Methodology

Our public ranking uses 4 criteria backed entirely by objective, third-party-verifiable data. No criterion in the public ranking relies on vendor self-reported content. Every formula is documented here. Every data point is verifiable.

Which Firms Are Included

This list includes all IT managed service providers with offices within 100 miles of downtown Chicago that have at least 25 aggregate reviews across our tracked platforms (Google Business, Clutch, Cloudtango, The Manifest, Glassdoor, Indeed, and others). Geographic proximity is an inclusion filter, not a scored criterion — every firm on the list already serves the Chicago area. Firms are discovered automatically from public directory listings and verified for geographic eligibility. If your firm meets these criteria and is not listed, you can submit your data to be included.

The 4 Public Criteria

The public ranking scores every firm on 4 objectively verifiable criteria. Weights sum to 100 and reflect the relative importance of each factor for a typical Chicago SMB.

Reputation Formula

Each vendor is scored objectively across client reviews and employer reviews using a Bayesian model. The two pools use tuned parameters so that employer reviews (which cluster lower industry-wide) are scored on a fair scale.

effective_reviews = Σ(count × credibility_weight)
  credibility_weight is per source; Clutch is auto-set to 1.25 × the
  vendor's best other source weight (1.0 if Clutch is the only source).
  group_mean_effective and the group mean rating are computed with the
  same per-vendor weights; recent-12mo counts are unweighted.
weighted_rating   = Σ(rating × count × weight) / effective_reviews
bayes_rating      = (effective × weighted_rating + C × m) / (effective + C)
  C = prior strength (per pool)
  m = group mean rating − skeptic margin (per pool)
floor             = group_mean_rating − 1.0 (dynamic, per pool)

If bayes_rating < floor (below-floor age decay):
  age_ratio       = recent_12mo_count / total_review_count
  gap             = floor − bayes_rating
  effective_gap   = gap × (0.5 + 0.5 × age_ratio)
  effective_bayes = floor − effective_gap
Else:
  effective_bayes = bayes_rating

rating_quality    = clamp((effective_bayes − floor) / (5.0 − floor), 0, 1)
rating_factor     = rating_quality ^ exponent

Client pool:
  volume_factor   = effective_reviews / group_mean_effective
  recency_factor  = max(0.5, recent_12mo / group_mean_recent_12mo)

Employer pool (threshold-based, saturates at full credit):
  volume_factor   = min(1, effective_reviews / volume_threshold)
  recency_factor  = max(0.5, min(1, recent_12mo / recency_threshold))

attainment        = rating_factor × min(cap, volume × recency) × 100

The floor is computed dynamically from each pool's group mean rating, not hardcoded. Employer reviews on Glassdoor/Indeed typically average lower than client reviews on Clutch/Google, so each pool gets a floor calibrated to its own data. When a vendor's Bayesian rating falls below the floor, old reviews carry less negative weight than recent ones — a firm that improved recently is not punished as heavily for historical scores.

A recency floor of 0.5 ensures that vendors are never fully penalized when per-review date breakdowns are unavailable. Not all review platforms expose individual timestamps — for example, the Google Places API returns only a small sample of reviews with dates. We estimate Google review recency by sampling up to five reviews per location and extrapolating the recent proportion to the full review count. Vendors with no recency data at all still receive at least half credit for the recency factor rather than being zeroed out.

Security Scoring

Security is scored using a two-path model that distinguishes verified certifications from unverified website claims.

Path A — Website claims only (no verified certs):
  score = min(25, claim_count × 5)
  Maximum: 25/100

Path B — At least one verified cert:
  Website claims are ignored entirely.
  Top-tier (50 pts each):
    CMMC L3, ISO 27001, HITRUST, SOC 2 Type II, FedRAMP, CMMC L2+
  Lower-tier (25 pts each):
    CMMC L1, SOC 2 Type I, PCI-DSS
  score = min(100, top_count × 50 + lower_count × 25)

Verified means the certification is attested by a third party (directory listing, audit report, or vendor feed submission with evidence URL). Mentioning “SOC 2” on a marketing page alone does not qualify.

Proactive Scoring

We analyze each vendor’s workforce composition to measure how proactively they invest in preventing IT issues vs. reacting to them. Employee job titles are fetched from Apollo.io and classified into three buckets:

• Proactive — architects, security engineers, vCIOs, compliance specialists, penetration testers, automation engineers, etc.
• Reactive — help desk, service desk, NOC analysts, desktop support, field technicians, support engineers, etc.
• Neutral (excluded) — leadership, sales, HR, accounting, software development, and other non-IT-operations roles.

reactive_share = reactive / (reactive + proactive)
attainment     = (1 − reactive_share) × 100

A minimum of 3 reactive employees is required for a vendor to be scored. Vendors below this threshold are treated as unmeasured and receive the pessimistic floor score.

Contract Terms

Contract duration, performance-based termination rights, auto-renewal terms, and price lock guarantees are evaluated directly within the Price & Contract criterion. Vendors answer structured questions about their standard contract terms, and responses are scored using the same tiered rubric system as all other inquiry-based criteria. Shorter agreements, performance exit clauses, and buyer-friendly renewal terms score higher.

Data Sources

• Client Reviews: Google Business Profiles, Clutch.co, Cloudtango, The Manifest, MSP Companies
• Industry Rankings: CRN MSP 500 (list presence, not review scores)
• Employer Reviews: Glassdoor, Indeed
• Directory & Strengths: Expertise.com, MSP Directory, MSP Database (vendor discovery and capability data, not reviews)
• Security: Third-party certification databases, vendor feed submissions with evidence
• Apollo.io: Employee role analysis (proactive vs reactive title share)
• Vendor Feed: Voluntary structured data from vendors (spec)

Data is refreshed periodically. See individual vendor pages for “last updated” timestamps.

Missing Data Policy

When we cannot verify a criterion from public sources, that cell shows “—” on the rankings table. For scoring purposes, unmeasured criteria receive the lowest score observed among vendors where we could measure that criterion. This pessimistic approach ensures vendors are not rewarded for opacity.

Vendors can improve their security score by submitting verified certification evidence through our vendor feed.

Editorial Beliefs

We hold a set of editorial positions that all content on this site — whether written by a human or generated by AI — is checked against. These beliefs reflect our experience advising IT buyers and are published here for full transparency.

SLA-001: SLAs & Contract Terms

SLAs only matter in longer agreements (multi-year) as a mechanism to share pain with the vendor. For agreements under a year, or agreements with termination-for-convenience clauses, the better recourse is simply terminating the agreement. Content should not present SLAs as universally critical or essential.

SIZE-001: MSP Size

Bigger is not inherently better. Right-sizing matters more than headcount. Content should not imply that larger MSPs deliver superior service by default.

PRICE-001: Price Comparison

Per-user price without scope context is misleading. Content should never compare raw per-user prices without discussing what is included in each tier.

CONTRACT-001: Contract Length

Shorter agreements are generally better for the buyer. Long lock-ins primarily benefit the vendor. Content should not present multi-year contracts as a neutral or positive default.

Interactive Preview

Drag the sliders to see how changing weights affects the ranking. This uses real vendor scores — no account required.

Like what you see? Sign in to save a custom evaluation with all 10 criteria weighted for your business.

Custom Evaluations: 6 Additional Criteria

The public ranking intentionally excludes criteria that depend on your specific business requirements. When you sign in with your work email, you unlock 6 additional criteria:

• Support Coverage and Responsiveness — scored from IT firm responses to contextual inquiry questions tailored to your support needs
• Compliance and Regulatory Fit — scored from IT firm responses to questions specific to your compliance requirements (HIPAA, PCI, SOX, etc.)
• Geographic / Onsite Fit — proximity and on-site capability (auto-scored from Google Places data)
• Price & Contract — scored from IT firm responses to pricing, contract duration, exit flexibility, and auto-renewal questions adapted to your IT model and company size
• Service-Scope Match — scored from IT firm responses to questions about service breadth matched to your needs
• Similar Size Fit — MSP size vs. your company size (auto-scored from Apollo workforce data)

Geographic and Similar Size Fit are auto-scored from third-party data.Support Coverage and Price & Contract are included in every evaluation and use a contextual question enginethat generates questions tailored to your company profile. Two additional criteria — Compliance and Service-Scope — can be added optionally. All inquiry-based criteria send questions directly to IT firms for structured answers, ensuring scores reflect actual capabilities, not marketing claims.

Inquiry-Based Criteria

Several criteria are scored from direct IT firm responsesto structured questions. This includes the four contextual criteria above (Support, Compliance, Price & Contract, Service-Scope) plus additional specialized criteria you can add to your evaluation.

When your evaluation includes inquiry-based criteria, the platform sends a unified outreach email to top-ranked vendors on your behalf. The email reveals only your industry, company size, and city — never your identity. IT firms click a magic link to authenticate and submit structured answers through a vendor response portal. Answers are scored via predefined rubrics and your ranking updates in real-time as responses arrive.

For the four contextual criteria, the questions are dynamically tailored to your company profile. For example, if you selected HIPAA compliance, the Compliance criterion will include specific HIPAA questions (BAA signing, risk assessments, PHI handling). If you use a co-managed IT model, pricing and scope questions adapt to ask about co-managed rates and shared responsibilities.

Additional inquiry criteria:

• Disaster Recovery Maturity — RTO/RPO commitments, DR test frequency
• Cloud Platform Expertise — Azure/AWS/GCP partner certifications
• Onboarding Timeline — days from contract to fully managed
• Client Retention Rate — annual client retention percentage
• Co-Managed IT Capability — integration model with internal IT
• Industry Vertical Expertise — specialization depth by vertical
• vCIO / Strategic Advisory — QBR cadence, roadmapping, budget planning
• SLA Response Commitments — contractual response/resolution times
• Technology Stack Alignment — RMM, PSA, and security tooling
• Cybersecurity Insurance — coverage limits and policy status

You can also add custom criteria with your own questions using a multi-question builder. Define answer types (free text, numbers, yes/no, select, multi-select) and optionally set conditions based on your company profile.

All inquiry-based criteria are visually distinguished with a blue “Inquiry-based” label. Rankings update automatically as vendor responses arrive. IT firms' answers are persisted and pre-filled on subsequent evaluations, reducing response burden.

Hard Requirements

Beyond weighting criteria, you can set hard requirementsthat act as non-negotiable filters. Any IT firm that fails a requirement is disqualified from your shortlist entirely — the requirement is not factored into scoring, it is a binary pass/fail gate.

Available requirement types vary by criterion. For data-backed criteria like Client Reputation, you can set minimum attainment scores, minimum average ratings, or minimum review counts. For Security, you can require specific certifications (ISO 27001, SOC 2, etc.). For Similar Size Fit, you can set minimum and maximum employee counts. For inquiry-based criteria, you can set structured requirements derived from the criterion's answer fields (e.g. “Must offer 24/7 support”) or free-text requirements evaluated by AI.

When hard requirements reduce the qualified pool below 5 IT firms, the system presents relaxation suggestionsranked by impact — showing which single requirement removal would add the most vendors. You can relax requirements inline without restarting your evaluation.

For inquiry-based requirements, enforcement is retroactive. Vendors appear as “pending” until they respond. Once a response arrives, the system checks it against your requirements and disqualifies vendors that fail. You can always view disqualified vendors and their failure reasons in the results section.