The RFP Checklist for Outsourced IT Services: 40 Questions to Ask Before You Shortlist

An outsourced IT services RFP should give providers enough context to quote accurately and ask questions specific enough that weak vendors cannot hide behind marketing language. Cover six areas: coverage, technician vetting, security, SLAs, pricing and transition. With third parties now involved in 48% of breaches (Verizon DBIR via Expert Insights, 2026), vendor diligence is security work.

Send a vague document and you will get six vague responses that all sound identical, which leaves you choosing on price and gut feeling. That is how most bad IT partnerships start. Not with a dramatic failure, but with a comparison spreadsheet where every vendor scored a 4 out of 5 on everything because nobody asked a question hard enough to produce a real answer.

The checklist below works whether you are replacing a full managed provider or buying a layer of onsite IT support services for distributed offices. It is organized by evaluation category, with 40 questions you can lift directly into your RFP document, a scoring model, and the red flags worth watching for when responses come back.

What should an outsourced IT RFP include before you ask a single question?

Providers cannot quote accurately on incomplete information, and every gap in your RFP becomes a change order later. Before the question sections, give vendors the context below. Treat it as the part of the document that earns you accurate pricing.

On scope: if you are unclear on where the line between your team and the provider should fall, thinking through how support tiers are structured first will save you a round of clarifying calls.

On response format: this one matters more than it sounds. If one provider quotes per user and another quotes per location with no common denominator, you are doing arithmetic instead of evaluation, and arithmetic is where errors live. The difference between per-user and per-device pricing models is worth understanding before you specify a format, because the model you pick shapes what you pay for three years.

Which coverage and capability questions should you ask? (Questions 1 to 8)

1. In which cities and metro areas can you dispatch a technician, and how quickly in each of our specific locations?
2. What is your average time to onsite arrival, by market, for the past 12 months?
3. Are your technicians employees, subcontractors, or a mixed network, and how does that vary by market?
4. Can you support all of our current locations, and what happens when we open a location in a market you do not currently cover?
5. Which service categories do you cover directly versus subcontract out?
6. Which of our locations fall outside your standard coverage, and under what terms would you support them?
7. What is your capacity for project work such as office buildouts, refreshes, and reimaging, running alongside day-to-day support?
8. Can you provide surge capacity for acquisitions, office moves, or seasonal spikes, and with how much notice?

Question 4 is the one that separates national providers from regional ones wearing a national logo. Ask for a coverage map, not an adjective. Better still, attach your site list and ask vendors to mark each address as covered by an existing technician, covered by travel, or not covered. The method for verifying an IT outsourcing company’s coverage claims walks through how to test those answers before you rely on them.

For multi-location IT support, also ask how the provider handles a site with very low ticket volume. Small branches are where coverage claims fail first, because a provider with no work in a market has no reason to keep a technician there.

How do you evaluate technician quality and vetting? (Questions 9 to 14)

9. What is your technician vetting process, step by step?
10. What percentage of applicants do you accept?
11. What skills do you require for each type of work, and how do you verify them?
12. What background check standard applies, and does it vary by client or market?
13. What is the average years of experience across your technician network?
14. How do you handle escalation when a technician encounters something outside their scope?

For field and onsite roles, the CompTIA A+ credential is a common baseline, and Network+ is a reasonable additional requirement for anyone touching switches or cabling. Credentials are a floor, not a guarantee, so ask how skills are checked in practice: a practical test, a supervised first job, ratings after every visit. A provider who cannot describe their vetting standards in specifics is telling you the standards do not exist.

Ask too how a technician is briefed before arriving at your site. Good providers send site notes, contact names, access instructions and the expected outcome with every dispatch. Techmate’s breakdown of building field IT capability in-house versus outsourcing it covers what good vetting actually looks like, and the guide to what a field technician does is useful for writing the skills section of your scope.

What security and compliance questions belong in an IT outsourcing RFP? (Questions 15 to 22)

15. What security attestations do you hold, and can you provide current documentation?
16. Will you sign a Business Associate Agreement or equivalent for our regulatory environment?
17. How do you provision, manage, and revoke technician access to client systems?
18. What is your process for offboarding a technician who leaves your network mid-engagement?
19. Do technicians use their own devices on client sites, and how are those devices secured?
20. What is your incident response process if a technician is involved in a security event?
21. Do you subcontract, and if so, what security standards apply to subcontractors?
22. Can you provide your most recent penetration test summary?

This is not paranoia, it is arithmetic. Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48% of confirmed breaches, up from 30% a year earlier (Expert Insights, 2026). Your IT provider will hold privileged access to your environment across every location you operate, which makes vendor security assessment part of your own security posture rather than a procurement formality.

NIST’s cyber supply chain risk management guidance includes a due diligence framework worth borrowing wholesale if your organization does not already have one. Question 21 is the sleeper: outsourcing that gets outsourced again is where accountability quietly evaporates. If a provider uses subcontractors, ask that the same access, background and offboarding rules flow down to them in writing.

Physical access deserves its own line in the RFP. A technician standing in your network closet or IDF can do more damage in ten minutes than most remote attackers can in a week. Ask how visits are logged, how badges or keys are handled, and whether you get a record of who was on site, when, and what they touched.

How should you test SLA and escalation commitments? (Questions 23 to 29)

23. What response and resolution commitments do you offer by priority level?
24. Are those commitments contractual, and what financial consequences attach to a miss?
25. How do you measure and report SLA performance, and at what frequency?
26. Can SLAs be tiered differently by location?
27. What does your escalation path look like, with named roles and time thresholds?
28. Who is our day-to-day contact, and who is the executive sponsor?
29. What reporting do we receive, and can it be broken out by location?

Insist on location-level reporting. A global average will look perfectly acceptable while one office quietly suffers for eight months. The cost of getting this wrong is not abstract: in Uptime Institute’s 2026 outage analysis, 57% of respondents said their most recent major outage cost more than $100,000, and about one in five put the cost above $1 million (Uptime Institute via Business Wire, 2026).

If you want a template for what enforceable service levels look like, the deeper dive on designing and enforcing SLA governance covers priority tiers, penalty structures, and gain-sharing.

Not sure what to put in the scope section yet? Techmate runs a free 30-minute IT support audit that maps your current coverage and identifies the gaps worth writing into your RFP. Book one here.

Which pricing and contract questions prevent budget surprises? (Questions 30 to 35)

30. What pricing models do you offer, and which do you recommend for our profile and why?
31. Are travel, mileage, after-hours, and surge charges included or billed separately?
32. What triggers a change order, and how is change order pricing calculated?
33. What are the contract term, renewal terms, and price escalation provisions?
34. What are the exit provisions, notice periods, and data or documentation handover terms?
35. What is not included that we should expect to pay for separately?

Question 31 quietly determines whether your budget survives the year. Travel and surge charges can add a meaningful amount to a multi-site contract, and they never appear in the headline number. Question 35 is the most useful question in the entire RFP, because it invites vendors to disclose exclusions they would otherwise let you discover in month four.

The main pricing models behave very differently once you have more than a handful of sites, so ask each vendor to quote against the model that fits your profile and explain the tradeoffs.

Many distributed companies end up with a blend: a managed provider or internal team for remote support, plus on-demand field coverage for the sites that need hands occasionally. The comparison of on-demand versus managed IT lays out when each one makes sense. Before finalizing your cost comparison, running the numbers against the full in-house versus outsourced cost breakdown will give you a defensible baseline for the board conversation, and reviewing the contract clauses to negotiate in outsourced IT support will help you convert the answers to questions 33 and 34 into enforceable terms.

What should you ask about transition and onboarding? (Questions 36 to 40)

36. What does your onboarding process look like, week by week?
37. How do you capture our environment documentation, and what do you need from us?
38. What happens during the overlap period if we are transitioning from another provider?
39. What does the first 90 days look like, with defined milestones?
40. What has gone wrong in past transitions, and what changed as a result?

Question 40 is the best question on this list. Every provider has had a transition go sideways. The ones worth hiring will tell you about it. The ones who claim a spotless record are either new or not being straight with you. For a benchmark of what a credible answer to question 39 looks like, compare responses against a structured 90-day onboarding plan for an outsourced tech support provider.

Transition risk is also the reason documentation requirements belong in the contract rather than the kickoff meeting. As the case for treating IT documentation as a core deliverable lays out, runbooks and asset records are what let a partnership survive turnover on either side. And if you are unwinding an existing agreement, the mechanics of switching providers without downtime should shape your timeline before you commit to a start date.

What are the red flags in an outsourced IT services RFP response?

Most weak responses fail in predictable ways. Keep this table next to you while reading submissions.

How should you score outsourced IT support proposals?

Weight the categories before you read a single submission, ideally before the RFP goes out. Assigning weights afterward is how a shortlist gets reverse-engineered to match whoever gave the best presentation.

Adjust for your regulatory environment. Organizations in regulated industries typically shift more weight toward compliance, and for good reason. A law firm will care most about confidentiality and chain of custody for devices; a bank or credit union about access logging and audit evidence at each branch; a real estate or property management company about coverage across scattered, low-volume offices.

Score independently before the group discussion. Group scoring converges on whoever speaks first. Then shortlist two or three vendors and run a paid pilot of 30 to 60 days across a mix of sites, including at least one hard-to-reach location. A pilot tells you more about dispatch reliability than any written response.

What mistakes do companies make when running an IT outsourcing RFP?

• Sending the RFP before the site list is clean. Wrong addresses and missing closets produce wrong quotes.
• Letting the incumbent shape the requirements. Write scope from your ticket data, not from what the current provider happens to offer.
• Skipping reference calls. Ask references specifically about their smallest and most remote sites.
• Comparing headline prices. Normalize every bid to a total annual cost including travel, after-hours and project work.
• Ignoring the exit. Documentation handover and notice periods matter most on the day you need them.

How does Techmate respond to outsourced IT RFPs?

Techmate provides onsite IT support, smart hands and IT field services for companies with offices across the US, through a network of 7,000+ vetted technicians in 450+ US cities. Across completed work, technicians maintain a 97% resolution rate and a customer satisfaction score of 4.7 out of 5.

Coverage spans desktop support, onsite hardware support, network and rack work, audio visual, projects and recurring work, and staff augmentation, with support for co-managed arrangements where your internal team keeps strategy and ownership. That makes Techmate a fit as the onsite layer alongside an MSP or internal help desk, not only as a full replacement.

Building your shortlist now? See how the engagement model works, or start a conversation about coverage for your specific locations.

Frequently Asked Questions

What should an outsourced IT services RFP include?

Your organizational profile, scope of services needed, site details, timeline, required response format, and structured questions across six categories: coverage and capability, technician vetting, security and compliance, SLA and escalation, pricing and contract terms, and transition planning. Attach your full location list so every vendor quotes against the same footprint and you can compare answers line by line.

How many vendors should you include in an IT RFP?

Four to six is a practical range. Fewer than three limits comparison and weakens your negotiating position. More than six creates evaluation fatigue, and fatigue is when scoring gets sloppy. If you have a longer list, send a short request for information first and use the answers to cut it down before the full RFP goes out.

What questions should you ask an outsourced IT provider about security?

Ask about attestations held, access provisioning and revocation, technician offboarding, device security standards, incident response, subcontracting practices, and recent penetration test results. For onsite work, also ask how physical visits are logged and how keys and badges are handled. A provider with privileged access to every location is part of your attack surface, so treat the answers accordingly.

How long should an outsourced IT RFP process take?

Most organizations run four to eight weeks from RFP release to selection, plus a transition period before go-live. Compress it further and you will skip reference checks, which is the step people most regret skipping. Add time if you plan a pilot, and check notice periods on your current contract before you set a target start date.

What is the biggest mistake companies make in IT vendor selection?

Choosing on headline price without accounting for excluded costs like travel, surge rates, after-hours premiums, and change orders. The cheapest proposal frequently is not the cheapest contract. Normalize every bid to a total annual cost for your actual site list and ticket volume, then compare. The gap between headline and real cost is often where the decision should be made.

Should a multi-location company use one provider for remote and onsite support?

Not necessarily. Many distributed companies keep remote help desk with an MSP or internal team and buy field coverage separately, because the provider that is best at remote support often lacks technicians near smaller sites. If you split the work, define in the RFP who owns each ticket, how handoffs happen, and which provider reports on each location.

Want a second set of eyes on your scope before the RFP goes out? Book a free 30-minute IT support audit and we will map your current coverage by location and flag the gaps worth writing into your outsourced IT services RFP.