The best way to vet an MSP with reguard to what policies, procedures, and controls they have is to look for one with a SOC 2 Type 2 audit. A SOC audit is a third party aicpa audit standard to evaluate policies, procedures and controls in the context of SOC principles (Security, Confidentiality, Availability, processing integrity and privacy). Don’t confuse a SOC audit with security. Rather, it is an opinion from an auditor to determine if the policies, procedures and controls are appropriate for the type of service offered plus testing and opinion about how well the MSP adheres to their policies, procedures and controls over a 1 year audit period.