How to Vet an MSP's Security Before You Sign

Outsourcing IT means handing someone the keys to your network. Remote management tools, admin accounts and backup systems all sit in the provider's hands. If that provider is breached, the attacker can inherit the same access. So the security review should happen before the contract, not after the first incident.

The good news is that a careful buyer can test most of the risk in advance. A Los Angeles managed service provider that advertises an annual independent SOC 2 audit, for example, gives buyers a document to request and read. This guide sets out what to ask for, what the answers should look like, and how to keep checking once the work begins.

Why Do Attackers Target Managed Service Providers?

An MSP is an efficient target because one compromise can open many doors. Its staff hold privileged access to many customer environments at once. Attackers know that breaking into the provider can be easier than breaking into each customer.

Government agencies have warned about this pattern directly. On 11 May 2022, seven agencies from five countries released a joint advisory on threats to MSPs and their customers. The authors included the UK's NCSC, CISA, the NSA and the FBI. The release pointed to the 2020 SolarWinds compromise as an example of how a supply chain attack can reach customers worldwide. CISA Director Jen Easterly said that "malicious cyber actors continue to target managed service providers."

Recent breach data shows why the advice still matters. The 2026 Verizon Data Breach Investigations Report found that 31% of breaches now start with software vulnerabilities. It also found that 48% of all breaches involve ransomware. An MSP that patches slowly or reuses admin credentials multiplies both risks across every client it serves.

Which Questions Should You Ask an MSP Before Signing?

The joint advisory gives buyers a useful baseline for these conversations. Ask each provider on your shortlist the same questions, and ask for written answers.

1. How long do you keep logs? The advisory recommends keeping important logs for at least six months, because incidents can take months to detect.
2. Is multi-factor authentication required on every account that reaches our systems? The advisory says customers should require MFA in the contract itself.
3. How fast do you patch? Ask how the provider ranks known exploited vulnerabilities against routine updates.
4. Who on your team can reach our environment? Request a list of named roles and the access level each one holds.
5. How do you remove access when staff leave? Unused accounts are an easy way in, so ask for the offboarding steps.
6. Can we read your latest SOC 2 report? Ask which report type it is and which period it covers.
7. How quickly will you tell us about an incident? Put the notification window into the service agreement.

Vague answers are a finding in themselves. A provider that cannot describe its own logging or access model is unlikely to manage yours well.

What Does a SOC 2 Report Actually Prove?

A SOC 2 report is an independent auditor's view of a service organization's controls. The AICPA's SOC 2 guidance names five trust services criteria for these reports. A report may cover some or all of them, so check the scope page first.

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

The report type matters as much as the scope. Compliance platform Drata describes the difference between the two types in plain terms.

A Type 2 report is the stronger evidence, because it shows controls working over time. Even so, it is not a guarantee of safety. Read the exceptions section, check the dates, and confirm that the systems in scope are the ones that will touch your data. For a buyer's view of what goes wrong without this evidence, see this piece on vendor SOC 2 gaps.

How Can You Keep Checking After the Contract Starts?

Vetting does not end at signature. Providers change staff, tools and subcontractors, and each change can shift your risk. A light, repeating review keeps the picture current.

The CIS Controls offer a structure for that review. The framework lists 18 controls, and Control 15 covers service provider management. It asks organizations to build a process for evaluating providers that hold sensitive data or run critical IT platforms. Smaller teams can start with Implementation Group 1, a foundational set of 56 safeguards meant to defend against the most common attacks.

• Request the provider's new SOC 2 report each year and compare it with the last one.
• Review the list of provider accounts in your environment every quarter.
• Confirm that MFA is still enforced on every remote management tool.
• Ask for evidence of patch timelines, not just a policy document.
• Bring in an independent assessor now and then, since MSP self-auditing can hide gaps.

Write these checks into the contract as reporting duties. That way the evidence arrives on schedule, and you do not have to chase it.

Turning Answers Into a Shortlist

Score each provider on the same questions, then weigh the evidence rather than the sales pitch. A current Type 2 report, clear logging and enforced MFA should carry the most weight. A provider that shares documents readily is usually easier to work with when something goes wrong. The aim is simple: give admin access only to a partner whose controls you have actually seen.

Frequently Asked Questions

What Is the Biggest Security Risk of Using an MSP?

The biggest risk is privileged access. An MSP often holds admin rights across many client networks, so one breach at the provider can spread to its customers.

Is a SOC 2 Type 1 Report Enough to Trust a Provider?

A Type 1 report only shows how controls were designed at a single point in time. A Type 2 report also tests whether those controls worked over a period, so it is stronger evidence.

How Long Should an MSP Keep Security Logs?

The 2022 joint advisory recommends keeping important logs for at least six months. Incidents can take months to detect, and shorter retention may leave no trail to investigate.

Should MFA Be Written Into an MSP Contract?

Yes. The advisory says customers should contractually require multi-factor authentication on the services they receive. A written duty is easier to enforce than a verbal promise.