MSP and MSSP RFP Template for Mid-Sized Businesses

An MSP and MSSP RFP template gives a mid-sized business one document for evaluating a provider's IT operations, security operations, and compliance support side by side. The free template below has eight sections, 29 core questions, and a short module for healthcare, legal, financial services, or manufacturing. It also includes a weighted scorecard and the security checkpoints every provider should pass before you score anything else.

It is built for IT leaders, operations executives, and CFOs at organizations that answer to auditors, examiners, or cyber insurers. Copy the template, replace every [bracket], keep the industry module that fits your business, and send it to three to five providers. Each question asks for a specific, checkable answer, so the differences between providers show up on paper before they show up in your environment. 

Get the editable version: Download the MSP and MSSP RFP template (Word) and Scorecard (Excel). 

In this Article

• Why one RFP should cover both MSP and MSSP services
• The template at a glance 
• The free MSP and MSSP RFP template
• Security due diligence checkpoints
• Weighted scorecard for comparing providers
• How to run the RFP in six steps
• Industry-specific questions
• Red flags in MSP and MSSP proposals
• Send us the template
• Frequently asked questions
  
  

Why one RFP should cover both MSP and MSSP services

Your IT provider is now one of your largest security exposures, so it should be evaluated with the same rigor as your security provider. The share of breaches involving a third party doubled to 30% in Verizon's 2025 Data Breach Investigations Report, and the average U.S. breach reached a record $10.22 million in IBM's 2025 Cost of a Data Breach Report.

Managed service providers are a specific target. U.S., U.K., Canadian, Australian, and New Zealand cyber agencies jointly warned that attackers go after MSPs because the privileged access MSPs hold can cascade into every customer. The same advisory urges customers to confirm their contracts actually include the security controls they expect.

Regulators have also turned vendor oversight into a written requirement for many mid-sized firms:

• Financial institutions under the FTC: the Safeguards Rule requires firms to select capable service providers, require safeguards by contract, and reassess them periodically.
• SEC-registered advisers and broker-dealers: amended Regulation S-P requires oversight of service providers, including notice of a breach within 72 hours, with smaller entities required to comply by June 3, 2026.
• Healthcare organizations: HIPAA requires written satisfactory assurances from any business associate that handles protected health information.
• Everyone else: NIST CSF 2.0 added a supply chain risk management category (GV.SC) that calls for security requirements in supplier contracts and for planning what happens after an agreement ends.

Separate RFPs for IT and security tend to produce separate vendors, and separate vendors split accountability during an incident. If you are still deciding which model fits, start with our breakdown of MSP vs. MSSP vs. vCISO roles. Then use this template to test any provider, integrated or not, on the same questions.

The template at a glance

The template groups 29 questions into seven core sections, plus an industry module. Each section tests one thing a proposal deck rarely shows.

The free MSP and MSSP RFP template

Copy everything from "Request for Proposal" through Section G into your own document, then add the industry module from the next section. Or download our editable template and score card. Notes in italics explain why each section matters and what a strong answer looks like; delete them before you send.

Request for Proposal: Managed IT and Cybersecurity Services

Issued by: [Company Name] Issue date: [Date] Responses due: [Date] Submit responses and questions to: [Name, email]

Purpose. [Company Name] is evaluating managed services providers to deliver integrated IT and cybersecurity services for [number] employees at [location(s)]. We are seeking a single provider accountable for day-to-day IT operations, security operations, and strategic technology guidance. Concise, factual answers are preferred over marketing language.

Instructions to respondents

• Answer each question in order, keeping the question numbering. A few sentences per question is sufficient.
• For each service area, state whether it is included in base monthly pricing, available as an add-on, or not offered.
• Where a capability is provided through a third party or subcontractor rather than your own staff, say so explicitly.
• Claims of certification or compliance experience must be supportable by evidence on request.

Section A: Company Profile

Complete the table. Short, factual entries are sufficient.

Why it matters: A.4, A.6, and A.7 separate providers that run security from providers that resell it. A strong answer names a security headcount, attaches or offers the SOC 2 Type II report under NDA, and lists exceptions instead of hiding them.

Section B: Service Model

B.1 Are managed IT, managed cybersecurity, and strategic advisory (vCIO / vCISO) delivered by a single integrated team under one agreement? Identify any service you do not deliver with your own staff.

B.2 During a security incident, how many separate organizations are involved end to end, and who holds single-point accountability for resolution?

B.3 Do you provide a named vCISO and/or vCIO, and what does this role own?

Why it matters: every handoff between organizations adds delay and finger-pointing during an incident. A strong B.2 answer gives an actual number and names the person or role accountable for resolution.

Section C: Security Operations

C.1 List the platforms you operate in production for: EDR/MDR, SIEM, email security, MFA, and managed firewalls.

C.2 Is your security operations center staffed by your own employees or a third party? If any part of monitoring or response is delivered by a third-party or white-label provider, name the provider.

C.3 During an active incident, what response actions can your team take without prior client approval (for example, isolating an endpoint or disabling a compromised account)?

C.4 What client notification timeline do you commit to contractually after a confirmed security incident?

C.5 If a confirmed incident requires forensic investigation, is that capability in-house, available via retainer, or referred out?

C.6 Do you provide security awareness training and phishing simulation? Name the platform and frequency.

Why it matters: "24/7 SOC" can mean very different things. C.2 surfaces white-label monitoring, C.3 tells you whether containment happens in minutes or waits for a phone call, and C.4 should be a number of hours written into the contract.

Section D: Cloud, Data Protection and AI

D.1 What Microsoft 365 (or equivalent) administration do you provide: tenant management, identity and access management, and device management including mobile devices?

D.2 What backup, disaster recovery, and business continuity services do you provide? Cover cloud data, retention, restore testing, and the recovery objectives you commit to.

D.3 What AI enablement services do you provide for tools such as Microsoft Copilot and other generative-AI assistants: deployment, data protection and governance, and user enablement?

Why it matters: identity is where most cloud incidents start, and untested backups fail when you need them. A strong D.2 answer states recovery time and recovery point objectives and describes how often restores are tested.

Section E: Support and Service Levels

E.1 What are your help desk contact methods, hours of coverage, and staffing locations? Is 24/7 coverage included in base pricing or an add-on?

E.2 Provide your standard response commitments by priority level (P1 to P4) and your resolution targets.

E.3 What performance metrics do you report, and at what cadence? Include customer satisfaction and first-call resolution, and state whether clients receive live dashboard access.

Why it matters: response targets without resolution targets measure how fast someone acknowledges a ticket, not how fast your people get back to work. Ask for both, plus a sample monthly report.

Section F: Account Management, Onboarding and Exit

F.1 What named roles make up the delivery team for this account, and can the individuals be identified before contract signature?

F.2 Do you conduct quarterly business reviews, and what do they cover?

F.3 Provide a high-level onboarding and transition plan, including knowledge transfer from an incumbent. Are there one-time onboarding fees?

F.4 Do you provide an exit plan at end of contract, including orderly handover of documentation, credentials, and data?

Why it matters: the sales team is rarely the delivery team. F.4 matters as much as F.3, because a provider that holds your credentials and documentation without an exit plan makes leaving expensive.

Section G: Pricing, Contract and References

G.1 What is your pricing model (per-user, per-device, flat, or hybrid)? State what is included in the base monthly fee and what is billed separately.

G.2 State your standard contract term, notice period, and termination provisions, including your obligations if your company's ownership changes during the term.

G.3 Provide two client references from organizations of similar size and industry, with contact information and a brief description of each engagement.

Why it matters: two proposals with the same monthly price can include very different services. G.2's ownership-change clause protects you if your provider is acquired mid-contract and service terms shift.

Security due diligence checkpoints

Treat these eight answers as pass or fail gates. A provider that fails any gate should not advance to scoring, no matter how strong its pricing or presentation.

The exit and ownership gates reflect a point NIST makes directly: supply chain plans should include provisions for activities after a service agreement ends. For financial firms subject to Regulation S-P, the notification gate should be no longer than 72 hours.

Weighted scorecard for comparing providers

Score only the providers that clear every gate, and set the weights before any proposal arrives. Security operations carries the most weight because it is where integrated and outsourced models differ most; adjust the other weights to match your priorities.

Section A feeds the gates rather than the score. Rate every answer on the same four-point scale:

• 0: No answer, a non-answer, or "not applicable" without explanation.
• 1: Generic or marketing language that could describe any provider.
• 2: Specific and complete, describing how this provider actually works.
• 3: Specific, complete, and backed by evidence such as a sample report, runbook, contract clause, or named reference.

To calculate a category score, average the ratings for that section, divide by 3, and multiply by the weight. A provider averaging 2.4 in Section C earns 20 of 25 points (2.4 ÷ 3 × 25). Have each evaluator score independently first, then compare notes on any category where scores differ by more than one point.

How to run the RFP in six steps

Most mid-sized organizations can move from first draft to signed agreement in six to eight weeks if the environment summary is ready before the RFP goes out.

1. Document your environment. List users, devices, locations, servers, key applications, current security tools, compliance frameworks, and the renewal date of your current contract. Attach this as an appendix so every provider prices the same scope.
2. Set the team and the weights. Name a decision owner and two or three evaluators from IT, finance, and compliance. Lock the scorecard weights before any proposal arrives.
3. Send the RFP to three to five providers. Give them about 10 business days and one deadline for written questions. Share every clarification with all bidders.
4. Apply the gates, then score. Remove any provider that fails a security checkpoint. Evaluators score the rest independently, then meet to reconcile large gaps.
5. Test the finalists. Run the same incident scenario with each finalist's actual delivery team, not the sales team. Call both references and ask what went wrong and how the provider handled it.
6. Carry the answers into the contract. Notification timelines, response authority, SLAs, exit terms, and ownership-change protections from the RFP response belong in the master services agreement or statement of work.

For a deeper look at the contract terms in step 6, see what to review in a managed IT agreement before your next 100 hires.

Section H: Industry-specific questions

Keep the module that matches your industry and delete the rest. Each one targets the regulatory obligation that most often lands on your IT and security provider.

Healthcare

H.1 What experience do you have supporting HIPAA-regulated organizations, and will you execute a Business Associate Agreement?

H.2 How do you support HIPAA risk assessments and audit readiness?

Context: HIPAA requires written assurances from any business associate that handles protected health information, and the agreement must require the vendor to use appropriate safeguards. See how Compass supports healthcare organizations and HIPAA and HITRUST programs.

Legal

H.1 What experience do you have supporting law firms, including client-confidentiality expectations and conflict-sensitive data handling?

H.2 How do you support document retention, litigation holds, and eDiscovery?

Context: ABA Formal Opinion 477R lists due diligence on technology vendors among the reasonable steps lawyers should take to protect client information. See our approach for legal services.

Financial services

H.1 Which financial-services regulatory frameworks do you support in production (for example, the GLBA / FTC Safeguards Rule and SEC expectations), and how do you produce audit-ready evidence for examiners and auditors?

H.2 What experience do you have responding to investor, lender, or due-diligence security questionnaires on a client's behalf?

Context: the Safeguards Rule requires firms to oversee service providers by contract and through periodic assessment, and amended Regulation S-P adds a 72-hour service provider breach notice. See how Compass supports financial services firms.

Manufacturing

H.1 What experience do you have with CMMC and NIST SP 800-171, including any Cyber AB designations you hold?

H.2 How do you approach network segmentation between office IT and production systems?

Context: on July 13, 2026, the Department of War suspended CMMC Phase 2, which would have required third-party Level 2 certification starting November 10, 2026, pending a program review. Phase 1 self-assessments remain in place, and existing DFARS and NIST SP 800-171 obligations are unchanged, so H.1 still matters. See our work with manufacturers and on CMMC readiness.

Red flags in MSP and MSSP proposals

The weakest proposals tend to fail the same way: they describe tools instead of accountability. Watch for these patterns:

• Answers that skip the question. A brochure paragraph in place of B.2 or C.3 usually means the honest answer is unflattering.
• An unnamed SOC. "Our 24/7 security partner" without a name in C.2 often signals white-label monitoring with its own escalation queue.
• Response times with no resolution targets. A 15-minute response commitment means little if a P1 has no resolution target.
• Security listed as an add-on. If MFA, EDR, or backup testing sits outside the base fee, compare total cost, not the headline number.
• No exit language. A provider that cannot describe how you leave has made leaving expensive.
• References from a different world. Two references from organizations half your size, or outside your industry, say little about fit.
• Certifications without documents. A SOC 2 claim that never turns into a report under NDA does not pass the assurance gate.

If you are evaluating an incumbent provider at the same time, our MSP evaluation checklist covers the day-to-day warning signs that a provider is reacting instead of preventing problems.

Ready to start vetting MSP and MSSP? Download the Free, Editable RFP Template and scorecard. 

Send us the template

If CompassMSP is on your shortlist, send us this RFP as written. We will answer every question in writing, including each security gate, so you can score us against every other provider on the same terms. Start the conversation here, or explore how we deliver managed IT, cybersecurity and vCISO advisory, and compliance and risk management under one agreement.

Still narrowing the field? The 12-question framework for regulated SMBs is a faster first screen before you send a full RFP.