Define the boundary first
Write down what your team will keep, what the provider will own and where responsibility is shared. Ambiguous boundaries create the most expensive gaps after onboarding.
- Systems and users in scope
- Coverage hours and supported locations
- Change authority and approval rules
- Security incident ownership
Compare the operating model
Ask who performs routine work, who handles escalations and whether the named team will remain on the account. A polished sales process does not prove delivery depth.
- Named service lead and escalation chain
- Response and resolution commitments
- Change management process
- Reporting cadence and review format
Test trust claims
Certifications help narrow a market but they do not replace diligence. Confirm the certified entity, covered services, audit period and any exclusions that matter to your environment.
Run a reference scenario
Give finalists the same realistic incident or migration scenario. Compare the questions they ask, the sequence they propose and the people they involve. The exercise exposes operating maturity better than a generic presentation.