What to Look for in Managed IT Services in Jacksonville, FL: A Buyer Checklist

Use this during evaluation rather than after it. Most proposals differ from each other on scope rather than on price, so the questions below are designed to surface what a proposal leaves out. Work through it with every provider on your list, including us, and write the answers down. Two or three items will eliminate candidates quickly, which is the point.

Anything a provider will not put in the agreement should be treated as marketing rather than a commitment.

Before You Talk to Anyone

Do this first. Without it, the best proposal writer defines your requirements for you.

• ☐ Counted your users and your managed devices, including servers and network equipment
• ☐ Listed your Jacksonville and any remote sites, and which have technical staff present
• ☐ Decided your genuine coverage hours, including whether nights and weekends are real requirements
• ☐ Confirmed which compliance frameworks apply through regulation or customer contract: HIPAA, PCI DSS, NYDFS, CMMC, or customer-imposed requirements
• ☐ Written one page of requirements to send to every provider

Florida and Jacksonville Specifics

These questions apply to every provider you evaluate, local or regional. They surface the gaps that matter most in this market.

Does your incident response plan account for Florida’s 30-day notification deadline?

Under the Florida Information Protection Act, Fla. Stat. § 501.171, you have 30 days to notify affected individuals after determining a breach occurred or having reason to believe it occurred. The clock runs from discovery, not from the breach itself. At 500 or more affected Florida residents, you must also report to the Department of Legal Affairs within 30 days. At 1,000 or more individuals notified, you must contact the three largest national credit reporting agencies. If you conclude no notification is required because there is no likely risk of harm, that determination must be documented in writing, retained for five years, and filed with the Department within 30 days.

Ask your provider: does your logging and detection capability give us a defensible discovery date? Do you have a documented incident response process that aligns to FIPA timelines? Who drafts the notification and who files with the Department of Legal Affairs?

• ☐ Provider has confirmed logging and detection that produces a documented discovery date
• ☐ Provider has a written incident response process with FIPA timeline mapped into it
• ☐ Named contacts for legal notification and regulatory filing are in the plan

Can your backup and recovery plan survive a Gulf Coast storm?

A recovery copy in the same county as your primary environment is not a recovery copy during a storm that covers Duval County. Two facilities in the same regional power and fiber footprint fail the same test.

• ☐ Confirmed where backups replicate to, and that it is outside the Gulf Coast storm corridor
• ☐ Confirmed at least one immutable copy that ransomware and a failed restore cannot delete
• ☐ Confirmed recovery objectives are set per system, not one number for the whole business
• ☐ Confirmed date of the last tested restore of an environment like yours

Are your support hours in Eastern Time?

Jacksonville runs on Eastern Time, and most Florida providers publish hours in that zone. Confirm the desk is actually staffed then, not just that the listed hours happen to match your local time.

• ☐ Support hours confirmed in Eastern Time in the agreement
• ☐ After-hours escalation path confirmed with a named contact

Scope and What Is Included

• ☐ Received a line-item response to your requirements document, not the provider’s own template
• ☐ Read the exclusion list before the inclusion list
• ☐ Confirmed whether third-party application patching is included, or only Microsoft updates
• ☐ Got the out-of-scope hourly rate in the agreement
• ☐ Confirmed whether software licensing is passed through at cost or marked up
• ☐ Asked for onboarding assessment findings before signing

Red flag: a provider who will not scope onboarding remediation up front is deferring an invoice, not absorbing one.

Security Operations

• ☐ Established what endpoint security actually means here: detection and response, or managed antivirus
• ☐ Confirmed whether a security operations centre is staffed overnight, and by whom
• ☐ Confirmed which containment actions the provider will take without asking you
• ☐ Got the list of telemetry sources ingested: endpoint, identity, cloud, email, network
• ☐ Confirmed log retention length, and whether it is long enough to support a FIPA investigation that starts weeks after the breach
• ☐ Confirmed who remediates after containment, on their side or yours

Why log retention matters here specifically: Florida’s 30-day clock starts at discovery. If you find out eight weeks after access occurred, your logs decide whether you can answer what happened and whose data was taken. See our managed security services.

The Provider’s Own Security

Your provider will hold privileged access into your environment. CISA publishes guidance for MSP customers that makes this a procurement question, not just a service one.

• ☐ Defined required privilege levels before contract award rather than granting broad access and narrowing later
• ☐ Asked how client environments are isolated from one another
• ☐ Asked what the blast radius is if another of their clients is compromised
• ☐ Asked how their own administrative accounts are protected
• ☐ Required incident response provisions in the contract, including where the incident is theirs
• ☐ Asked for their own security attestations and their subcontractor list

Compliance and Evidence

Jacksonville’s mix of logistics, financial services, healthcare, and defense suppliers means compliance obligations vary widely. Confirm coverage for whichever applies to you.

• ☐ Confirmed which compliance frameworks they have produced evidence for, in your sector
• ☐ Confirmed evidence production is a standing deliverable with a cadence, not an annual project
• ☐ Confirmed access reviews run on a defined schedule
• ☐ Confirmed backup immutability and recovery testing

For healthcare organizations: HIPAA requires a risk analysis, not just a gap assessment. Ask whether your provider produces the risk analysis documentation OCR actually examines. See our healthcare practice.

For financial services and their vendors: Third-party risk assessments from large institutions and carriers arrive on their schedule. Ask whether the provider helps you maintain the evidence continuously rather than assembling it under a deadline.

For defense and federal suppliers: CMMC obligations changed in July 2026, when third-party certification requirements were suspended while self-assessment and annual affirmation obligations stayed in force. Your prime’s flow-down clauses still bind you. Ask whether the provider can support NIST 800-171 evidence and SPRS attestation. See our compliance work.

People and Staffing

• ☐ Got named engineers who will work on your environment
• ☐ Confirmed where the service desk is physically staffed, for every tier including overnight
• ☐ Asked whether any subcontractor holds administrative credentials in your environment
• ☐ Confirmed bilingual support if your workforce needs it

Onsite Coverage

Jacksonville is served well by regional providers given the Florida footprint, but the Beaches, Mandarin, Orange Park, and outer Duval County locations vary. Confirm coverage extends to your actual sites.

• ☐ Got a written onsite response window for each of your sites, not just a general commitment
• ☐ Confirmed whether onsite is delivered by employees, a local partner, or dispatch
• ☐ Confirmed onsite hours are included, capped, or billed per visit

Contract Terms

• ☐ Modelled the full term with annual escalators, not the first month
• ☐ Confirmed data and documentation portability: diagrams, configurations, licence records, credentials, in a usable format at any point
• ☐ Asked who owns the company now and what happens to your terms if they are acquired
• ☐ Confirmed response and resolution commitments separately

References

• ☐ Took three reference calls at Jacksonville or Florida organizations of similar size and sector
• ☐ Asked: was communication clear
• ☐ Asked: did problems surface early enough to fix
• ☐ Asked: were commitments met and invoices predictable
• ☐ Asked: would you sign again
• ☐ Read published case studies as background

Red Flags Summary

• ☐ Proposal in their template rather than against your requirements
• ☐ No exclusion list, or one you had to ask for
• ☐ Cannot explain how their logging supports a FIPA notification timeline
• ☐ Backup replication inside the Gulf Coast storm corridor
• ☐ Backup never tested against your actual environment
• ☐ Discomfort with the question of how you would leave
• ☐ Cheapest quote by a wide margin

If You Are Keeping Internal IT

A co-managed arrangement needs three additional items:

• ☐ Responsibility matrix agreed before the contract, splitting by function and time of day rather than by system
• ☐ Explicit answer on who owns a ticket at 2am
• ☐ Your internal IT lead involved in provider selection, genuinely rather than as a courtesy

See our co-managed IT services in Jacksonville.

Talk to Us

If you are partway through an evaluation and want a second opinion on your requirements rather than another proposal, that is a reasonable place to start. Schedule a consultation.