SMB Cybersecurity BriefingDaily cybersecurity intelligence for small and mid-sized businesses

MSP Security Expectations: Questions With Checkable Answers

Published · Last reviewed

Ask your managed service provider (MSP) questions whose answer is a version number, a date, a list or an export, never “are we safe?”. Eight areas cover most of the risk: administrator access, multi-factor authentication on the provider’s own accounts, patch status, backups and who can delete them, incident notification time, remote-management tools, technician offboarding, and the provider’s own insurance.

Why the question wording matters

An MSP usually holds the strongest keys in your business: administrator accounts, remote-control software and often the backups. That is normal and useful, and it also means an MSP’s weaknesses become yours. A question such as “Is our environment secure?” invites “yes”. A question such as “Send me the list of accounts with administrator rights and the date each was last reviewed” invites evidence, and the absence of evidence is itself an answer.

The same approach works whether the provider is a large firm or one person who looks after your office. Nothing here accuses anyone. It is the same discipline you would apply to a bookkeeper who holds your bank login.

The eight questions

Action
Ask for the list of administrator accounts in your Microsoft 365 or Google Workspace tenant, split into your own staff and the provider’s technicians, with the date each was last reviewed. Check it yourself in Microsoft Entra admin center Roles and administrators or Google Admin console Account Admin roles.
Why it helps
Every standing administrator is an account an attacker can aim at. Former technicians and shared logins are the usual surprises.
Verification
The provider’s list matches what the console shows, name for name, and every account is individually named rather than shared.
Fallback if delayed
If the provider cannot produce the list this week, ask the console to be opened to you as read-only and review it yourself before the next invoice.
Action
Ask for evidence of multi-factor authentication on every technician and admin account. In Microsoft 365, the authentication-methods registration report in the Entra admin center shows who is registered; in Google Workspace, the user security report in the Admin console under Reporting Reports User reports Security shows 2-Step Verification enrolment.
Why it helps
The provider’s accounts reach many customers at once, so they are high-value targets.
Verification
An export dated within the last 30 days shows every admin account enrolled, with no exceptions listed as “temporary”.
Fallback if delayed
Until the export arrives, ask that technician access be limited to named accounts with a time-limited role.
Action
Ask for patch status as dates and builds: the operating-system build and last-patched date for each server and each internet-facing device, plus the list of devices not patched in the last 30 days. Compare it with the CISA Known Exploited Vulnerabilities catalogue.
Why it helps
“We patch monthly” says nothing about the one device that missed the cycle.
Verification
You receive a dated list, and any device on it that appears in the KEV catalogue has a named owner and a due date.
Fallback if delayed
Where a patch cannot be applied, ask for the compensating control in writing, such as taking the service off the internet.
Action
Ask where the backups are held, who can delete them, and the date of the last successful restore test for a file, a mailbox and a server. See restore testing for what a proper test shows.
Why it helps
A backup the provider’s own admin account can erase will be erased by anyone who steals that account.
Verification
You are given a test date and a result, and one copy is immutable or offline according to the immutable backup guide.
Fallback if delayed
If no test has been run, ask for one within 30 days and put the date in your calendar.
Action
Ask for the incident-notification commitment in writing: the number of hours within which the provider will tell you of a suspected incident on its own systems or your tenant, and the named person who will call.
Why it helps
Delay is the main cost of a vendor incident, because you cannot protect what you have not been told about.
Verification
The clause is in the contract or service schedule, with a phone number that is answered outside business hours.
Fallback if delayed
Without a clause, send the provider an email stating your expectation and keep the reply.
Action
Ask which remote-management and remote-access tools are installed on your machines, who can use them, and how their sign-in is protected. CISA publishes a guide to securing remote access software to compare against.
Why it helps
These tools give full control of your devices, and attackers look for them.
Verification
You hold a list of tool names that matches what is installed on a sample of three of your machines.
Fallback if delayed
Remove any tool nobody can explain.
Action
Ask how fast the provider removes a technician’s access when they leave or change role, and ask for the last date it did so.
Why it helps
Departed technicians with live access are a common and avoidable gap.
Verification
A named example with a date, or a written procedure with a time limit such as same day.
Fallback if delayed
Review the admin list yourself every quarter.
Action
Ask for the date and limits of the provider’s own cyber and professional-liability cover and for a certificate you can file.
Why it helps
If the provider’s error causes your loss, the cover decides what is recoverable. See cyber insurance requirements.
Verification
A certificate with a current expiry date is in your vendor file.
Fallback if delayed
Note the gap in your risk register and raise it at contract renewal.

Profile B/C delta: In Google Workspace the console names above are the Admin console equivalents. In a hybrid on-premises directory, also ask who holds Domain Admin rights and when that group was last reviewed.

How it works

Each question turns a promise into a record. A list, an export or a dated test is evidence you can file and compare next quarter. An answer that is only a sentence is a prompt for a follow-up, not a result.

Send the eight questions as one email, ask for replies within two weeks, and keep the answers in a folder with the date. Review them at each contract renewal and after any incident, and when a reply changes, ask why. The point is not to catch the provider out. A good provider will have most of these answers to hand, and will welcome a customer who asks, because it makes their own review easier.

Worked example

A hypothetical 40-person firm sends the eight questions. The provider replies within a week with an admin list of nine accounts. The firm’s office manager opens the Roles and administrators page and counts eleven. Two belong to a technician who left the provider last year. Nobody was careless; the list was never reconciled. The provider removes both the same day and agrees to send a fresh list each quarter.

The patch answer lists one firewall last updated many months ago, and its model appears in a vendor advisory the firm has not yet read. The provider schedules the update for that weekend and, until then, restricts the management page to the office address. The firm records both the date and the interim control. All names and counts in this example are invented to show the method.

Frequently asked questions

What should a small business ask its MSP about security?

Ask who has administrator access, whether multi-factor authentication covers every technician account, which devices are unpatched and since when, where backups are held and who can delete them, how quickly the provider will notify you of an incident, and what insurance it carries. Ask for lists, dates and exports.

How often should I review my MSP’s security answers?

At least yearly and at each contract renewal, and again after any incident at the provider. The administrator list is worth reviewing every quarter, because it changes as people join and leave.

Can my MSP access my data without telling me?

A provider with administrator rights can usually reach your mail, files and systems. Ask what access is routine, how it is logged, and how you can see the log. Where you can, keep a read-only view of the admin audit log yourself.

Should I put security requirements in the contract?

Yes where you can. A named incident-notification time, multi-factor authentication on technician accounts, and an annual review are reasonable terms. Ask a lawyer to review the wording.

What if my MSP is one person?

The same questions apply, and the answers matter more because there is no second pair of eyes. Ask who covers when they are unavailable and where the recovery details are kept.