IT Provider Shortlist Due Diligence: Four Columns

What are the four columns we publish for every firm?

Every firm in our rankings carries the same four columns: a score, a review count, certification marks, and listed weaknesses. IT Support Chicago tracks 103 active Chicago Managed Service Providers (MSPs), with data current as of 2026-10-03. Each column answers a different question that a buyer would otherwise have to research alone.

The score summarizes public evidence across four weighted criteria. The review count shows how many client reviews sit behind a rating. The certification marks record what documentation our records hold for each framework a firm lists. The listed weaknesses name a specific finding and the data source it came from, such as Google, Indeed, Glassdoor or Apollo.

Reading IT provider rankings column by column, rather than by position alone, is the core of sound IT provider shortlist due diligence for a small or midsize business. A firm can lead on one column and trail on another. The trade-offs between columns are where your questions to each finalist should start.

In practice, we advise building a simple worksheet with one row per finalist and one column for each of our four. Add a fifth column for the questions each row raises, and send those questions in writing before any final presentation.

How is the score column built?

The score is a composite of 4 criteria scored from public evidence. For that reason, we advise reading it together with the other three columns rather than as a verdict on its own. IT Support Chicago's published score weights Client Reputation 29, Proactive Issue Reduction 27, Security Certification 24 and Employee Reputation 20, out of 100.

Coverage differs by criterion, as the table shows. When you compare two finalists, check whether both scores rest on the same parts of the evidence. Where staffing or certification data is thin, raise that gap with the firm directly rather than reading it as a finding.

The average vendor score across the firms we track is 20.0%. We publish it as context, not as a pass mark. Six further criteria apply only inside a signed-in custom evaluation and carry no weight in the published score. Two of them are scored from third-party data against the buyer's own location and size. The other four are scored only from a firm's own answers to our inquiry questions. The published score therefore says nothing about fit with your location, size or requirements, and that judgment stays with you.

Why doesn't a 4.73 average rating separate a shortlist?

In our view, with the average client rating across the firms we track at 4.73 / 5.0, a star rating alone rarely separates a shortlist. Review count and listed weaknesses therefore carry more of the comparison. IT Support Chicago's records hold 6,720 client reviews in total across the 103 active Chicago MSPs it tracks.

An IT provider's review count tells you how much client experience sits behind its stars. Two firms with similar ratings can rest on very different volumes of feedback. The one with fewer reviews gives you less to go on, which is not the same as offering a worse service.

Client Reputation is the most heavily weighted criterion, and it already adjusts ratings for volume, recency and platform credibility, so the score partly absorbs review count. The raw count still matters on a shortlist because you can act on it. Ask each finalist how reviews are collected, read the most recent ones yourself, and compare recent ratings with the all-time figure. A weakness cell such as Recent ratings trending down (-0.5 vs all-time) - Google makes that comparison visible.

A high review count is not a proxy for size, and size is not a proxy for quality. Our position is that bigger is not inherently better and that right-sizing matters more than headcount. Read volume as depth of evidence, not as a ranking of scale.

What does a claimed certification mark mean?

A (claimed) mark means the entry is the firm's own claim and our records hold no third-party documentation for it. It does not mean the firm lacks the certification. It means we have not obtained a document that shows it. IT Support Chicago's certification marks describe only the documentation its records hold, never how secure a firm is.

A ✓ mark means the entry is third-party documented. Our records hold a named third-party issuer's document, evidence hosted off the firm's own domain, or a public registry entry. Within the Security Certification criterion, third-party documented certifications are additive by tier, while entries that are the firm's own claim add 5 points each, capped at 25/100.

The practical step is the same whichever mark a finalist carries: ask the firm directly for the issuer's document. For System and Organization Controls (SOC) 2, that document is the auditor's report. A Type II report covers whether controls operated effectively over a multi-month observation period, while Type I covers control design at a single point in time. International Organization for Standardization (ISO) 27001 certification requires an accredited external audit, so ask for the certificate and the certifying body. Payment Card Industry Data Security Standard (PCI DSS) and Cybersecurity Maturity Model Certification (CMMC) entries deserve the same request. Our certification verification checklist walks through each document.

Do not rank finalists by their marks. A mark records what reached our files, which is a statement about our intake. A buyer who reads it as a security grade ends up comparing the wrong thing.

Turning listed weaknesses into provider questions

An IT provider's listed weaknesses are specific findings, each followed by the data source it came from. IT Support Chicago's weakness cells name their data source, such as Google, Apollo, Indeed or Glassdoor, after each finding. A weakness is a prompt for a question, not a disqualification. The useful move is to convert every cell on your shortlist into something you ask that firm in writing.

The table pairs weakness cells that appear in our data with the question we advise putting to any provider that carries one. Ask for the answers in the proposal itself. That way you can compare responses side by side and hold the firm to them later.

Employee review weaknesses deserve particular attention. Employee Reputation carries a weight of 20 of 100, and the criterion rests on a simple premise: high turnover is a risk even if clients are happy today. Our Best IT Companies to Work for in Chicago analysis looks at the employer side in more depth.

How should a single-platform review weakness change your checks?

A single-platform weakness should add a reference request to your process, not remove the firm from your list. In IT Support Chicago's data, several of the top-scored rows carry a weakness noting client reviews sit on a single platform only.

We advise addressing the gap by asking each provider for references or reviews from additional sources. A single-platform profile is not evidence that the reviews are unreliable. It means the client evidence sits in one place, and a buyer has no second channel to cross-check it against.

Make the request specific. Ask for client references from businesses of similar size to yours, and ask for any profiles on other review platforms such as Clutch. Also ask whether the firm chose the references itself or will let you pick from a list. Our IT provider reference check guide sets out questions for the calls themselves.

Weigh the answer against the other columns. A firm with a single-platform weakness and a high review count still has substantial feedback on record. A firm with the same weakness and a low count gives you less to work with, which makes the references more important.

What should you ask about a heavily reactive support model?

Ask how preventive work is staffed: who does it, how much of their time your account gets, and how the results are reported to you. A weakness cell such as a heavily reactive support model, drawn from workforce data, gives a buyer a concrete trade-off to raise with that provider.

IT Support Chicago scores Proactive Issue Reduction by classifying employee job titles in Apollo.io workforce data as proactive or reactive. Proactive titles include architects, security engineers and consultants. Reactive titles include help desk, network operations center (NOC) and support technicians. The criterion's attainment is (1 − reactive share) × 100. A cell reading 83% reactive roles therefore describes the mix of titles on record, not an observation of the work itself.

Because a title count is not a work log, ask the provider to show what preventive work looks like on an account like yours. Useful evidence includes a patching schedule, a sample monthly report, and the role of whoever owns planning for your environment.

The trade-off depends on your needs. If your main requirement is day-to-day help desk coverage, a reactive-heavy staff may match it. If you need security engineering or longer-term planning, press for specifics on who delivers that work and how often you will meet them.

What the four columns cannot tell you

The four columns narrow a shortlist, but they do not finish the job. IT Support Chicago does not collect vendor pricing, so none of its four published columns says anything about what a provider costs.

Our position on price is that a per-user figure without scope context is misleading. When quotes arrive, compare what each tier includes before comparing any rate. Check coverage hours, on-site versus remote support, compliance requirements, and the user and device count covered.

The published score also leaves out fit. Criteria tied to your location and size, and to a firm's own answers to our inquiry questions, sit only inside a signed-in custom evaluation. Proactive Issue Reduction is scored for 55 of 103 firms. For a finalist outside that group, that part of the published score has no workforce data behind it.

Finally, our data is a snapshot as of 2026-10-03. Ratings, staff and documentation change over time. Re-check the columns before you sign, and ask each finalist to confirm in writing anything you rely on.

Carrying your findings into contract terms

Open questions from your due diligence belong in the contract. The length of that contract decides how much those questions cost you if the answers disappoint. IT Support Chicago's position is that shorter agreements are generally better for the buyer and long lock-ins primarily benefit the vendor.

The common counterargument is that a multi-year term buys stability and a locked rate. We take that argument seriously. Still, stability you cannot exit serves the vendor as much as you. We advise against treating multi-year terms as a neutral default, especially when a weakness cell left a question only partly answered.

Service Level Agreements (SLAs) are often offered as the safeguard. An SLA defines measurable service commitments and specifies remedies when a commitment is missed. Our view is that SLAs matter mainly in multi-year agreements, as a mechanism to share pain with the vendor. For agreements under a year, or agreements with termination-for-convenience clauses, the better recourse is simply terminating the agreement.

The same caution applies to scale. Some buyers reason that the largest provider they can afford is the safest choice because it has a deeper bench. Our view is that bigger is not inherently better. None of the four score criteria measures headcount, and right-sizing matters more than size. Ask whether any depth a large firm offers would actually be assigned to your account.