How to Choose an MSP in South Africa: Scorecard and RFP Template

 

 

An MSP should qualify for your shortlist through evidence, accountability, service discipline, cybersecurity, commercial transparency, and a sound fit for your business. The monthly fee is only one cost that must be considered. A structured assessment makes each proposal easier to compare on the same basis.

South African businesses also have local factors to assess, from POPIA duties and on-site support to data locations, contractual accountability, and business continuity.

The scorecard and RFP template below set out a practical framework for an MSP selection process without deep technical detail in procurement.

 

Define your requirements before you compare MSPs

 

A fair comparison begins with a written baseline. Without one, each provider can interpret the scope differently, which makes price, service levels, and responsibilities difficult to compare.

Record these five points before you request proposals:

• User numbers, office locations, remote staff, and support hours.
• Critical systems, cloud platforms, networks, and third-party applications.
• Current service problems, repeat incidents, and internal capability gaps.
• Cybersecurity, privacy, backup, recovery, and sector obligations.
• Growth plans, expected business changes, and desired IT outcomes.

 

Send the same baseline to every provider. Changes to scope should be documented before commercial comparison; otherwise, one proposal can appear cheaper simply because key responsibilities fall outside the quoted fee.

 

MSP scorecard for South African providers

Rate each provider from 1 to 5 against the same eight criteria. The weights below reflect a business-led procurement framework, not an industry benchmark. Adapt the percentages only when your organisation has a specific risk or operational reason.

Criterion	Weight	What to verify	Evidence to request	Score (1–5)
Business alignment and strategic advice	15	Business objectives, roadmap, governance, proactive advice	Sample roadmap or governance agenda	__/5
Service desk, SLA, and escalation	15	Coverage, priority definitions, response targets, escalation, reports	Sample SLA and service report	__/5
Cyber security and POPIA governance	20	Controls, administrator permissions, incidents, operators, data locations	Security documents and contract terms	__/5
Backup, disaster recovery, and continuity	10	Backup ownership, restore tests, RTO, RPO, recovery roles	Restore evidence or DR process	__/5
Technical capability and environment fit	10	Skills relevant to your actual estate and platforms	Current certifications and team profile	__/5
South African coverage and staff depth	10	On-site support, escalation depth, absence cover, regional reach	Service model and team structure	__/5
Commercial transparency and contract fit	10	Inclusions, exclusions, annual increases, exit costs, project fees	Itemised commercial schedule	__/5
References, reports, and governance	10	Comparable clients, report cadence, accountability, review process	References and sample report	__/5

 

Calculate each weighted result as: score ÷ 5 × criterion weight. Total the eight results for a score out of 100. A 4/5 score on a 20-point criterion earns 16 points.

Treat critical gaps separately from the total. A high score should not offset unacceptable terms on cyber security, data protection, disaster recovery, SLA accountability, or exit support.

POPIA sections 19 to 21 require reasonable technical and organisational safeguards, confidentiality where an operator processes personal information, and a written contract that addresses operator security obligations.

A final score can support judgement, but procurement still requires evidence. Ask each finalist to substantiate claims with documents, examples, references, or demonstrations that match the service under review.

Under this framework, a gap below 5 points should prompt another review of the highest-weight criteria and commercial exclusions before a final decision.

 

RFP template for comparable MSP proposals

 

Send identical RFP sections to every shortlisted provider. A consistent structure reduces vague sales language and exposes differences in scope, responsibility, commercial treatment, and service delivery.

1. Business context and required scope. Describe user numbers, sites, operational model, critical systems, current problems, required services, business objectives, dependencies, and exclusions. Request a written summary of the provider’s interpretation.
2. Service model and SLA commitments. Request support hours, contact channels, priority definitions, response targets, resolution approach, on-site coverage, after-hour arrangements, escalation routes, ticket ownership, and service performance reports.
3. Cyber security, privacy, and POPIA responsibilities. Request security controls, privileged account policy, incident response, personal-information duties, subcontractors or operators, data locations, cross-border transfers, and contractual safeguards.
4. Backup, disaster recovery, and business continuity. Request backup responsibilities, retention periods, restore test frequency, RTO and RPO targets, disaster recovery roles, test records, and response procedures after a major outage.
5. Technical capability and staff depth. Request the service team structure, relevant skills, current certifications, senior escalation capacity, absence cover, key-person dependency controls, and expertise that matches your present environment.
6. Transition, documentation, and governance. Request transition stages, documentation ownership, credential transfer, account management, report cadence, strategic reviews, change control, roadmap responsibilities, and communication channels.
7. Commercial terms, exclusions, and contract conditions. Request monthly fees, project charges, licence costs, on-site or travel charges, exclusions, annual increases, contract term, notice periods, termination duties, and exit or handover costs.
8. Evidence and references. Request comparable client references, sample service reports, SLA evidence, relevant security documentation, a sample transition plan, and B-BBEE status where your procurement policy requires it.

 

Require each commercial or service item to have one status: Included / Optional / Additional cost / Not provided / Third party.

Request a page reference for each response, plus one named owner for each service obligation. A common response format makes gaps easier to spot before score calculation.

POPIA should form part of the contract review when an MSP processes personal information on behalf of your organisation. Section 72 also sets conditions for personal information sent outside South Africa, such as adequate protection or another permitted basis under the Act.

Legal advice can be appropriate where the service model, sector, or data flow creates complex obligations. Procurement teams should not treat a generic “POPIA compliant” statement as evidence.

 

Red flags that should lower an MSP score

 

A credible proposal states responsibilities in terms that procurement, leadership, and technical teams can test. Reduce the score when evidence does not support the promise.

• SLA terms leave priority levels, or escalation routes open to interpretation.
• Security claims lack policies, process evidence, or contractual accountability.
• Documentation, credentials, and administrator rights have uncertain ownership.
• Backup services lack restore tests or defined recovery responsibility.
• Commercial terms hide exclusions, annual increases, project fees, or exit costs.
• References, transition detail, or escalation discussions are repeatedly avoided.

 

One red flag does not automatically disqualify a provider, and instead, severity should drive the decision. An unresolved security, privacy, recovery, or exit risk warrants a different response from a minor preference on report format.

 

How to choose between your final MSPs

 

Once proposals have comparable scope, test the finalists against the same evidence standard. Commercial comparison should reflect actual responsibility, not headline monthly cost.

1. Normalise scope so included services, exclusions, and third-party costs can be compared.
2. Check two to four references with the same prompts for each provider.
3. Present one realistic service or cyber incident scenario and assess the response.
4. Finalise SLA, transition, governance, commercial, and exit terms before signature.

 

Consider two proposals. For example, one quotes R45,000 per month but excludes on-site work and major projects; another quotes R52,000 with defined on-site support and broader service scope. The lower fee is not automatically the lower total cost.

Decision-makers should also assess the people behind the proposal. Service governance, communication discipline, escalation ownership, and executive advice will affect the relationship long after contract signature.

 

Frequently asked questions about MSP selection in South Africa

 

Do I need an RFP to choose an MSP?

An RFP is sensible when several providers will compete for complex or business-critical scope. A smaller organisation can apply the same sections as a structured checklist, even if procurement does not require a formal tender document.

 

How many MSPs should I shortlist?

A shortlist of two to four qualified providers is usually manageable for a detailed comparison. More bidders can create extra review work while decision quality changes little, especially when the same team must assess service, security, commercial, and contractual evidence.

 

Should an MSP sign a POPIA operator agreement?

A written contract is required where an operator processes personal information for a responsible party, and the contract must address the operator’s security safeguards under POPIA section 21. A legal review can confirm the correct terms for your specific arrangement.

 

Does an MSP need to be based in South Africa?

An MSP does not automatically need a South African base. Assess service coverage, on-site capability, data location, subcontractors, contract jurisdiction, and cross-border data transfers. POPIA section 72 sets conditions for transfers of personal information outside the Republic.

 

Choose for accountability, fit, and long-term partnership

An MSP relationship affects daily operations, cyber security, resilience, costs, and technology decisions. Select the provider that can substantiate commitments, accept defined responsibility, support your business priorities, and work with leadership over the contract term.

SevenC supports South African businesses through managed IT services, cyber security, data protection, cloud, networks, and virtual CIO services, with service arrangements tailored to the client environment.

If your business plans an MSP review, speak to SevenC about the requirements, risks, and service model behind your shortlist.