IT MANAGEMENT · PROPOSAL REVIEW
Compare IT Outsourcing Proposals: Scope and Responsibilities
Comparing IT outsourcing proposals means more than comparing monthly fees. Start with the same users, devices, locations and support hours. Then compare the tasks, the responsibilities retained by the customer and the records to be delivered. A low price with an unclear scope does not prove that the same service is being offered for less.
Start with the same inventory
Give each candidate the same short requirements document: user and device counts, locations, critical applications, existing licences and required support hours. Clearly mark information that has not been verified. Do not include sensitive details such as serial numbers or administrator passwords in the initial proposal request.
For example, for a business with 20 users and 2 locations, clarify whether only computer support is required or whether network and server management are included too. The numbers in this hypothetical example are not a package, a capacity guarantee or a Quad price quotation. Ask every provider to state the assumptions behind its proposal.
If this service model is new to you, read our guide to the scope of IT outsourcing first. This article focuses on evaluating proposals on equal terms rather than repeating the definition of outsourcing.
What belongs in a proposal comparison table?
The following table is an original assessment template prepared by Quad Bilişim. Instead of assuming that a task is included, locate a written commitment in the proposal or its appendix. Do not treat an empty field as a positive answer; send it back to the provider as a specific clarification question.
| Area | Question to ask | Evidence to request |
|---|---|---|
| Service scope | Which users, devices and applications are included? | Scope and exclusions list |
| Support schedule | How are on-site support and out-of-hours work handled? | Hours, locations and additional-work conditions |
| Incident management | How are priority, initial response and resolution targets distinguished? | SLA and sample incident record |
| Secure access | Who grants and revokes administrator permissions? | Sample access approval and access log |
| Backups | Who creates backups and tests restoration? | Named owner and restoration test record |
| Licences and tools | Which licences are separate from the service fee? | Quantity, renewal and ownership list |
| End of service | How are documents, accounts and records handed over? | Handover checklist and access-revocation steps |
Assess the SLA and responsibility matrix separately
An initial response to a fault is not the same as resolving it. Ask how priorities are assigned, which support calendar applies and how incidents that depend on another vendor are reported. For an explanation of these time targets, see our IT support SLA guide .
For each task in the responsibility matrix, identify who performs it, who approves it and who is informed. For example, a provider may prepare a security update while the business performs acceptance testing for its application. This is an example of task allocation, not a mandatory model for every company.
Microsoft’s cloud shared-responsibility model also shows that managing data and identities involves continuing customer responsibilities. A cloud subscription or an outsourcing agreement does not automatically transfer every operational responsibility to the other party.
Request evidence of access and recovery controls
Do not treat a shared administrator account as a normal requirement of the proposal process. Discuss the permissions the provider needs, access approval, strong authentication and how permissions will be removed when the work ends. Establish who can access audit logs when needed.
NCSC recommends discussing access, updates and tested backup arrangements when selecting an MSP. The requested evidence need not contain customer data: a redacted sample record, a process explanation or a demonstration may be appropriate. A certificate alone does not prove that every control has been implemented in your environment.
Do not accept “daily backup” as a complete description. Ask which data is covered, what the latest restoration test showed and who will request a restore. Do not test by sharing passwords, recovery keys or real customer files.
Which costs need clarification beyond the monthly fee?
Setup and migration, on-site visits, project work, licence renewals, backup storage and out-of-hours support may be charged separately. Check each item for inclusion. Do not assume that migration work and routine support use the same pricing model.
As an original comparison method, use fixed service fees for the selected period + explicitly excluded work + additional tools and licences to build a comparison worksheet. This is not a market price or a cost guarantee. Instead of inventing an amount for an unclear item, mark it “awaiting confirmation”. Clarify different contract periods and currencies before adding amounts together.
A short checklist before the final decision
- Verify that all proposals use the same inventory and support schedule.
- Request one concrete clarification for every empty row in the table.
- Ask the provider to explain a sample support incident from ticket creation to the final report.
- Check how documents, account ownership and access will be handed over when the service ends.
Do not reduce the decision to a total score. Positive answers elsewhere do not compensate for a critical application being excluded. This checklist supports operational assessment; specific contract terms should also be reviewed with the relevant specialists.
Frequently asked questions
Should you choose the IT outsourcing proposal with the lowest monthly fee?
First check that the scopes match. Monthly fees alone are not comparable if the support schedule, licences and excluded work differ.
Do you need to share a password when comparing proposals?
Do not share administrator passwords or recovery keys during the initial assessment. If an authorised technical assessment is needed, agree its scope and secure access method separately.
Define a suitable service scope together
Explore our IT outsourcing service or contact us to discuss your requirements. Remove sensitive information before sharing an existing agreement.
Technical sources
- NCSC — Choosing a managed service provider (MSP)
- Microsoft Learn — Shared responsibility in the cloud
Sources checked: 24 October 2026. The assessment table, workflow and hypothetical example are original practical suggestions by Quad Bilişim, not a price or outcome guarantee.