Separate the person from the company
A technician's certification can support a claim about a particular area of knowledge. Ask whether that skill is relevant to your environment, whether the credential is current, and who actually performs the work. One certified employee does not establish that every member of the team has the same expertise.
Vendor partner status can indicate a relationship or program participation. It does not automatically prove secure operations, successful recovery, or expertise in your exact application. Ask the provider to connect credentials to the people and services in your proposal.
Read the scope behind an independent report
For an independent assessment, identify the legal entity, covered services, locations, assessment period, exceptions, and customer responsibilities. A SOC 2 report is an attestation report, not a blanket certification that nothing can go wrong. AICPA publishes an illustrative Type 2 report that shows why the actual report matters more than a marketing label. [S04]
Some reports are shared only under confidentiality restrictions. A reasonable diligence process can use an authorized summary, a controlled review, or specific answers about coverage. An assessment of a hosting vendor does not automatically cover the MSP's own administration and support processes.
Ask for relevant operational evidence
Request examples of access reviews, incident communication, restoration testing, and escalation procedures with sensitive information removed. Ask how the provider knows its controls are working and what happens when a control fails. A tool inventory answers what the company bought; an operating record helps explain what it does.
References should be relevant to your business's size, applications, and risk, not merely its industry label. With permission, ask a reference about transition quality, difficult incidents, billing clarity, and whether the provider follows through on recurring problems. A sanitized case study should distinguish measured results from customer impressions.
Treat missing evidence as a question, not an accusation
Smaller organizations may not hold every expensive certification or report. That does not automatically make them unsuitable, just as a long badge list does not automatically make a provider appropriate. Decide which evidence your risk, contracts, and regulators require, then assess gaps proportionately.
For Blue Tree Technology®, request the current status and scope of any credential you plan to rely on. An "in progress" program should remain described that way until it is earned. Ask for approved references rather than expecting another customer's confidential tickets or security details to be shared.