What an MSP is, and how to choose one in Canada

Ask six Canadian providers what's in their managed IT contract and you'll get six different answers, all priced about the same. That's the real problem with this purchase. It isn't finding an MSP. It's telling them apart.

So here's the short version, before the detail.

An MSP, or managed service provider, is a company that takes ongoing responsibility for running part or all of your IT for a flat recurring fee. Not a break-fix shop you call when something dies. A managed service provider monitors your systems, patches them, backs them up, answers your staff's tickets and reports on all of it, under a contract that says how fast they have to respond. You pay monthly, usually per user or per device.

That's the definition. The rest of this piece is the part nobody writes down: what these contracts actually cover, where MSP stops and MSSP starts, what the work costs in Canada, the ten questions that separate a real operator from a good sales deck, and the clause you'll wish you'd read if the relationship ends badly.

We run managed services ourselves, so treat this as a builder's view rather than a neutral one. We've also said plainly below where an MSP isn't the right answer at all.

What is an MSP, exactly?

Three things make a provider an MSP rather than a vendor you happen to call a lot.

It's ongoing, not per-incident. The contract covers a scope of work over time. A break-fix shop bills you when something breaks, which quietly gives them a reason not to fix the root cause.

It's proactive by design. Monitoring agents sit on your endpoints and servers and raise problems before a user does. The industry calls this RMM, remote monitoring and management. It's the piece of software that makes the model work at all.

It's priced flat. Per user per month, per device per month, or a tier. Predictable for you, and it aligns the incentive: a provider on a flat fee wants fewer tickets, so they want your estate stable.

Strip those away and you've got an IT contractor with a retainer. That's a legitimate thing to buy. It just isn't managed services, and the SLA you think you have probably doesn't exist.

Not sure which one you're actually buying today? Our managed IT services page lays out the full scope of what a managed contract should cover, piece by piece.

What MSP does not mean in Canada

Worth clearing up, because it costs people real time. In Canada those three letters carry at least four meanings, and the IT one isn't the most searched.

Search "what is an MSP in Canada" and Google will happily tell you about BC health coverage. If you're briefing a non-technical board, spell out "managed service provider" the first time. Small thing. Saves a confusing meeting.

What does an MSP actually do all day?

Contracts vary, but the work falls into six buckets. A provider that can't speak clearly to all six is selling you a help desk and calling it managed services.

Two of those are where buyers get burned most often.

Backup is the first. Plenty of providers monitor that the backup job ran. Far fewer restore from it on a schedule and hand you the evidence. A backup nobody has restored is a hypothesis, not a recovery plan.

Reporting is the second. If the monthly report is a ticket count, it's telling you how busy they were, not whether your estate got better. Ask for repeat-incident rate instead. That one number shows whether anyone is fixing causes.

MSP vs MSSP: what's the difference?

This is the distinction that changes what you're buying, and almost nobody explains it properly.

A managed service provider keeps your IT running. A managed security service provider, or MSSP, watches for attackers and does something about it. Availability versus adversaries. Different tooling, different staff, different hours, different contract.

Here's the split in practice.

Most Canadian MSPs bundle some security. Antivirus, a firewall, MFA, maybe a phishing simulation. That's security hygiene and it's genuinely valuable. It is not a security operations capability, and the gap between the two only shows up on the worst day you'll have.

The test is one question: at 3am on a Sunday, who is awake, what can they do without phoning you, and how do you know? A provider with a real managed security service will answer with named authority levels, what they're allowed to isolate on their own, and where your logs live. A provider without one will answer with a tool name.

That gap matters more than it used to. IBM's Cost of a Data Breach Report 2026 put the Canadian average at CA$7.11M, a record, with the average breach lifecycle running 205 days. The same research found organisations using AI extensively in security operations detected breaches in 124 days and contained them in 57, against 154 and 71 for those without. And the Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026 names ransomware the top cybercrime threat to Canadian critical infrastructure, and says Canadian ransomware incidents known to the Cyber Centre grew an average of 26% a year from 2021 to 2024.

Do you need both?

Usually, yes, and they don't have to come from the same company.

Take a 90-person engineering firm in Ottawa. Call the ops director Priya. Her MSP is solid: tickets close fast, patching is current, staff like the help desk. Then a bid deadline arrives and a client's security questionnaire asks who monitors her environment outside business hours and how fast a compromised account gets disabled. Her MSP's honest answer is that alerts go to a shared inbox reviewed each morning. Nothing in her contract was broken. The contract just never covered that.

Splitting the work is fine. Buying it twice by accident isn't. Get both providers to write down, on one page, who owns detection, who owns response, and who owns the phone call to you.

Want the 3am answer from us in writing? Book a 30-minute call and we'll walk through the response authority we'd sign up to for your environment, before anyone talks pricing.

Fully managed, co-managed, or staff augmentation?

Three operating models, and picking the wrong one is the most expensive mistake in this category.

Fully managed hands the whole function over. Right when you have no internal IT, or one overloaded generalist. You get depth you couldn't hire. You give up some visibility, so the reporting clause matters more than usual.

Co-managed keeps your team and adds capacity around them. Right when you have good people carrying too much: they keep the work they're strong at and the provider takes the night shift, the patch cycle and the backlog. It's also the model that lets you keep institutional knowledge in-house. See co-managed IT.

Staff augmentation rents you an engineer. Right for a defined project or a parental leave. Wrong as a permanent answer, because you're buying hours rather than outcomes and nobody owns the result. More on that under IT staff augmentation and IT outsourcing.

Quick rule of thumb. Under about 50 users with no internal IT, fully managed usually wins. Over 100 users with two or more internal staff, co-managed usually wins. Between those, it depends on whether your internal person is a systems thinker or a firefighter.

What does an MSP cost in Canada?

Few providers publish firm numbers, so here's how the pricing works instead. That's more useful anyway, because the model tells you what you're on the hook for.

Per user, per month. The common one. Covers a person and their devices. Simple to budget, predictable as you hire. Watch what "user" means: a shared floor terminal in a warehouse may bill as a full user.

Per device, per month. Better when your device-to-person ratio is odd. Manufacturing, labs, retail. Watch for servers, firewalls and switches billed separately at much higher rates.

Tiered bundles. Bronze, silver, gold. Easy to compare on paper and easy to hide exclusions in. Read what moves between tiers, not what's in the top one.

The four costs that surprise people, in the order we see them bite:

1. Onboarding. Discovery, documentation and getting your estate to the provider's baseline. Often a real project, sometimes quoted as a one-time fee, sometimes buried.
2. Projects. Migrations, office moves, new firewalls. Almost never in the monthly fee. Get the hourly project rate in the same document as the monthly rate.
3. After-hours. If your business runs past 5pm, confirm whether that's included, on-call, or billable.
4. Licences. Microsoft 365, EDR, backup storage. Some providers resell at a margin and some pass through at cost. Both are fine. Not knowing which is not.

When you compare quotes, normalise them to cost per user per month including onboarding amortised over the contract term. Two quotes that look 20% apart often aren't.

How do you choose an MSP? Ten questions that actually sort them

Every provider will say yes to "do you offer 24/7 support". These questions are harder to fake, because each one has a right answer that a weak provider can't improvise.

Question 8 is the one that separates Canadian providers fastest. Try it early.

Which Canadian rules change your shortlist?

Most MSP buying guides you'll read were written for an American audience and quote HIPAA. If you operate in Canada, four things matter more.

PIPEDA. Federal private-sector privacy law. Breaches posing a real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals, and you must keep records of every breach, including ones you decide not to report. Your provider will be first to know something happened, so their obligation to tell you needs to be in the contract with a clock on it. More at PIPEDA compliance.

Quebec Law 25. If you collect personal information about staff or customers in Quebec, this applies regardless of where you're headquartered. It brings consent, data-portability and incident-reporting duties that touch how systems are built, not just how policies are written. See Quebec Law 25.

Bill C-8. Received royal assent on 2026-06-15 as Statutes of Canada 2026, chapter 9. Part 1, amending the Telecommunications Act, took effect on assent. Part 2, the Critical Cyber Systems Protection Act, comes into force in stages by order, and as of today Schedule 2 is still empty, so no operator has been designated yet. If you're a federally regulated operator in finance, telecom, energy or transport, treat it as pending and plan, not as an obligation you're currently breaching. Background at Bill C-8 and the CCSPA.

Data residency. Ask where logs, backups and ticket contents physically sit. Plenty of good platforms default to US regions. That may be fine for you. It should be a decision, not a discovery.

A provider who can talk through these without reaching for a US framework has almost certainly done Canadian compliance work before. One who can't, hasn't.

What an MSP won't do for you

This is the section other guides skip, and skipping it is why people end up disappointed.

The managed services model is built for breadth at volume. It's very good at a thousand endpoints doing ordinary things. It is not built for depth on hard infrastructure, and most MSPs staff accordingly: strong generalists, a few specialists, no expert-level bench.

So these usually sit outside the contract, and should:

• Designing a data centre fabric. Cisco ACI multi-pod, VXLAN EVPN, spine-leaf. See enterprise networking.
• Rolling out network access control without locking the building out. 802.1X and Cisco ISE deployments fail on sequencing, not on licensing.
• Application delivery and WAF policy on F5 BIG-IP.
• Segmentation architecture, as opposed to segment upkeep.
• Zero Trust design.
• WAN strategy. SD-WAN or MPLS is an architecture decision with a cost model attached.

Here's the pattern we see. A 140-person firm signs a solid managed contract. Eighteen months later they need network segmentation for a cyber-insurance renewal, and the MSP says yes because saying no loses the account. The design gets done by someone learning on the job. It half works, nobody documents it, and the cleanup costs more than the original project would have.

The fix isn't a better MSP. It's being clear that run work and build work are different purchases. Ask any provider where their expert-level ceiling is. The honest ones will tell you, and tell you who they bring in above it. For context, we keep CCIE Data Center, CCIE Security and CCDE Design in-house, which is unusual at our size and is exactly why we'll say plainly when a job is run work instead.

The clause to read before you sign: getting out

Read the exit terms before the service terms. You'll be more objective about them now than you will be in eighteen months.

Four things to nail down in writing:

Who owns the documentation. Network diagrams, asset inventory, runbooks, password vault. If it lives only in the provider's PSA tool and the contract is silent, you leave with nothing and your next provider rebuilds it at your cost.

Who holds the admin credentials. Your Microsoft 365 global admin, your firewall enable password, your domain registrar. These should be yours, with the provider holding delegated access. Common, and bad, is the reverse.

Notice and transition. How much notice, and does the provider have a duty to co-operate with the incoming one during it? A 30-day notice period with no transition obligation is a 30-day hostage situation.

Agent removal. RMM and monitoring agents need to come off every endpoint cleanly. Put a timeline on it.

Take a 60-person accounting firm in Mississauga. Call the controller Dana. She gives notice in January, between tax seasons, which is the right call. The problem is that the only current network documentation lives in her outgoing provider's portal, and the contract never said it was hers. The new provider spends three weeks rediscovering an estate that was already documented once. That's not a dispute anyone wins. It's just a clause nobody read.

Frequently asked questions

What does MSP stand for?
Managed service provider. A company that runs IT services for you on an ongoing contract for a recurring fee, rather than charging per incident.

What is an MSP in Canada?
In IT, the same thing it means anywhere: a managed service provider. Be careful with the acronym in Canada though, because MSP is also British Columbia's Medical Services Plan, the provincial health insurance programme.

What's the difference between an MSP and an MSSP?
An MSP keeps your systems running and your users working. An MSSP watches for attackers and responds to them, with security analysts and 24/7 coverage. Many MSPs include basic security hygiene. Fewer run genuine security operations.

How much does an MSP cost per month in Canada?
It's quoted per user, per device, or as a tier, and the honest answer depends on your endpoint count, your after-hours expectation and how much of your estate is non-standard. Compare quotes on cost per user per month with onboarding included, not on the headline rate.

Do we still need internal IT if we hire an MSP?
Not always, but usually you want at least one internal owner of the relationship. Someone has to hold the provider to the contract, set priorities and make judgment calls about the business. That role is small. It isn't zero.

Can one provider do both managed IT and managed security?
Some can. Ask the 3am question and ask for the authority matrix in writing. If both answers are solid from one provider, one contract is simpler. If not, split the work and make the boundary explicit.

Bottom line

Five things to take away:

1. An MSP runs your IT on an ongoing contract for a flat fee. If it's per-incident, it isn't managed services, whatever the invoice says.
2. MSP and MSSP are different purchases. Availability versus adversaries. Most providers do the first well and the second partly.
3. The operating model matters more than the brand. Fully managed, co-managed and staff augmentation fail in different ways.
4. Canadian rules should shape your shortlist. If a provider quotes you HIPAA, they're reading an American script.
5. Read the exit clause first. Documentation ownership and admin credentials are where relationships turn expensive.

Take the ten questions into your next three provider calls and score them side by side. The answers will spread out faster than the pricing does.

If you'd like a second opinion on a contract you're already holding, we'll do a 30-minute review of your current managed IT scope and tell you what's missing. No pitch attached, and you keep the notes either way. Book an IT operations review.