Why three MSP proposals for the same office are not comparable

Seven national cyber agencies had to write down, in a public advisory, that a managed service provider negotiating a contract should provide clear explanations of the services the customer is purchasing, services the customer is not purchasing, and all contingencies for incident response and recovery. That sentence does not get drafted, cleared by seven agencies and published unless the opposite is the ordinary condition of the market.

The industry's own admission

Read the advisory as a procurement document rather than a security one and it reads as an inventory of things buyers routinely do not know after signing: whether multi-factor authentication is enforced on the provider's own accounts, whether logs are retained and visible, whether backups meet the recovery targets anyone has written down, and who owns hardening, detection and incident response. The same authorities recommend that customers verify their contractual arrangements include security measures matching their requirements, and that contracts specify whether the provider or the customer owns each of those duties. The companion CISA note for buyers goes further and lists what a provider should hand over before award, starting with specific performance-related service level agreements, including a clear delineation of operational IT services and security services. The delineation is listed because it is usually absent.

Every buying guide published by a provider arrives at the same place and stops there. It concedes that the proposals in front of you describe different things, hands over a checklist, and wishes you well. The concession is correct. The stopping is the problem, and it is not an accident: the party writing the guide is one of the bidders, so it cannot publish the conversion that would rank its own proposal against two others.

There is a large buyer of services that refuses to live with this. The federal government does not ask offerors to volunteer a comparable format; it dictates one. The uniform contract format fixes sections A through M, with Section L carrying instructions to offerors and Section M carrying the evaluation factors for award, so that every response lands in the same shape. Price analysis then leans on that shape: comparison of proposed prices is the first technique the proposal analysis rules name, and the rules attach conditions to it, requiring adjustment for materially differing terms and conditions before any two prices are set beside each other. Comparability is treated as something you construct, not something you find.

One office, three bids

Here is a fixed environment: 41 people, two sites, 54 workstations and laptops, nine servers including two at the second site, seven shared floor logins used by staff who have no assigned machine. Nothing about that environment changes across the three bids below. Only the unit each provider chose to price in changes, and the carve-outs each one made while pricing.

The arithmetic nobody does

On the headline row the order is Tamarack, Ellsworth, Cedar Ridge, and the gap between first and last is $722 a month. On the scope-matched row the order is Ellsworth, Cedar Ridge, Tamarack, and the gap is $16,474 a year. Nothing was invented to produce that reversal. The nine servers were added back at $214 each, the rate Tamarack put in its own optional schedule, and the onboarding fee was folded into year one because it is cash that leaves in year one.

The result is more awkward than the version of this story usually told, which is why it is worth walking through. The low bid did not turn out to be a swindle; it turned out to be a quote for a smaller job. The winner is not the most expensive proposal either. It is the middle headline, from the provider that happened to quote per device and therefore had to enumerate every device before it could produce a number. Ellsworth's per-device model did not make Ellsworth more honest. It made Ellsworth's arithmetic legible, which is a different virtue and the only one available at the proposal stage.

Cedar Ridge is worth a second look before you discard it. Per-user pricing absorbs device count, so the seven shared floor logins cost nothing and the tablets this business is about to hand its field crew will cost nothing either. If headcount is flat and device count is rising, Cedar Ridge's $5,926 annual premium over Ellsworth is buying an option on that growth. If headcount is what grows, the option is worthless and you have overpaid. We cannot tell you which of those is true for you, and neither can any of the three bidders — that one turns on a hiring plan none of them has seen.

Why the work goes undone

The conversion above took about forty minutes: read three proposals, build one device inventory, find every optional schedule, restate each price against the same denominator, and note which line items exist in one document and not the others. It is tractable. It is also unpaid, unglamorous and impossible to do well while three salespeople are chasing a decision, which is the actual reason it goes undone rather than any deep opacity in the market.

The structural obstacle is that the four parties who could do it all have a reason not to. Each bidder is disqualified by self-interest. An IT consultant billing hourly to evaluate proposals is often the fourth bidder in disguise. Procurement software sells a scoring matrix and leaves the units to you, which moves the work rather than doing it. And the buyer, who has the strongest interest, has the least practice: most firms run this decision once every four or five years, which is exactly the cadence at which no institutional skill accumulates.

What changes when the units match

Three things change, and only three. The ranking changes, sometimes sharply, as it did above. The exclusions become visible, because a missing line item is obvious in a column and invisible in a fourteen-page PDF. And the conversation with the provider changes, because you can ask why the same nine servers cost $214 each on one sheet and are folded into $61 workstations on another, which is a question with a real answer that a good provider will enjoy giving.

What does not change is the part that matters most and normalizes least. A cost per endpoint says nothing about whether the person answering the phone at 2am is a named engineer who has seen your network or a first-line agent reading a script. It cannot price the difference between a provider that will still be independently owned in three years and one that is mid-conversation with an acquirer. Those judgements sit outside the arithmetic, and we would rather say so than pretend a tabulation settles them.

Where we stand

This surface exists because doing the conversion is our business model rather than an aside in someone's marketing. You describe the environment once. Three or four providers who actually serve your area, your size and your compliance profile are invited to bid. What comes back is restated into one set of units, with every carve-out flagged, and handed over as a single sheet with contact details attached. Take whichever discovery calls you want.

If you would rather do it yourself, the rest of this surface is the method rather than a teaser for it: how the pricing models differ and what each one hides, how to compute a cost per endpoint and where that number lies to you, a scope skeleton that forces the twelve line items to be priced identically, the contract questions that decide what the price actually means, and what HIPAA and CMMC change about the whole exercise. None of it is gated, and there is no PDF to trade an email address for.