How to Manage Your Managed Service Provider: An MSP Oversight Checklist for Mid-Market Owners and Operators

How to Manage Your Managed Service Provider: An MSP Oversight Checklist for Mid-Market Owners and Operators

2026-10-27

Takeaway: Your managed service provider (MSP), the outside firm that runs your IT, probably holds admin access to almost everything you own. That makes it one of your biggest security risks as well as one of your most useful vendors. Write down who owns which security job, lock down the MSP’s own accounts, require logs and incident notice you can see, and review the arrangement on a schedule instead of waiting for something to break.

Most mid-market companies outsource IT for good reasons: it’s cheaper than a full team, and a decent MSP knows more about patching and backups than an office manager ever will. The trouble starts when “we outsourced IT” quietly turns into “we outsourced thinking about IT.” Then nobody inside the business can say what the MSP is responsible for, what it can reach, or how you’d find out if it got breached.

Why your MSP is a security question, not just a service question

To do its job, an MSP needs privileged access (admin-level rights) across your network, often through remote monitoring and management (RMM) software that can push changes to every machine at once. Attackers know this. Breaking into one MSP can open the door to every one of its customers.

That’s not a theory. On July 2, 2021, attackers exploited a vulnerability in on-premises Kaseya VSA, RMM software used by many MSPs, and pushed ransomware to MSPs and their downstream customers, according to CISA’s guidance for affected organizations (July 12, 2021). CISA and the FBI told affected customers to make sure backups were current and air-gapped (kept disconnected from the network), switch to manual patching, and put multi-factor authentication (MFA, a second login step beyond a password) and least privilege on admin accounts (CISA-FBI guidance, last revised July 6, 2021).

The broader numbers point the same way. Verizon’s 2025 Data Breach Investigations Report (released April 23, 2025, covering 12,195 confirmed breaches) found third-party involvement in breaches doubled to 30%. The 2026 edition (May 19, 2026) puts breaches involving a third party at 48%. Not all of those are MSPs, but your MSP is usually the third party with the most access.

The MSP oversight checklist

The best single source here is a joint advisory from the US, UK, Australian, Canadian, and New Zealand cyber agencies, AA22-131A (May 11, 2022). Its core message to customers: put the controls in the contract. Here’s how that translates for an owner or operator.

1. Write down who owns which security job

AA22-131A tells customers to make sure MSP contracts “transparently identify ownership” of security roles and responsibilities. In plain terms: for patching, backups, monitoring, user accounts, and incident response, is it you, the MSP, or nobody? “Nobody” is the answer you’re trying to find before an attacker does.

2. Lock down the MSP’s own accounts

The advisory says contracts should require MFA on all MSP accounts that reach your environment, and that MSPs should treat those accounts as privileged. Ask for a list of every account the MSP uses in your systems, who it belongs to, and whether it’s shared. Disable accounts that are no longer in use, and make account removal part of your offboarding steps if you ever change providers.

3. Require visibility into what the MSP does

If the MSP handles monitoring and logging, AA22-131A says the contract should require it to give you visibility into its own presence, activities, and connections to your network, and to notify you of confirmed or suspected security incidents on its infrastructure. The agencies also recommend keeping your most important logs for at least six months, because incidents can take months to detect.

4. Make backups and recovery explicit

Who owns backups, where they live, how often they’re tested, and how fast you get your data back belong in writing. Kaseya showed why at least one copy should sit somewhere your MSP’s tools can’t reach.

5. Hold them to service levels you can measure

Response times, patch timelines, and a monthly report you actually read. If the MSP sets its own priorities and you only hear from it at renewal, you have a vendor, not a partner.

6. Review it on a calendar

Once a year at minimum, walk through this list with the MSP. Compare the contract to what’s really happening. Treat changes in its staff, tools, or ownership as triggers for an extra review.

What this doesn’t mean

None of this says “fire your MSP.” A good provider will welcome clear terms, because they protect it too. The goal is that someone on your side understands the arrangement well enough to ask hard questions and judge the answers.

The bottom line

Your MSP has the keys. Make sure the contract says what it does with them, and that someone on your team checks. Yellow Coop’s CIO work includes a help desk and managed service provider review, with service levels you can hold them to. Its Virtual level puts an experienced technology executive on call as an escalation point for your IT lead or provider. Let’s talk.

Sources