MSP security stack minimums

When an SMB hands its IT to a managed service provider (MSP), it hands over its security too, whether it knows it or not. Threat actors know it: access to an MSP's administration tool opens every client at once. The question for an MSP is therefore not "do we offer security?" but "what is the minimum below which we refuse to go, for our clients and for ourselves?".

Two free, public references answer that question for modestly sized organizations. The Canadian Centre for Cyber Security publishes the Baseline Cyber Security Controls for Small and Medium Organizations (version 1.2), built on the 80/20 rule: 80% of the benefit for 20% of the effort. The Center for Internet Security defines, in CIS Controls v8.1, Implementation Group 1 (IG1) as "essential cyber hygiene", the emerging minimum standard for every enterprise, designed for those with little in-house expertise. An MSP that delivers both sets to every client, and applies them to itself, holds a defensible minimum.

The thirteen baseline controls, from the MSP's seat

The Cyber Centre lists thirteen baseline controls. Here is what each means in a managed-services offer.

1. An incident response plan. Written, tested, with roles, out-of-band contacts and escalation thresholds. The MSP needs its own and a template for each client; in a ransomware event, the first hour cannot be improvised.
2. Automatic patching of operating systems and applications. The most cost-effective measure in the catalogue and the most often neglected "because the client dislikes reboots". The contract must set the windows and exceptions in writing.
3. Security software enabled: antivirus or EDR on every workstation and server, with a console someone actually watches.
4. Devices configured for security: default accounts disabled, unnecessary services closed, disk encryption, a documented reference configuration.
5. Strong authentication. Multi-factor authentication on every administrative access, every remote access and every mailbox. For the MSP itself, it is non-negotiable on the remote management tool (RMM) and on client consoles.
6. Employee awareness training, at least yearly, with phishing exercises.
7. Data backup and encryption, with offline copies. The Cyber Centre's ransomware playbook is explicit: backups that are not connected to the network are the most important mitigation, because ransomware can neither find nor delete them. A backup that has never been restored does not exist.
8. Secure mobile services: device management, encryption, remote wipe.
9. A basic perimeter defence: configured firewall, VPN for remote access, segmentation between workstations, servers and equipment.
10. Secure cloud and outsourced IT services: the MSP is itself in this category and must be able to show its clients its own controls.
11. Secure websites: HTTPS, updated CMS and plugins, security headers.
12. Access control and authorization: least privilege, named accounts, access review when an employee leaves.
13. Secure removable media: a clear policy, encryption, ports blocked where justified.

What the client should see

A security minimum only exists if it is measurable. A serious MSP gives each client, every quarter, the state of these controls: percentage of patched endpoints, accounts without MFA, last successful backup restore, incidents and alerts handled. The report need not be pretty; it must be true and dated.

Two items deserve a line of their own in that report. The incident response plan should be exercised at least once a year, with the client in the room, because a plan nobody has rehearsed is a document, not a capability. And the backup line should state how many offline copies exist and when the last full restore was tested: the Cyber Centre's playbook recommends storing several copies of backups offline precisely so that a compromised network cannot take them all.

What the MSP must apply to itself

Supply-chain attacks target precisely the MSP's tools: remote access, central backup, password management. The minimum for the provider itself:

• MFA on every console and conditional access tied to managed devices.
• Separate administration accounts per client.
• Central logging with enough retention to investigate.
• Patches for its own tools within days of release, especially those exposed to the internet.
• A periodic penetration test of its own perimeter, not only of its clients'.

Where IG1 and the baseline controls meet

The two frameworks describe the same idea by two paths: inventory what you protect, reduce the attack surface, require strong authentication, patch fast, back up offline, train people and know how to respond to an incident. IG1 adds a useful discipline for an MSP: each measure is a verifiable safeguard, which makes it a good basis for a service contract.

Beyond the minimum

The minimum protects against opportunistic attacks, which are the vast majority. It does not replace continuous monitoring with someone who answers, nor regular penetration tests. That is where we work with MSPs: 24/7 monitoring and incident response for their clients, penetration tests of their perimeter, and compliance audits when a client must demonstrate SOC 2, ISO 27001, PCI DSS or Law 25.