What is missing from your managed IT quote?
Two managed IT proposals can carry the same monthly price and cover completely different things. Open the quote in front of you, work through 22 checks, and note the exact questions to send back before you sign. Built for Greater Toronto Area businesses by IT Rapid Support in Vaughan.
Print it and fill it in by hand, or work through it on screen. Want a second opinion on your answers? Call or send us a message and we will go through them with you.
The 22 checks
Never upload your contract anywhere. You read the quote and work through the checks yourself, on screen or on paper; there is nothing to submit.
Mark each item: In writing / Mentioned, not specific / Not there, or unsure.
| # | Area | Weight | Check |
|---|---|---|---|
1 | Scope & support | 4 | Does it state whether help desk support is unlimited, or capped at a number of hours, tickets or users? |
2 | Scope & support | 4 | Does it define what means: engineers who can fix things, or a service that takes a message? |
3 | Scope & support | 3 | Are on-site visits included, and does it say how many and how quickly someone attends? |
4 | Scope & support | 3 | Is it explicit about what is being priced, every user, endpoint, server, site and network device, and what is excluded? |
5 | Scope & support | 2 | Does it say whether dealing with your other vendors, internet provider, phone system, line-of-business software, is included? |
6 | Security inclusions | 4 | Does it name multi-factor authentication as included: deployed and enforced, not merely available? |
7 | Security inclusions | 4 | Does it name the endpoint security product, and say whether the licence sits inside the monthly fee? |
8 | Security inclusions | 3 | Does it commit to patching on a stated schedule, and say whether third-party applications are included? |
9 | Security inclusions | 3 | Does it include email authentication: SPF, DKIM and DMARC configured and moved to an enforcing policy? |
10 | Security inclusions | 3 | Does it say who is watching security alerts outside business hours, and what they are allowed to do about one? |
11 | Security inclusions | 3 | Does it say whether responding to a security incident is covered, or billed separately as project work? |
12 | Security inclusions | 2 | Is security awareness training or phishing simulation named as included, or is it an add-on? |
13 | Backup & recovery | 4 | Does it state exactly what is backed up: servers, endpoints, and your Microsoft 365 data? |
14 | Backup & recovery | 4 | Does it commit to test restores: how often they run, and whether you are shown the result? |
15 | Backup & recovery | 3 | Does it put numbers on recovery: how much data you could lose, and how long you would be down? |
16 | Ownership & exit | 4 | Does it say who owns the Microsoft 365 tenant and holds the global administrator credentials: you or the provider? |
17 | Ownership & exit | 3 | Does it say you receive the documentation, network diagram, asset inventory, credentials, and in what format if you leave? |
18 | Ownership & exit | 3 | Does it say who holds your backup data, and how you get it back if the relationship ends? |
19 | Ownership & exit | 3 | Does it set out the term, the notice period, whether it auto-renews, and any early-termination charge? |
20 | Commercial terms | 3 | Is the line drawn between covered work and project work: migrations, new sites, hardware, licences? |
21 | Commercial terms | 2 | Does it say how and when the monthly price can change? |
22 | Commercial terms | 2 | Does it state the onboarding fee, how long onboarding takes, and what it covers? |
Reading your answers
Every check the quote leaves out, or mentions without specifics, becomes a question to send back to the provider before you sign. Start with the heaviest weights.
How the weighting works
Each of the 22 items carries a weight from 2 to 4 based on how expensive its absence tends to be after signing. Something written clearly costs nothing. Something mentioned without specifics costs half the weight, because a loose clause is still an argument you can have. Something absent costs the full weight. The points you keep, out of a possible 69, become a clarity score from 0 to 100.
The weights are ours and they are printed next to every item, so you can disagree with them. The heaviest items, help desk caps, what means, MFA enforcement, endpoint licensing, backup scope, restore testing and who owns your Microsoft 365 tenant, are the ones that most often turn into an unexpected invoice or a painful exit.
The list itself comes from three places: the line-by-line inclusion matrix we publish on our own plans page, the questions we tell buyers to get in writing before signing with anybody, and the gaps we keep finding in agreements when businesses move to us from another provider. One item cites our own measurement: in a DNS scan of 481 GTA business domains in August 2026, 52.4% published a DMARC record but only 20.6% had it set to block forged mail, the full dataset is published here.
What this is not
It scores a document, not a company. A capable provider can write a thin proposal, and a polished proposal is no guarantee of good delivery. A low score means you cannot yet compare this quote with another one, not that you should walk away. It is also not a legal review. If the agreement carries meaningful liability, indemnity or data-protection obligations, have a lawyer read it. This checklist covers the operational and commercial detail that decides what you actually get for the monthly fee.
Before you sign, also worth reading
What managed IT actually costs
Pricing models, the real drivers behind a monthly fee, and where quotes are made to look cheaper than they are.
Our plans, line by line
Eighteen capabilities across three plans, written out in full, plus how the monthly price is put together.
IT risk self-check
Fifteen weighted control areas with four answers each, so you can see your weakest points ranked.
Quote checker FAQs
It walks you through 22 things that should be written into a managed IT or MSP proposal: help desk caps, what 24/7 actually means, on-site visits, MFA and endpoint protection, patching, email authentication, out-of-hours monitoring, incident response, backup scope and restore testing, recovery objectives, who owns the Microsoft 365 tenant, documentation and backup data on exit, term and auto-renewal, project boundaries, price changes and onboarding. For each one you mark whether it is in writing, vague, or absent. You get a clarity score out of 100 and a prioritized list of questions to send back to the provider.
No. The checklist never asks for the document, your company name, your email address or the provider’s name. You read your quote yourself and work through 22 yes/vague/no checks; nothing is sent to IT Rapid Support or anyone else.
No, and it is important not to read it that way. The checklist measures the document, not the company. Plenty of capable providers write thin proposals, and a polished proposal is not proof of good delivery. What a lot of gaps tell you is that you cannot yet compare this quote against another one, and that several things which determine your real cost have not been agreed in writing.
Yes. The checklist is deliberately written to apply to any managed IT provider in the Greater Toronto Area, including us. If a proposal from IT Rapid Support does not answer one of these items, ask us the same question and we will put the answer in writing.
Because it is the clearest example of an item that gets marked complete without being finished. In our own DNS scan of 481 Greater Toronto Area business domains in August 2026, 52.4% published a DMARC record but only 20.6% had a policy that actually blocks forged mail. A provider can truthfully say DMARC is in place while spoofed invoices still land in your customers’ inboxes, which is why the quote should specify an enforcing policy and ongoing monitoring rather than just configuration.
They come from the inclusion matrix we publish on our own managed IT plans page, the seven questions we tell buyers to get in writing before signing with anyone, and the areas where scope is most often left undefined in the agreements we see when businesses switch to us. Each item is weighted by how much its absence tends to cost after signing, not by how difficult it is to answer.
Comparing two providers?
Run both quotes through the checklist and compare the gaps, not the prices: our guide to comparing managed IT quotes line by line covers how to normalize them onto one page. If you want a third proposal to measure them against, IT Rapid Support is in Vaughan and covers Toronto and the wider GTA.
Related.
- ArticleManaged IT Services Pricing in Canada (2026): Toronto & GTA Cost GuideWe do not publish price lists, and we are wary of anyone's 'average cost per user' because it hides what is in the scope.
- PageManaged IT plans built around your businessThree levels of managed IT for Ontario businesses: co-managed, fully managed, and managed with security.
- ToolHow exposed is your business to a cyber attack?Fifteen questions about the controls that decide how bad a cyber incident gets, each with four answers from strongest to weakest.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.