IT Services RFP Checklist: What to Ask Providers

An IT services RFP (request for proposal) works when every provider answers the same questions about the same environment. Describe your users, devices, systems and working hours, say what outcomes you need, then ask for written answers on support targets, security, data protection, contract terms and exit. Agree how you will score the replies before you read them. If you are shortlisting a managed service provider (MSP) in Dubai, send each one the same checklist and the same deadline. The answers show you which providers run a defined process and which ones are improvising, before you sign anything.

What should an IT services RFP describe about your business?

It should describe your environment clearly enough that two providers would scope the same work. Include:

• People and places: how many staff, which offices, and who works remotely or travels.
• Devices: Windows PCs, Macs, phones and tablets, and whether the company or the employee owns them.
• Systems: Microsoft 365 or other email, business applications, any server or NAS, firewalls, switches, Wi-Fi and backup tools.
• Working hours: when the business operates, including weekends, shifts and staff in other time zones.
• Rules you must follow: regulators, client contracts or data protection laws that apply to your data.
• Pain points: what goes wrong today, with two or three recent examples.
• Boundaries: what stays in-house, what you are handing over, and which vendors the provider must work with.

Give today's numbers and expected growth. A provider can only commit to targets for an estate it understands.

Which questions show how a provider really delivers support?

Ask for definitions and numbers in writing, because a support promise without a priority definition cannot be measured. Ask every provider:

• How do you define each priority level, with examples?
• What is the response target for each priority, and in which hours does each target apply?
• What is the resolution target for each priority? Response and resolution are different clocks.
• Does response mean an engineer working on the issue, or an automatic reply?
• Who does an unresolved ticket escalate to, and after how long? Ask to see the escalation matrix.
• What does your monthly report contain, and does it list every missed target?
• How do staff raise tickets: phone, email, portal or chat?
• Who are our named contacts, and who covers when they are away?
• Which work is done remotely, which needs a visit, and how is a visit booked and charged?

How should providers prove security and data protection?

Ask them to describe, in writing, the controls on their own access to your systems and data. A joint advisory from CISA, the NSA, the FBI and the national cyber security agencies of the UK, Australia, Canada and New Zealand notes that MSP services usually need privileged access to customer systems. It tells customers to check that their contracts include security measures that fit their own requirements. Questions drawn from that advisory:

• Will MFA be enforced on every account you use to reach our environment?
• Will the contract state that you never reuse admin credentials across customers?
• Will your accounts be limited to the systems you manage, on a least-privilege, need-to-know basis?
• How and when will you tell us about an incident affecting our environment?
• Which logs do you keep, and can we see your own activity and connections in our network? The advisory recommends keeping the most important logs for at least six months.
• Which backup service is included, and how does it meet our resilience and recovery requirements?
• What is your policy on software updates, and are timely updates delivered as an ongoing service?
• Which subcontractors or third-party vendors will handle our systems or data?
• Who owns hardening, detection and incident response: you or us?

If the provider will administer your Microsoft tenant, ask whether it will use granular delegated admin privileges (GDAP). Microsoft describes GDAP as least-privileged access that partners configure to be granular and time-bound, and the customer has to grant it explicitly. Ask which roles the provider will request, for how long, and why. A provider asking for permanent Global Administrator rights should explain why a narrower role will not do.

Personal data adds a legal layer. The UAE Personal Data Protection Law, Federal Decree Law No. 45 of 2021, sets general obligations for companies that hold personal data to secure it and keep it confidential, and sets requirements for transferring it across borders. Ask where your data, backups and ticket records will be stored, which countries they may move to, and how the provider will support your obligations. If you operate in the DIFC, which has its own Data Protection Law (DIFC Law No. 5 of 2020), ask the same questions against that law. Our pages on PDPL compliance and the DIFC Data Protection Law go further.

If you want a recognised framework behind your questions, NIST SP 800-161 Rev. 1 gives guidance on identifying, assessing and mitigating cybersecurity risks throughout the supply chain, and NIST publishes a fillable version of its SCRM Assessment Scoping Questionnaire (Table 26) alongside it.

What should you ask about contract terms and exit?

Ask how the contract renews and ends, and what you get back when it ends, because exit terms are hardest to negotiate once you depend on a provider. Cover:

• Term and renewal: the length of the term, whether renewal is automatic or by approval, and the notice each side must give.
• Billing basis: per user, per device or per site, how additions and removals work mid-term, and what is charged separately, such as onsite visits, projects, hardware and licences.
• Ownership: who owns the Microsoft 365 tenant, domains, admin accounts, documentation and asset register. The answer should be you.
• Handover pack: documentation, credentials, network diagrams, runbooks and licence records, delivered in a format the next provider can use.
• Access removal: written confirmation that the provider's accounts and delegated roles are removed after handover. The CISA advisory warns that disabling MSP accounts can be overlooked when a contract ends.
• Transition help: how long the outgoing provider will work with the incoming one, and on what terms.

If you are replacing a provider now, see how a managed IT handover is planned.

How do you score RFP answers fairly?

Agree the criteria and weights before you open the first reply, then score every answer on the same scale: 0 to 5 for each criterion, multiplied by its weight. The weights below are an example; adjust them to your priorities.

Ask for evidence wherever you can: a sample monthly report, an anonymised escalation matrix, an onboarding checklist, and references from organisations of a similar size that you can call. Have two people score independently, then discuss the gaps. Compare commercial offers only after you have scored quality, and compare like with like: the same scope, the same term and the same billing basis.

Which red flags should rule a provider out?

Rule out any provider that will not put its answers in writing. Other warning signs:

• No written response and resolution targets, or targets with no priority definitions.
• Shared or reused admin accounts, or a refusal to use least-privilege roles.
• A wish to own your tenant, domains or admin credentials.
• No exit terms and no handover pack.
• Claims about partner status or past work that you are not allowed to check.
• No clear line between remote and onsite work, or no explanation of how visits are charged.

How does GR answer this checklist?

With written targets for every priority. In short:

• Response: P1 in 5 minutes, 24/7, on every package. P2 in 10 minutes and P3 in 30 minutes during support hours, Monday to Friday 9:00 to 18:00 and Saturday 9:00 to 14:00. P2 and P3 run 24/7 on GR IT AMC Scale and GR Managed IT Professional, and on GR Managed IT Enterprise they are set in your contract. P4 is next business day.
• Resolution targets: P1 4 hours, P2 1 business day, P3 3 business days, P4 5 business days.
• Escalation and reporting: on our IT AMC packages, the service manager is notified within 30 minutes of a P1 ticket and a director is briefed within 1 hour, and every missed target is listed in the monthly report.
• Delivery and billing: our IT AMC and managed IT packages are annual, paid in advance, one fee per user, and delivered remotely. Onsite visits are booked and charged separately.
• Security: on our managed IT packages, Defender alerts are triaged by our Dubai-based SOC.

See the detail on our managed IT services and IT AMC pages, or compare the two models in IT AMC vs managed IT.