frequency

Evaluate the Escalation Path

A reliable provider should have access to multiple skill levels and specialties.

The escalation process may include:

1. Help desk technician
2. Senior support engineer
3. Network or cloud specialist
4. Cybersecurity specialist
5. Service manager
6. Executive escalation
7. Third-party software or carrier support

Ask how long a ticket may remain with one technician before it is escalated.

4. Verify Support Hours and Staffing Depth

An insurance agency should understand who will answer the phone, where the support team is located, and what happens when the primary technician is unavailable.

Support Staffing Questions

1. How many help desk technicians are available?
2. Are technicians employees or subcontractors?
3. Is support U.S.-based?
4. What are normal support hours?
5. Is live after-hours support available?
6. How are overnight security alerts handled?
7. What happens during holidays?
8. How are onsite requests scheduled?
9. What happens when the assigned account engineer is absent?

Avoid Dependence on One Person

A provider that depends on one technician may create delays during vacations, illness, turnover, or major incidents.

The MSP should maintain shared documentation so another qualified technician can support the agency without requiring employees to explain the entire environment again.

Clarify After-Hours Coverage

The agreement should specify:

• Which incidents qualify for after-hours response
• How to contact the emergency team
• Expected response times
• Whether additional fees apply
• Who may authorize emergency work
• How routine requests are handled

An active ransomware incident should not wait until the next business morning because the employee submitted the report after normal hours.

5. Assess Microsoft 365 and Cloud Expertise

Microsoft 365 is often the center of an insurance agency’s email, identity, file sharing, collaboration, and remote work. The MSP should do more than sell licenses and reset passwords.

Microsoft 365 management should address:

• User onboarding and offboarding
• Multi-factor authentication
• Conditional access
• Administrator accounts
• Email security
• SharePoint permissions
• OneDrive management
• Microsoft Teams governance
• External guest access
• Mailbox forwarding rules
• Third-party application access
• Audit logging
• License optimization
• Backup and recovery

Ask What the MSP Reviews Regularly

A mature provider may review:

• Inactive accounts
• Former employee access
• Global administrator assignments
• MFA enrollment
• Risky sign-ins
• External sharing
• Guest accounts
• Connected applications
• License usage

Review Microsoft 365 and related services through 911 IT’s cloud services.

6. Examine Backup and Disaster Recovery Capabilities

An MSP should be able to explain exactly which systems are protected, how frequently backups run, how long data is retained, and how restoration is tested.

Backup Evaluation Questions

1. Which servers and devices are backed up?
2. Is Microsoft 365 protected separately?
3. Are SharePoint, OneDrive, and Exchange included?
4. How frequently do backups run?
5. How long is data retained?
6. Where are recovery copies stored?
7. How are backups protected from ransomware?
8. Who reviews failed jobs?
9. How often are restoration tests performed?
10. Can the provider restore one file, one mailbox, or an entire server?

Require Measurable Recovery Targets

The provider should help establish:

• Recovery Time Objective: How quickly a system must return
• Recovery Point Objective: How much recent data loss is acceptable

A provider cannot design the right recovery solution if the agency has not defined its business requirements.

Ask for Evidence of Testing

Backup success reports do not prove that the data can be restored. Request documentation showing:

• The date of the latest test
• The system restored
• The recovery method
• The time required
• Whether the recovery target was met
• Any corrective actions

Explore 911 IT’s business continuity and disaster recovery services.

7. Confirm Insurance Software and Vendor Coordination

An MSP will not control every insurance application, internet circuit, phone platform, or carrier portal. It should still help coordinate diagnosis and resolution.

Vendor coordination may include:

• Agency-management software support
• Comparative-rating platforms
• VoIP providers
• Internet carriers
• Printer and scanner vendors
• Website providers
• Microsoft licensing providers
• Accounting application vendors
• Cyber insurance resources

Define Responsibility Boundaries

The agreement should explain whether the MSP will:

• Open vendor support cases
• Participate in troubleshooting calls
• Provide logs and technical information
• Test network and workstation performance
• Coordinate software updates
• Track the issue until completion
• Charge separately for vendor coordination

Avoid the Vendor Blame Cycle

When several providers are involved, each one may claim that the problem belongs to someone else. A capable MSP should act as the agency’s technical advocate and help identify where the failure actually occurs.

For example, slow agency-management software may involve:

• The vendor’s cloud platform
• The office internet connection
• DNS performance
• The employee’s computer
• Browser settings
• Security software
• A local network problem

8. Review Strategic Planning and Reporting

Managed IT should include more than responding to tickets. The provider should help leadership make informed technology and budget decisions.

Strategic Services May Include

• Quarterly technology reviews
• Hardware lifecycle planning
• Software and licensing reviews
• Cybersecurity roadmaps
• Backup and recovery planning
• Technology budgeting
• Office move planning
• Merger and acquisition support
• Cyber insurance readiness
• Policy and procedure guidance

What a Quarterly Review Should Cover

A useful quarterly business review may include:

• Ticket trends
• Recurring problems
• Response-time performance
• Cybersecurity findings
• Patch and device status
• Backup results
• Recovery tests
• Microsoft 365 risks
• Upcoming renewals
• Hardware replacements
• Recommended projects
• Budget forecasts

Ask Who Provides Strategic Guidance

Some providers call this role a virtual chief information officer, or vCIO. Ask:

• Who will perform the role?
• How often will meetings occur?
• What reports will be provided?
• How are recommendations prioritized?
• Is strategic planning included in the monthly fee?

9. Compare Total Pricing, Scope, and Exclusions

MSP pricing should be compared using total annual cost rather than the monthly fee alone.

Managed IT services for a 25–50 employee agency may fall within a broad range of approximately $100–$275 per user per month, depending on support coverage, cybersecurity, backup, cloud licensing, onsite service, and included projects.

Actual pricing varies significantly. The agency should request a detailed proposal based on its systems and requirements.

Common Pricing Components

• Per-user managed services
• Per-device management
• Microsoft 365 licensing
• Cybersecurity tools
• Backup services
• Cloud services
• Onboarding fees
• Project labor
• Onsite support
• After-hours support
• Hardware and software

Questions About Included Services

1. Are unlimited help desk requests included?
2. Is onsite support included?
3. Is after-hours support included?
4. Are employee onboarding and offboarding included?
5. Is Microsoft 365 administration included?
6. Is vendor coordination included?
7. Are backup restorations included?
8. Are cybersecurity investigations included?
9. Are quarterly planning meetings included?
10. Which changes are considered projects?

Compare Proposals Side by Side

Category	Provider A	Provider B	Provider C
Monthly recurring fee	Document amount	Document amount	Document amount
Help desk hours	Document coverage	Document coverage	Document coverage
Cybersecurity	List included controls	List included controls	List included controls
Backup and recovery	List included systems	List included systems	List included systems
Microsoft 365	List included services	List included services	List included services
Onsite and after-hours work	Document fees	Document fees	Document fees
Projects	Document exclusions	Document exclusions	Document exclusions
Annual estimated total	Calculate total	Calculate total	Calculate total

A lower monthly price may become more expensive when required security, backup, onsite labor, and routine administration are billed separately.

10. Evaluate Onboarding, Documentation, and Termination Procedures

The MSP transition process reveals how organized the provider is. A strong onboarding plan should protect security and reduce disruption.

Typical MSP Onboarding Steps

1. Review the existing IT agreement and responsibilities.
2. Inventory employees, devices, applications, and vendors.
3. Collect technical documentation securely.
4. Verify administrative account ownership.
5. Assess cybersecurity and backup risks.
6. Deploy monitoring and support tools.
7. Confirm Microsoft 365 configuration.
8. Test backup and recovery.
9. Introduce the help desk process to employees.
10. Create a 30-, 60-, and 90-day improvement plan.

Documentation the Agency Should Retain

The agency should have appropriate access to:

• Device inventory
• Application inventory
• Vendor contacts
• Microsoft 365 tenant ownership
• Domain ownership
• Network diagrams
• Backup information
• Licensing records
• Administrative account procedures
• Recovery plans

Sensitive passwords should be stored securely rather than placed in ordinary documents or email.

Review the Termination Clause

Before signing, ask:

• How much notice is required?
• Are early termination fees charged?
• Who owns the documentation?
• Who owns hardware and licenses?
• How will accounts and passwords be transferred?
• Will the provider cooperate with a replacement MSP?
• Are offboarding fees charged?
• When will monitoring tools be removed?
• How long will backup data remain available?

A professional provider should have a documented exit process even when it expects the relationship to continue for many years.

How to Score MSP Candidates

Use a weighted evaluation rather than choosing a provider based on one impressive presentation.

Category	Suggested Weight
Cybersecurity and risk management	20%
Support and response process	20%
Insurance experience and vendor coordination	15%
Backup and disaster recovery	15%
Microsoft 365 and cloud management	10%
Strategic planning and reporting	10%
Pricing and contract terms	10%

Score each category from 1–5:

• 1: Requirement is not met.
• 2: Requirement is partially addressed.
• 3: Requirement is adequately met.
• 4: Provider demonstrates a strong process.
• 5: Provider provides evidence, reporting, and relevant results.

Multiply each score by the category weight to create a more objective comparison.

Documents to Request From an MSP

Depending on confidentiality and the stage of evaluation, request appropriate documentation such as:

• Sample service agreement
• Detailed scope of services
• Response-time definitions
• Escalation process
• Sample quarterly report
• Onboarding project plan
• Cybersecurity overview
• Incident response process
• Business continuity information
• Proof of insurance
• Client references
• Pricing and rate schedule
• Termination procedure

The MSP may appropriately protect sensitive internal security information. It should still provide enough evidence for the agency to evaluate its processes.

Red Flags When Choosing an MSP

• The provider proposes a solution before understanding the agency.
• The proposal contains vague descriptions without specific deliverables.
• Cybersecurity consists only of antivirus.
• The provider cannot explain who monitors alerts.
• Response time is defined only as an automated acknowledgment.
• Support depends on one technician.
• Backup restoration has not been tested.
• Microsoft 365 administration is treated only as license resale.
• The provider avoids discussing exclusions and project charges.
• There is no quarterly planning process.
• Client references are unavailable.
• The provider will not explain its onboarding process.
• Contract termination and data transfer are unclear.
• The agency does not retain ownership of its domain or Microsoft tenant.
• The provider pressures leadership to sign before contract review.

Positive Signs of a Mature MSP

• The provider asks detailed business and risk questions.
• Recommendations are tied to agency priorities.
• Support targets are measurable.
• Cybersecurity is layered and actively managed.
• Backups are tested.
• Microsoft 365 is reviewed regularly.
• Documentation is maintained.
• Several technicians understand the environment.
• Vendor coordination is clearly defined.
• Leadership receives scheduled technology reviews.
• Pricing and exclusions are transparent.
• The onboarding plan includes measurable milestones.
• The provider can describe relevant client results.

Questions to Ask MSP References

1. How long have you worked with the provider?
2. How many employees does your organization have?
3. How quickly does the provider respond to urgent issues?
4. Are problems resolved permanently or repeatedly reopened?
5. How does the provider communicate during outages?
6. Has the provider improved your cybersecurity?
7. Has backup recovery been tested?
8. Are invoices predictable?
9. Are projects completed on schedule?
10. Does leadership receive useful strategic guidance?
11. How does the provider handle mistakes?
12. What would you change about the relationship?

Speak with references that have a similar employee count, industry, and technology environment whenever possible.

A 45-Day MSP Selection Timeline

Days 1–5: Define Requirements

• Identify current technology problems.
• Document employee count and locations.
• List critical applications and vendors.
• Define support-hour expectations.
• Identify cybersecurity and recovery requirements.
• Establish an estimated budget.

Days 6–15: Interview Providers

• Meet with two to four qualified MSPs.
• Provide consistent information to each provider.
• Ask the same core evaluation questions.
• Request relevant examples and references.

Days 16–25: Review Proposals

• Compare scope and exclusions.
• Evaluate security and backup services.
• Calculate estimated annual cost.
• Score each provider using weighted criteria.
• Request clarification where proposals differ.

Days 26–35: Complete Due Diligence

• Interview references.
• Review contract terms.
• Verify insurance and business information.
• Review onboarding and transition plans.
• Confirm account and documentation ownership.

Days 36–45: Select and Plan

• Choose the provider.
• Approve the final scope.
• Notify the current provider according to the contract.
• Create a transition calendar.
• Assign agency and MSP responsibilities.
• Communicate the new support process to employees.

A Practical MSP Selection Scenario

Consider a 40-person insurance agency evaluating three providers.

Provider A offers the lowest monthly price but excludes onsite support, cybersecurity training, Microsoft 365 backup, and most project work.

Provider B offers a mid-range price with help desk support, endpoint security, email protection, Microsoft 365 administration, backup, quarterly planning, and vendor coordination.

Provider C offers the highest price and advanced security services but has limited insurance experience and slower onsite availability.

The agency scores each provider using weighted criteria:

Category	Provider A	Provider B	Provider C
Cybersecurity	2	4	5
Support process	3	5	4
Insurance experience	2	5	2
Backup and recovery	2	4	5
Microsoft 365	3	5	4
Strategic planning	1	4	4
Pricing transparency	2	5	4

Provider B is not the cheapest or the most technically advanced in every category. It earns the strongest overall score because its service model best fits the agency’s support, security, industry, and budget requirements.

MSP Evaluation Checklist for Insurance Agencies

• The provider has relevant insurance experience.
• Client references have been reviewed.
• Cybersecurity controls are clearly documented.
• Security alerts receive active investigation.
• The provider protects its own administrative access.
• Response times are measurable.
• Escalation procedures are defined.
• After-hours coverage is documented.
• More than one technician can support the agency.
• Microsoft 365 security and administration are included.
• Backup scope and retention are documented.
• Recovery testing is included.
• Vendor coordination responsibilities are clear.
• Quarterly strategic reviews are included.
• Hardware and software planning are included.
• Pricing and exclusions are transparent.
• Project charges are clearly defined.
• The onboarding plan has milestones.
• The agency retains ownership of critical accounts and data.
• The termination and transition process is documented.

Frequently Asked Questions

How many MSPs should an insurance agency evaluate?

Evaluating two to four qualified providers usually creates enough comparison without making the process unmanageable. Each provider should receive the same core requirements.

How long should MSP selection take?

A thorough evaluation may take approximately 30–60 days, depending on contract review, technical assessment, references, and the complexity of the environment.

Should an insurance agency choose the cheapest MSP?

Not automatically. Compare cybersecurity, support, backups, Microsoft 365, vendor coordination, projects, exclusions, and total annual cost before making a decision.

Does an MSP need insurance-industry experience?

Industry experience is valuable because the provider understands agency workflows and common applications. It should still demonstrate strong technical, security, and service-management capabilities.

What response time should an MSP provide?

A critical outage or security incident should generally receive a qualified response within approximately 15 minutes. High-impact issues may receive a response within 30–60 minutes, while routine requests may reasonably take 2–8 business hours.

Should cybersecurity be included in managed IT?

Core cybersecurity controls should be integrated into the service. The proposal should identify which protections are included and which advanced services require additional fees.

Should the MSP manage Microsoft 365?

Yes, when Microsoft 365 is part of the agency’s environment. Management should include identity, security, administration, external sharing, user lifecycle, and license review.

Who should own the Microsoft 365 tenant and domain?

The agency should retain ownership and appropriate control of its Microsoft tenant, internet domain, and critical business accounts. The MSP may receive delegated administrative access.

Should an MSP provide unlimited support?

Unlimited support can improve cost predictability, but the agency should review exclusions. Projects, major migrations, hardware, and certain after-hours work may still be billed separately.

How often should the MSP meet with agency leadership?

Quarterly strategic meetings are appropriate for many 25–50 employee agencies. More frequent meetings may be useful during onboarding, major projects, or periods of rapid growth.

Can an MSP guarantee that the agency will never experience downtime?

No provider can eliminate every outage. A mature MSP should reduce preventable failures, respond quickly, maintain tested recovery options, and communicate effectively.

What is the biggest MSP contract risk?

Common risks include vague scope, unclear exclusions, weak termination procedures, provider-controlled accounts, untested backups, and security responsibilities that are not clearly assigned.

Choose an MSP Based on Evidence, Fit, and Total Value

An insurance agency should select an MSP based on the provider’s ability to support employees, secure client information, manage cloud systems, coordinate vendors, recover from outages, and provide predictable technology planning.

Use the 10-part framework:

1. Confirm insurance experience.
2. Evaluate cybersecurity.
3. Review response times.
4. Verify staffing and support coverage.
5. Assess Microsoft 365 expertise.
6. Examine backup and recovery.
7. Confirm vendor coordination.
8. Review strategic planning.
9. Compare complete pricing.
10. Evaluate onboarding and exit procedures.

Score each provider using the same criteria, verify claims through documentation and references, and compare the total value over 12–36 months.

911 IT has served businesses since 2004 and provides managed IT services, cybersecurity services, backup and business continuity, Microsoft 365 and cloud services, and 24/7 access to U.S.-based support.

Evaluating IT providers for your insurance agency? Schedule a discovery call with 911 IT to compare support coverage, cybersecurity, Microsoft 365 management, backup, vendor coordination, pricing, and transition requirements.