The short answer
A managed service provider (MSP) takes ongoing responsibility for some or all of your IT. To choose well, define the scope it will own, compare service agreements rather than marketing, check its own security (its privileged access makes its weaknesses yours), ask where your data goes and read the exit terms. Compare price last: proposals with different scope and service levels are not comparable.
Step 1: decide what you want managed
Write down what you want owned (support, monitoring, maintenance, security, planning) and what stays with you:
- Service desk
- Monitoring and maintenance
- Security operations
- Backup, recovery and power resilience
- Identity and Microsoft 365 or Google Workspace
- Projects (usually quoted separately)
- Planning
Examples for each component
| Component | Examples |
|---|---|
| Service desk | User support by phone, email, portal; hours of coverage |
| Monitoring and maintenance | Servers, network, endpoints, cloud services, patching, internet links and failover |
| Security operations | Endpoint detection and response, email security, alert monitoring |
| Backup and recovery | Backup management, restore testing, disaster recovery planning, and resilience to power cuts (UPS, inverter or generator cover for critical equipment) |
| Identity and Microsoft 365 or Google Workspace | Accounts, licences, access, configuration |
| Projects | Migrations, office moves, new systems (usually quoted separately) |
| Planning | Technology roadmap, budgeting, vendor management |
Then choose the model: fully managed suits organisations without internal IT staff; co-managed suits those with an IT lead or team wanting extra capacity, after-hours coverage or specialist skills (see co-managed IT).
Step 2: compare service agreements
The agreement is where promises become obligations. Compare coverage hours for support and monitoring (24/7 monitoring is not 24/7 help desk staffing), response and resolution targets by priority, escalation and named contacts, communication methods, billable extras (after-hours, onsite, projects, new users), reporting (tickets, targets met, patches, backups, security alerts) and what happens when targets are consistently missed. Good practice is to define all of these; if a proposal leaves any out, ask for them in writing.
Step 3: test the provider's own security
Remote management tools give an MSP administrative access to many clients at once, which makes it an attractive target. Test its controls with the security items in the checklist below (MFA, named least-privilege accounts, credential storage, staff screening, prompt incident notification, evidence): these are standard expectations. It should also help you meet baseline controls (patching, strong authentication, backups, awareness training), with the NIST Cybersecurity Framework as a common language; ngCERT is the national reference for threat advisories and incident guidance.
Step 4: data location, data protection and subcontractors
Your provider will see personal data such as staff records, customer emails and files. Under the Nigeria Data Protection Act 2023 (NDPA) you stay responsible for personal data a provider processes for you: use a written contract stating what it may do and the safeguards it must apply. The Nigeria Data Protection Commission (NDPC) publishes the Act and its General Application and Implementation Directive (GAID) 2025. Ask where its tools, logs and backups are hosted; who, including subcontractors and offshore staff, may access your data; whether it supports your sector rules (NDPA rules for health data, which is sensitive personal data, or your regulator's); and, if data leaves Nigeria, how NDPA transfer rules apply and whether it will report breaches fast enough for the 72-hour notification duty to the NDPC where it applies. Banks, payment service providers, insurers, pension and capital-market operators should also check their regulator's outsourcing and third-party risk requirements (Central Bank of Nigeria, SEC Nigeria, NAICOM or PenCom). This is general information, not legal advice.
Step 5: onboarding and exit
Good onboarding is a project (discovery, documentation, access handover, security fixes, agreed baselines): ask for a sample plan and sample documentation. Plan the exit before you enter, using the exit items below.
Red flags and pricing
- Vague answers on who can access your systems
- No written agreement, or unmeasured targets
- Reluctance to put admin accounts and domains in your name
- Pressure to sign long terms before discovery
- Security claims without evidence
Compare total annual cost, with every cost as an estimate in naira (or US dollars where a licence or service is priced in dollars), and ask how dollar-priced items are adjusted if the exchange rate moves.
Pricing models
Pricing is per user, per device, tiered bundles or blocks of hours. Per-user pricing is simple to budget but may not suit organisations with many shared devices. Ask for onboarding, licences resold by the provider and typical project work to be included in the estimates.
Comparison checklist
Scope
- Components to be managed listed, with what stays in-house
- Fully managed or co-managed model chosen
Service
- Coverage hours for support and monitoring confirmed in writing
- Response targets, escalation and reporting defined
- Included and billable work clearly separated
- Remedies for consistently missed targets
Security
- Multi-factor authentication on all provider tools confirmed
- Named, least-privilege technician accounts
- Incident notification process and timing agreed
- Credential storage, staff screening and leaver access removal reviewed
- Security framework for its own operations shown with evidence
Data and data protection
- Hosting location of tools, logs, ticketing and backups documented
- Subcontractors and offshore access disclosed
- Data processing and confidentiality terms signed
- Sector rules and NDPA transfer rules that apply to us supported
- Breach notification fast enough for the NDPC 72-hour duty
Exit
- Ownership of documentation, configurations and scripts stated
- Credential, licence and domain handover process defined
- Transition assistance, its cost and notice period agreed
- Tools licensed in the provider's name identified
Limitations
No checklist replaces references from clients of similar size and sector, a trial of how a provider communicates, and a clear onboarding period. Our managed IT services page explains how we scope, onboard and report.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023 and GAID 2025, Nigeria Data Protection Commission
- Cybersecurity advisories and incident guidance, ngCERT
- NIST Cybersecurity Framework, National Institute of Standards and Technology
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.