MSP Outsourcing RFP Template

• MSP legal name - [NAME]
• Operating regions - [REGIONS]
• Proposal contact - [CONTACT]
• Questions due - [DATE]
• Proposal due - [DATE]
• Target pilot start - [DATE]
• Target production start - [DATE]
• Proposal validity period - [DAYS]
• Required response format - complete the matched response table and attach evidence

For each row mark required, optional, or excluded. The provider must state the exact boundary and escalation point.

The provider must describe:

• shared, dedicated, overflow, or hybrid staffing
• service-delivery locations and timezone coverage
• direct end-user contact policy
• phone greeting, email domain, portal, and caller ID branding
• ownership of tickets, documentation, scripts, and recordings
• use of subcontractors
• background-check and training practices
• client-specific runbook handling
• conflict escalation and executive escalation

The provider must define each clock's start and stop event, pause conditions, business-hour treatment, holiday treatment, reporting period, breach review, and remedies. Receipt acknowledgement, qualified work start, mitigation, service restoration and permanent resolution are distinct measures.

For each required platform provide:

• supported workflow and direction
• objects created or updated
• tenant mapping
• authentication method
• least-privilege permissions
• credential owner
• audit log
• failure and retry behavior
• sandbox or pilot test
• offboarding and credential revocation

Logo presence does not count as implementation evidence.

The provider must provide evidence or mark the item unavailable:

• security program owner
• current certifications and audit scope
• workforce access controls
• MFA enforcement
• privileged access management
• endpoint security
• logging and monitoring
• vulnerability management
• incident notification window
• subcontractor controls
• data locations and transfers
• retention and deletion
• business continuity and recovery testing
• cyber insurance status
• most recent independent assessment date

Provide the owner, duration, dependency, and acceptance evidence for:

1. Discovery and inventory.
2. Tool access and tenant mapping.
3. Runbook and knowledge transfer.
4. Ticket taxonomy and severity mapping.
5. Branding configuration.
6. Pilot client selection.
7. Test cases and shadow period.
8. Production cutover.
9. First-week review.
10. Thirty-day review.

Also provide exit assistance, data export, credential removal, knowledge return, and transition charges.

State the rate period and invoice calendar for every recurring line. Keep a four-week rate with its original unit and invoice dates; provide any calendar-month comparison amount with its conversion assumptions. State the initial commitment, renewal period and notice deadline separately from payment frequency. Identify prepaid recurring charges so they are not counted again as one-time fees.

State taxes, annual increases, renewal, cancellation, payment terms, credits, and any charge omitted from the table.

For every included allowance, state the quantity, unit, reset period, pooling rules, expiry or rollover and overage rate. Define what counts as a ticket, call, user, device or labor hour. Explain whether reopened tickets, duplicate alerts and automated contacts consume the allowance. Keep separate limits for first-line contact and advanced remediation.

The buyer should add its retained MSP management cost after the supplier service-fee minimum. This is a buyer expense, not a fee the provider is assumed to quote. Do not charge the same usage twice in normalized usage and additional overage.

• sample monthly report
• sample escalation record
• sample anonymized ticket trail
• certificate or audit evidence
• continuity test summary
• integration documentation
• standard agreement and SLA
• data processing terms
• reference eligibility and permission

Set weights before proposals are opened.

Unknown fields receive no assumed value. A mandatory gate failure disqualifies the proposal regardless of total score.

Complete this section when the proposed service uses AI agents, automated intake, triage or remediation. Mark the section not required if these actions are excluded. A bot acknowledgement does not demonstrate qualified work start, service restoration or permanent resolution. Define the human fallback within the same service window and SLA table.

Ask the provider to demonstrate an approval-required action, an unavailable human recipient and access revocation in the limited pilot. Keep outcomes blank until observed. Agree who can stop automation and how open tickets return to a named human owner.