IT outsourcing RFP checklist for UAE and GCC companies: what to ask a managed service provider

Before you write the RFP

Most outsourcing bids are hard to compare because each provider guessed the scope differently. Fix that before you issue anything. If you need help with the tender process itself (timeline, scoring, shortlisting), see our guide to running an IT RFP or tender in the UAE. This checklist covers the questions to put to the providers.

• A user list, a device list (PCs, servers, network, printers, phones) and a site list with addresses and opening hours.
• The systems that stop the business when they fail: ERP, finance, line-of-business software, internet links.
• Your current contracts and their end dates, so the new provider can plan the handover.
• Any customer, regulator or insurer requirements you already have to meet.

1. Scope

• Which users, devices, sites and systems are covered, attached as a schedule with a process to add and remove items.
• Which services are included: helpdesk, onsite visits, monitoring, patching, security, backup checks, Microsoft 365 administration, vendor management.
• What is excluded, written as clearly as what is included.
• What counts as a project (new site, office move, migration) and how projects are quoted.
• Sites outside the main city or outside the country: onsite, remote, or local hands arranged by the provider.

2. SLAs and how they are measured

Ask for a table like this in each bid, with the numbers filled in:

Priority	Example	Response target	Resolution target
P1 Critical	Site or core system down	stated in hours	stated in hours, or workaround
P2 High	Department or key user blocked	stated in hours	stated in hours
P3 Normal	One user affected, workaround exists	business day	agreed days
P4 Request	New user, change, question	business day	agreed days

• Support hours: which hours the SLA clock runs for each priority. If you run shifts or warehouses, ask for cover that matches them and get it written into the contract.
• Definition of response: an engineer working on the issue, not an automatic acknowledgement.
• Measurement: taken from the provider’s ticket system and reported monthly, with the raw data available to you.
• Remedy: service credits, or a right to terminate if targets are missed for a stated number of months.
• Escalation: named people at each level, not just a shared mailbox.

3. Security controls

Your provider will hold admin access to your systems. Ask about its controls as well as the ones it will apply for you.

• Provider staff use named accounts with MFA; access is logged and removed the day someone leaves.
• Which security tools are included: endpoint protection or EDR, email security, firewall management, patching, backup monitoring.
• How fast the provider tells you about a security incident it detects, and who it tells.
• Whether it will complete your security or vendor-risk questionnaire, and which certifications it actually holds. Ask for certificates, not logos.
• Restore testing: how often backups are test-restored, and whether you see the results.

For a starting point on Microsoft 365 controls, see our Microsoft 365 security baseline.

4. Data residency and the PDPL

• Where your data will be stored and backed up, by country and by provider (Microsoft, a backup vendor, the MSP’s own systems).
• Whether any of the provider’s staff outside your country can access your systems, and under what controls.
• Data processing terms that support your obligations under the UAE PDPL (Federal Decree-Law No. 45 of 2021), or DIFC or ADGM rules if they apply. Our PDPL basics guide covers the essentials.
• For GCC operations, any local rules on where specific data, such as government or banking data, must be kept.
• What happens to your data, including backups, when the contract ends.

5. Exit and handover terms

• Your Microsoft tenant, domains, licences and admin accounts registered to you, not to the provider.
• Documentation, passwords, network diagrams and configuration backups handed over in writing.
• A transition period in which the outgoing provider works with the new one.
• Notice period and any exit fees stated up front.

Our guide to switching IT provider without downtime shows how a handover runs in practice.

6. Staffing and escalation

• Who answers the helpdesk, who comes onsite, and who owns your account.
• Languages the support team speaks, if your staff need more than English.
• Where the team is based and which work is done remotely.
• How the provider covers holidays and sickness, so your service does not depend on one engineer.
• Whether a dedicated team is available if you need people working only on your account.

7. Reporting and governance

• A monthly report: tickets by category and site, SLA performance, patching, backup status and repeat problems.
• A quarterly review with recommendations and a budget view for the next year.
• An asset and licence register kept up to date and shared with you.
• Ask each bidder for a sample report. It tells you more than the proposal.

8. Pricing models

Model	Suits	Ask
Per user per month	Office-based companies	What counts as a user; shared mailboxes and leavers
Per device per month	Warehouses, plants, shared PCs	Which device types; servers and network priced separately?
Fixed monthly fee	Stable estates	What changes the fee, and with how much notice
Annual maintenance (AMC)	Companies with in-house IT	Visits included, parts, response targets

• Ask every bidder to price the same model so you can compare.
• Ask for rates for out-of-scope work and for projects.
• Ask whether prices include the standard 5% UAE VAT.
• Compare three-year total cost, not the first year’s fee. Our AMC vs managed services guide explains the differences.

9. Onboarding and migration

• A written onboarding plan with dates and owners. For a mid-sized company about 30 days is a reasonable expectation.
• How migrations are staged, and how each stage can be rolled back if something fails.
• Whether the current provider stays on until the new one has tested its side.

Red flags in a bid

• No SLA table, or targets with no stated hours.
• "Unlimited support" with no list of what that includes.
• Your tenant or domains to be registered in the provider’s name.
• Claims of certifications with no certificate attached.
• A price given before anyone has looked at your sites.

How Missan answers this checklist

We have run managed IT for 22+ years, with 5,000+ clients served since 2004, and many clients have been with us for more than a decade. We give fixed quotes after a site survey, run staged migrations with a way back, and onboarding usually takes about 30 days. Support hours and SLA targets are written into the contract. If you leave, your Microsoft tenant and accounts stay in your name. Procurement details are on our supplier information page, and our enterprise fact sheet covers RFP credentials.

Related Missan services

• Supplier information for procurement
• Enterprise and RFP fact sheet
• Trust centre and security questionnaires
• Managed IT services
• Questions to ask an MSP

Frequently asked questions

What should an IT outsourcing RFP include?

At minimum: the scope (users, devices, sites, systems and what is excluded), the support hours you need, SLA targets per priority and how they are measured, the security controls you expect, where your data may be stored, exit and handover terms, staffing and escalation, reporting, and the pricing model you want quoted. Attach an asset and user list so every bidder prices the same thing.

How should SLAs be measured?

Per priority level, in stated hours, with the clock running only during the hours written in the contract. Ask for a monthly report showing actual performance against each target, taken from the provider’s ticket system, and a remedy if targets are missed repeatedly.

Does the UAE PDPL affect IT outsourcing?

Yes. Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) your provider is processing personal data on your behalf, so the contract should cover what they can access, where data is stored, how incidents are reported and what happens to data when the contract ends. Firms in DIFC or ADGM have their own data protection rules. Your legal adviser confirms which apply.

Which pricing model is best?

Per user per month suits most office-based companies. Per device suits shared devices and warehouses. A fixed monthly fee suits a stable estate. Whatever the model, ask what is excluded, the rate for out-of-scope work, and how the price changes when you add users or sites.

How long does onboarding with a new MSP take?

For a mid-sized company, about 30 days is typical: documentation, admin access, monitoring and backups first, then the helpdesk switch. Ask each bidder for a written onboarding plan with dates and named owners.

What exit terms should we insist on?

Your Microsoft tenant, domains and licences registered to you, a handover of all documentation, passwords and configuration backups, and a transition period during which the outgoing provider cooperates with the new one. Put the notice period and handover duties in the contract, not in a side letter.

This guide is general information for planning, not legal or tax advice. Regulations and deadlines change; confirm the current position with the official source linked in the text and with your own advisers. Last reviewed 22/10/2026.