The purpose of this article is to share common best practices and Managed IT Services RFP Examples. Managed IT services are a big part of any company’s IT support structure. Some companies subscribe to managed services for specific components of their infrastructure and others encompass a lot more. Examples of some of the offerings in the managed services space include the following:
- Managed Firewall Services
- Managed Backup and Disaster Recovery Services
- Help Desk
- vCIO
- vCISO
- Carrier Broker Services
- Staff Augmentation
- Managed Detection and Response (Managed Security Service Provider)
- Managed Patching and General Monitoring
You should consider the type of services you would like a managed service provider (MSP) to take on, their experience and their geographic locations in comparison to yours. I wrote an article about the 8 managed IT service trends to look out for in 2023 that would be relevant for anyone looking at this service this year.
Example Sections of an RFP for Managed IT Services:
- Table of Contents
- Request for Proposal (RFP) Goals, Scope and Overview
- Key Dates and Timeline
- No Obligation / No Guarantee
- Non-Disclosure Agreement (NDA)
- Contact Information
- Introduction to Your Company
- Overview of Your Current IT Environment
- Service Requirements
- Response Contents and Format
- Vendor Information and Company Background
- Vendor Pricing Structure
- Vendor Proof of Insurance
- Vendor Proof of Financial Strength
- Vendor Proof of Cyber Security Controls
- Terms of Agreement
- Price Increases
- References
- Discoveries, Final Interviews and Vendor Award Notice
RFP Goals, Scope and Overview
Most of the items on this list are self-explanatory. A clear RFP overview should be provided that discusses what your organizational goals are and answers questions like why you are looking to get managed IT services.
Key Dates and Timeline for RFP
You want to provide a list of key dates for your vendors so that expectations are clear for both parties. Those dates include RFP release date, due date for questions, release of answers to questions, RFP submission deadline, week of interviews, and the date for the award notice.
No Obligations, No Guarantee
No Obligations and No Guarantees is a clause in the RFP that is meant to describe that just because the RFP is being released, there is no guarantee that any vendor will be awarded the business. By responding to the RFP, they are acknowledging the business has the right not to make a selection.
RFP Non-Disclosure Agreement
A Non-Disclosure Agreement signals to your vendors that you want to keep the RFP confidential, and that any information obtained through the process of the RFP is to be held secret.
Contact Information for Managed Services RFP
You will want to assign a primary contact person from your organization who will manage the communication between vendors for the RFP. This should be listed in the RFP with a clause that vendors do not reach out to anyone else at your company about the RFP.
Company Overview Section
When describing your company to vendors, there are key pieces of information to include. You want to make sure to include your industry, your business growth plans, how many locations you have, how many employees, and how many users. Clearly defining these items will give your vendors key pieces of information that will directly impact their pricing structures. You also want to include how your business is structured and your company mission statement. Are you an ESOP? Family/woman/minority owned? Is your company publicly traded? Articulating these points can help you understand how your vendors align from a culture standpoint.
Overview of Your Current IT Environment
For this section of the RFP, you will want to make sure to list out all the infrastructure in scope. Here is a list of things you should add if you have it:
- Firewalls
- Switches
- Access Points
- Servers
- Storage Devices
- Backup Devices
- Virtualization (Hyper-V or VMware)
- Operating System Editions
- Antivirus/endpoint protection software
- Backup Software
- Offsite Backups (Yes or no and where/how they are backed up)
- Cloud Services the new vendor would manage (Office 365, G-Suite, Azure, AWS, etc.)
- Current Remote Management Tool (if you have a vendor, what are they using?)
- Any software being provided as a service by your current vendor (end user security training, endpoint backup, MFA software, etc.)
Service Requirements
Listing out your service requirements is your chance to clearly articulate what you are looking for in the services a new vendor would provide. You will dive deep into the granular details of the service you are looking for and your expectations. This includes asking your vendors to respond to how they will meet your service requirements. Since the purpose of this article is to provide Managed IT service RFP examples, a list of example service requirements is provided below.
- Help desk and end user support (either 24×7 or 8AM-5PM M-F)
- Proactive monitoring, maintenance, and remediation of critical infrastructure alerts (either 24×7 or 8AM-5PM M-F)
- Patching of Windows-based systems
- Patching critical infrastructure firmware
- Manage backup system and perform monthly test restores
- Disaster recovery testing
- Provide monthly health reports on critical infrastructure
- Provide annual technology plan
- Asset Inventory and Lifecycle Management
If you are subscribing to help desk services, then you should be requesting metrics along with your service criteria. Your vendors may be able to check the box on each of these items but how well are they able to execute? You should request information that helps you understand their overall ability to provide managed IT services. Some questions you can ask include:
- What is your live call answer rate? This number should tell you a percentage of the time that calls are answered vs going into a voicemail.
- What is your average hold time? If calls are not answered, do they go into a queue or a voicemail? If so, how long are end users waiting to get a response?
- What is your Mean Time To Respond (MTTR) to critical alerts where an actual live person is working on a situation?
- What are your service level goals?
- How do you measure customer satisfaction and what is your current rating?
Response Contents and Format
How do you want to receive the RFP? It is important to document clear instructions to bidders how they can submit their RFP. Do you have a secure FTP website they can upload their documents to? Is plain text e-mail okay or do they need to send it via encrypted e-mail? Can your vendors send you a physical copy via postal services? You should clearly articulate your goal here so vendors know how to submit it to you.
Vendor Information and Company Background
Learning who your vendors are will be a key selection criteria for you. Each vendor is different and has different history of how they evolved into who they are today. For example, if you are a Microsoft shop, you would not want to bring in a vendor who had been traditionally focused on Apple and just recently started learning Microsoft. Ask them what their experience is in with the technologies you have in place today. Find out how long they have been in business. Here are some additional questions you can ask to help you find your new managed services provider:
- Do you have a geographical footprint that matches ours?
- Where are your staff located? Do you outsource staffing to outside of the U.S.?
- hat level of Engineers do you have on staff and can you assist with future projects?
- Please list highest important IT certifications held by your staff.
- Please list your most valued partnerships with IT manufacturers (e.g. Microsoft, Cisco, Dell, HPE, VMware, Apple, etc.)
- How do you train your staff to respond to cyber security incidents?
These are all important questions to ask your vendors which will help you make your selection. The reason you are asking these questions is to make sure they can execute on your expectations. You would not want to partner with an organization who does not have a regimented process to responding to an e-mail getting compromised or a ransomware event.
Vendor Pricing Structure
Your goal in understanding the vendor’s pricing structure is to know how it will impact you if you grow, expand, shrink, or divest your business. There are several ways a vendor charges for their rates. Examples of common approaches are provided below:
- Per device (PC, switches, firewalls, servers, and storage devices all may have their own rates)
- Per user
- Per hour
- Per resource (Help desk technician, Engineer, vCIO/CTO may all be examples of resources consumed)
Additionally, you need to understand travel and trip charges. These are often charged for work that requires onsite services, such as setting up a new PC. You also need to ask about overages. Overages can occur if a vendor spends more time servicing your company than they anticipated. This should be spelled out in their response to your RFP. All of these factors can be mixed and matched by vendors with some offering “all you can eat” packages. Keep in mind that even these “all you can eat” packages may contain clauses that work as a backstop to allow your vendor to charge extra if needed.
Vendor Proof of Insurance
You will want to make sure your vendor has insurance and provides you with the proof of it. This includes Cyber Insurance, General Liability, Auto Liability, and Workers Compensation. These should be provided to you without hesitation.
Vendor Proof of Financial Strength
Partnering with a vendor that is in poor financial health could result to some bad experiences. If you pick a vendor that is not managing their money well, it could result in them losing employees, getting price increases, or being acquired by another firm. Any of these situations could lead to a poor experience for you.
Vendor Proof of Cyber Security Controls
Cyber security has become a foundational requirement for managed services providers. You should trust but also verify that your vendors have strong cyber security controls in place by requesting proof of a recent audit. Many managed services providers are seeking to become SOC 2 certified at some level (I or II).
Terms of Agreement
Your goal in getting terms should be in favor of your business. You should not seek an agreement that locks you in for multiple years. This has become a theme among managed service providers to give them predictable income streams. While this is great for them, it can leave you in a bad situation if you need to exit the agreement. You should seek a month-to-month agreement or other form of short term agreement with the option to renew to give you the most flexibility. Common reasons for needing to exit a managed services agreement include the following reasons:
- Service issues (make sure they have a clause for exiting the relationship based on poor performance).
- M&A (you may need to exit the agreement if you are acquired and need a way out). There should be no penalties for exiting based on M&A activities
- Desire to in-source IT. If you need to bring in technology leadership such as an IT Director or CIO, they may have other ideas on how to provide IT support.
Price Increases
It’s important you call out price increases in your RFP. This provides you long term price protection. Typically, managed services providers will raise their prices annually to adjust for inflation and their cost of goods/services sold. You need to request they articulate their price increases and come to an agreement on what that should look like for you. Get this in writing to protect your organization.
References
It may make sense to ask for reference clients. The one problem with asking a vendor for references is that they will always give you their best. If you have gone through the exercise of getting all the aforementioned items, then asking for multiple references with contact information so you can call them is likely going to be a waste of your time. Instead, ask them to provide you a list of customers in your vertical industry they do business with today and one or two references at most.
Discoveries, Final Interviews and Vendor Award Notice
Discoveries and final interviews are beneficial to you and your vendors. Discovery meetings happen before Q&A and allows your vendors to come into your office and learn about your business and your current IT situation. This can provide you with some insightful knowledge as typically an Engineer will come on site to look at your environment and tell you what they see.
Final interviews allow you to do one more Q&A session live. This will give you an opportunity to get a gut feeling about questions you have and how your vendors respond. It is a format that provides for much more rich dialog than can be gained through an RFP.
Once your final interviews are done and you have discussed them with other stakeholders at your organization, you can make your final selection. You should contact all vendors who responded to your RFP and let them know if they were selected or not. No more information needs to be provided beyond that to losing vendors, but you will get questions from them asking why they were not selected. Simply state that the weighted average of the RFP criteria favored another vendor.
Conclusion: RFP or No RFP?
RFPs are a lot of work for both you and the vendors involved. Nobody really likes doing them, but they have a great format which attempts to even the playing field by clearly articulating your ask across all parties. Many organizations require an RFP. If you can get by without doing one and following a format that works for you, such as the one outlined above, it will likely provide a better experience. Vendors will get a lot more excited and try harder to earn your business if you simply ask them if they want a shot at it. On the other hand, vendors who get RFPs know they are in for a lot of work with little chance of winning and may not be putting a ton of effort into their responses.