Skip to content

Free scorecard · 30 questions

Is your MSP built for a plant?

Score a current provider or a candidate across the 30 factors that matter in a production environment. You get a weighted score out of 100 and a list of where to press for evidence. Results show instantly, no email required. Comparing more than one provider? Grab the full toolkit at the end.

Manufacturing & operational fit · 20% of score

  1. Can the provider show relevant manufacturing, warehouse, logistics, or industrial experience and references?
  2. Does the provider understand how IT incidents affect production, shipping, inventory, quality, and customer service?
  3. Has the provider supported the infrastructure around your ERP, MES, WMS, labeling, or production-planning systems?
  4. Can the provider clearly define the boundary between IT and OT responsibilities?
  5. Does the provider have a documented approach for working with plant engineering, OEMs, ERP vendors, and carriers?
  6. Can the provider support multi-site operations, remote facilities, warehouses, and operational wireless?

Cybersecurity & IT/OT risk · 35% of score

  1. Does the provider enforce MFA for remote access, cloud services, and privileged accounts?
  2. Does the provider use modern endpoint security with monitoring, alerting, investigation, and response?
  3. Does the provider provide layered email security and practical phishing-awareness training?
  4. Does the provider prioritize vulnerabilities by exposure, exploitability, business impact, and operational safety?
  5. Can the provider design and manage segmentation, separate IT/OT zones, and an industrial DMZ where appropriate?
  6. Does the provider secure vendor remote access with MFA, least privilege, time limits, approvals, and logging?
  7. Does the provider provide 24/7 monitoring with defined alert-response and escalation procedures?
  8. Does the provider have a documented, tested incident-response plan with production-impact escalation?
  9. Does the provider maintain asset inventory, lifecycle tracking, and risk treatment for legacy systems?

Service delivery & incident response · 20% of score

  1. Does the provider prioritize and escalate incidents by operational and business impact?
  2. Is 24/7 remote response available, with clearly defined after-hours escalation and communication?
  3. How does the provider coordinate onsite support for production-impacting incidents at your locations?
  4. Are response, escalation, communication, and onsite commitments clearly defined in the agreement?
  5. Does the provider maintain current documentation for networks, systems, credentials, vendors, and recovery?
  6. Does the provider run regular operational reviews with meaningful reporting on incidents, security, and risk?

Infrastructure, cloud & business continuity · 15% of score

  1. Can the provider evaluate cloud, hybrid, and on-premise options by dependencies, latency, security, and cost?
  2. Does the provider have demonstrated Microsoft 365, Entra ID, Azure, Intune, and Defender expertise where relevant?
  3. Does the provider manage networks, firewalls, switching, wireless, and connectivity with proactive monitoring?
  4. Does the provider define RTO and RPO targets with business stakeholders and align recovery priorities?
  5. Does the provider support protected backup copies, restore testing, and documented recovery procedures?

Commercial terms, governance & transition · 10% of score

  1. Is the scope clear about included services, exclusions, client responsibilities, and project work?
  2. Do you retain ownership of and access to documentation, admin credentials, configs, and backup data?
  3. Are pricing, change control, project costs, and service-review processes transparent?
  4. Does the agreement include practical onboarding, transition, offboarding, and knowledge transfer?