Check an MSP before you hire it
Look a provider up by name or company number to see what the register knows about it. Then work through eight checks you can make yourself, from public records, in about twenty minutes.
Look a provider up
Searches the 8,462 companies on the register, in your browser. Nothing you type is sent to us or anyone else.
What the result means
Checked
The company's registered number is displayed on its own website, and we confirmed it on the date shown. It ties the website to the company. It does not say anything about the quality of the service.
Confirmed
The company has also written to us from an address on that website's domain to confirm the entry is theirs. The mark turns solid.
Listed, not checked
The company is on the register from the official record, but we have not confirmed its number on its own website. That is often a website that leaves the number off, not a problem with the company.
Not on the register
The register lists companies filed under the IT codes, plus those whose own site describes managed services, plus those that asked. Plenty of good providers are not on it. Look them up on their national register instead, and use the checks below.
Eight checks to make yourself
- 1
Find the company behind the name
A trading name is not a company. Ask for the registered company number, or find it in the footer or legal page of the provider's website: companies in the UK and across Europe are required to show it. Then look it up on its national register: Companies House in the UK, the CRO in Ireland, KVK in the Netherlands. Check the registered name matches, the status is active, and the company is not in liquidation or administration.
- 2
Check the website is theirs
The registered number on the provider's own website ties the website to the company. It is the one thing the Checked mark on this register confirms, with the date we saw it. If the number is missing, or belongs to a different company, ask why.
- 3
Look at the filing history
On the same register page, open the filing history where the register publishes one (Companies House does). Accounts and confirmation statements filed on time are a basic sign of a business being run with care. Overdue accounts are worth a question before you hand over your systems.
- 4
See who runs it
The officers tab lists the directors. Knowing who you are contracting with, and how long they have run the company, is part of due diligence for any supplier with admin access to your systems.
- 5
Verify any certification yourself
If the provider says it holds Cyber Essentials or Cyber Essentials Plus, ask for the certificate number and search the IASME certificate register. If it cites ISO 27001, ask for the certificate and the certification body, and check the scope covers the services you are buying.
- 6
Ask how they protect their own tools
A managed service provider usually has remote access to every machine it manages. Ask how that access is secured: multi-factor authentication on their remote management and ticketing tools, who in their team can use them, and how quickly access is removed when someone leaves.
- 7
Read the contract for the exit
Look for the notice period, what happens to your data and your admin passwords when you leave, and how long the handover lasts. A good provider is happy to explain how you would leave before you join.
- 8
Ask for references you can call
Two or three current clients of a similar size and sector, who you can speak to directly, tell you more than any rating. This register carries no ratings or reviews, on purpose.
General guidance, not legal or procurement advice. For a large contract, take advice on the contract itself.