Choosing a Secure MSP: A Small Business Guide

When a small business hires an IT support company or managed service provider (MSP), it usually hands over the keys to everything: email, files, laptops, backups and often the bank login on the office PC. That is sensible, because few small firms can run IT security themselves, but it means the provider's own security, and the way it connects to you, becomes part of your security. Attackers know this and target MSPs to reach many customers at once. This guide is for owners, office managers and anyone in a small organisation choosing, reviewing or leaving an IT provider. It explains in plain English what to ask before you sign, what to put in the contract, how the provider's access to your systems should work, what to check each year and how to leave safely. It draws on the UK National Cyber Security Centre's guidance on choosing an MSP and the US Federal Trade Commission's small business advice. If you are an MSP yourself, see the Cybersecurity for MSPs and MSSPs Guide instead.

Key takeaways

Your provider's access is your biggest single risk. Ask exactly who can log in to your systems, how they prove who they are, and how you would switch that access off in an emergency.
Look for Cyber Essentials Plus, then look further. NCSC calls Cyber Essentials the UK government's minimum baseline; a certificate is a good sign, but you still need to check the services you buy are set up securely.
Get the basics in writing. Patching within 14 days for critical updates, tested backups, two-step verification everywhere, security logs you can see, and clear incident reporting times.
You must stay the owner. Your domain name, Microsoft 365 or Google Workspace tenant, backups and admin passwords should be registered to your business, not the provider.
Plan the exit on day one. A contract that says how data, passwords and access are handed back makes it safe to change provider later.

What an MSP does and why it matters for security

An MSP or IT support company might set up and look after your computers, manage your email and cloud accounts, run backups, install updates, look after the office network and Wi-Fi, provide a help desk and, sometimes, security tools such as antivirus or email filtering. Some offer a separate security service, often called managed security or MDR, which watches for attacks around the clock.

To do this, the provider usually installs a remote management tool on your computers and holds administrator access to your cloud accounts. Those are exactly the tools and accounts an attacker wants. In October 2026 the ConnectWise Cloud Backup breach showed how far one stolen credential can reach: a credential belonging to a backup service sold through MSPs was used to sign in to customers' Microsoft 365 tenants, with 162 tenants confirmed affected in one security company's customer base alone, and no customer password or two-step check was involved. The lesson for a small business is not to avoid MSPs, but to choose one that takes its own security seriously and to know what access it holds.

Service you might buy	Access the provider usually needs	Questions it raises
Help desk and laptop support	Remote control tool on every computer, local admin rights	Which remote tool, who can use it, is every session logged?
Microsoft 365 or Google Workspace management	Global or super administrator, or delegated partner access	Named accounts or shared login? Two-step verification on all of them?
Backups	Backup software, cloud backup app with permission to read all mail and files	Where is the backup stored, who can delete it, when was a restore last tested?
Network and Wi-Fi	Router and firewall admin passwords	Who holds the passwords, are they unique, is the admin page reachable from the internet?
Security monitoring	Agents on devices, access to sign-in logs	What happens at 3am, and who decides to lock an account?

Questions to ask before you sign

The NCSC publishes a due diligence checklist for small organisations choosing an MSP. The questions below follow it and add the access questions that matter most in practice. Ask for answers in writing.

Certifications: do you hold Cyber Essentials Plus, ISO/IEC 27001 or a SOC 2 report, and do they cover the team and systems that will support us? You can check a UK Cyber Essentials certificate on the IASME certificate search.
References: can we speak to two other customers of a similar size and type?
Your own access: which of your staff will be able to log in to our systems, and do they each have their own named account with two-step verification?
Remote tools: which remote access or remote management tool will you install, how is your own login to that tool protected, and can we see a list of every session?
Patching: will you install critical and high-risk security updates within 14 days of release, the timescale NCSC uses, for all our devices and software you manage?
Backups: how often do you back up, where are backups stored, are they kept separate from our live systems so ransomware cannot delete them, and how often do you test a restore?
Logs: do you keep security logs for our systems, for how long, and can we see them?
Incidents: what happens if we are attacked, and what happens if you are? How quickly will you tell us?
Response times: what are your service levels? NCSC suggests roughly one business day for general requests and under one hour for urgent issues as typical targets.
Your suppliers: which other companies do you rely on to deliver the service (remote tools, backup vendors, subcontractors), and how do you check them?
Ownership: will our domain, cloud tenant, licences and backups be registered in our name?
Leaving: what is your process if we end the contract?

Be wary of a provider that will not answer, or that answers only with "we use industry best practice". A good provider will be glad you asked.

How your provider's access should work

This is the part most small businesses never see, and the part that matters most. The FTC advises small businesses to limit vendor access to only what is needed and only for as long as it is needed, and to require strong passwords and multi-factor authentication. NCSC says MSPs should protect their own access to your systems with two-step verification and keep administrative accounts restricted.

Named accounts, not shared ones: each technician should have their own account. A single "admin@yourbusiness" login shared by the whole provider team makes it impossible to tell who did what or to remove one person.
Two-step verification everywhere: on every provider account in your systems and on the provider's own remote management platform. Ask for an authenticator app or security key rather than text messages for admin accounts.
Least privilege: the help desk does not need full administrator rights to reset a password. Ask the provider to use lower-privilege roles for everyday work and keep full administrator access for the few tasks that need it.
Microsoft 365 partner access: if your provider manages Microsoft 365 through a partner relationship, ask for granular delegated admin privileges (GDAP) with limited roles and an end date, not permanent global administrator rights. See the GDAP and MSP Delegated Admin Access Guide.
Apps and service accounts: backup tools, monitoring tools and scripts often connect to your cloud account as an "app" rather than a person, with wide permissions and passwords or certificates that never expire. Ask for a list of every app and service account the provider adds, what each can do, and how its credentials are protected.
Your own break-glass account: keep at least one administrator account for your cloud tenant that belongs to your business, with a strong password and two-step verification, stored securely, so you can always get in and remove the provider if you need to.
Remote tool control: only one approved remote access tool should be on your computers. Unknown remote tools are a common sign of a scam or a break-in. See the Recognising Tech Support Scams Guide.

What to put in the contract

NCSC lists the details to check in an MSP contract and the FTC recommends putting security requirements into vendor contracts, including how the vendor handles, shares, keeps and deletes your data. The table turns that into clauses a small business can ask for.

Contract area	What to ask for
Scope	A list of every service, device and account the provider looks after, and what is not included
Service levels	Response and fix times by priority, with what "response" means, and what happens if they are missed
Security basics	Patching within 14 days for critical and high-risk updates, two-step verification on all access, antivirus and backups as described
Access	Named accounts, least privilege, removal of a technician's access when they leave the provider, and your right to see the access list
Incident notification	How quickly they tell you about an incident affecting your systems or theirs, by severity, and who they tell
Reporting and review	A regular report (monthly or quarterly) on patching, backups and any incidents, and a yearly review meeting
Data and ownership	Your data, domain, tenant, licences and backups remain yours; where data is stored; deletion at contract end
Old systems	Who tracks when systems reach end of support and plans their replacement
Liability and insurance	Who is responsible if the provider's mistake causes a breach, and whether they hold professional indemnity and cyber insurance
Exit	Notice period, handover of passwords and documentation, removal of their tools and accounts, and help moving to a new provider

For ready-made clause wording, see the Third-Party Security Contract Clauses Template.

Choosing the right kind of provider

Very small (under 10 people): a local IT support company on a pay-as-you-go or small monthly plan may be enough, but still insist on two-step verification, tested backups and your own admin account. Free or low-cost help from official schemes can fill gaps; see the Free Cyber Security Services and Tools for Small Organisations Guide.
Growing businesses (10 to 250 people): a managed service with fixed monthly pricing, documented processes and a named account manager. Ask whether security monitoring is included or a separate service.
Regulated or high-risk work (law firms, accountants, healthcare, anyone holding card or client money details): look for Cyber Essentials Plus at minimum, ask about ISO/IEC 27001 or SOC 2, and consider a separate security monitoring service. NCSC points organisations with more than 250 staff to its cloud security guidance for a fuller assessment.
Cheapest is rarely cheapest: a provider that skips updates or backups to keep its price down transfers the cost to you on the day something goes wrong.

Checking your provider every year

Ask for the access list: every provider account, app and remote tool in your systems. Remove anything you do not recognise.
Check two-step verification: confirm every admin account, yours and theirs, has it switched on.
Test a restore: ask the provider to restore a file or mailbox from backup while you watch, and note how long it takes.
Review patching: ask for a report showing devices that are out of date or out of support.
Re-check certificates: confirm Cyber Essentials or other certifications are current.
Walk through an incident: agree who calls whom if your email is taken over or ransomware appears, and write the phone numbers down somewhere that does not depend on your email working.

Simple measures of a good provider: percentage of devices with updates installed within 14 days, date of the last successful restore test, number of provider accounts compared with the number of technicians who actually support you, time taken to answer urgent calls, and number of incidents reported to you each year (zero can mean nothing happened, or nothing was noticed).

Changing or leaving a provider safely

Leaving is when many small businesses lose control. Old providers keep access for months, new providers inherit unknown accounts, and passwords are passed around in email.

Before notice: make sure you can sign in to your own admin accounts for email, cloud, domain registrar and backups. If you cannot, fix that first.
Get the handover pack: a list of systems, accounts, licences, network diagrams, and where backups are kept. Passwords should be handed over through a password manager or in person, not email.
Bring in the new provider before cutting off the old one where possible, so there is no gap in backups or monitoring.
Remove the old provider's access on the day the contract ends: their named accounts, partner relationships, apps and service accounts in your cloud tenant, and their remote access tool from every computer.
Change shared passwords: router, firewall, Wi-Fi, any shared admin passwords and any service account passwords they knew.
Check afterwards: a week later, review sign-in logs for any activity from the old provider's accounts or tools. The FTC's advice after a vendor problem applies here too: consider cutting off access, check your network for misuse and confirm the problem is fixed.

A full checklist for removing outside access is in the Third-Party Access Policy Template.

Where this fits in security frameworks

If an insurer, customer or auditor asks how you manage your IT provider, these are the references they will recognise.

Framework	Reference	What it expects
NIST CSF 2.0	GV.SC-05, GV.SC-06, GV.SC-10	Security requirements in supplier contracts, due diligence before signing, and planning for the end of the relationship
CIS Controls v8.1	Control 15 Service Provider Management	A process to evaluate providers that hold sensitive data or run critical IT
Cyber Essentials	User access control, security update management	Admin accounts limited and protected, updates applied promptly, which apply to provider accounts too
NCSC supply chain principles	Understand the risks, establish control, check arrangements, continuous improvement	Know your suppliers, set expectations, check they are met, improve over time

Common failure patterns

Everything registered to the provider: the domain name or Microsoft 365 tenant is in the provider's name, so leaving means a dispute or losing email.
One shared admin login: the whole provider team uses the same account, with the password written in a ticket system or spreadsheet.
Backups nobody has tested: the backup job reports success, but a restore has never been tried, and backups sit on the same network ransomware can reach.
Old providers never removed: remote tools and accounts from a provider you left years ago are still installed and still working.
Trusting a call "from your IT company": scammers pretend to be the provider to get staff to install remote tools or read out codes. Agree a way to check a call is genuine.
Assuming the provider handles security: the contract covers support tickets, but no one is responsible for updates, logs or incident response.

If something goes wrong

If your provider tells you it has been breached, or you suspect misuse of its access, act quickly. Ask the provider what happened and what systems were affected, temporarily remove or disable its access to your systems if you are unsure, change admin passwords, and check sign-in logs for unusual activity. The FTC also advises reporting attacks to the police or the FBI and to industry regulators, and notifying affected people where required. In the UK, report through Action Fraud or Police Scotland, and consider whether you must tell the ICO about a personal data breach. A step-by-step response for this situation is in the Compromised MSP Playbook.

Practitioner checklist

Ask the NCSC due diligence questions in writing and keep the answers.
Check the provider's Cyber Essentials (ideally Plus) certificate on the IASME search, and ask what ISO/IEC 27001 or SOC 2 covers.
Make sure your domain, cloud tenant, licences and backups are registered to your business.
Keep your own break-glass admin account with two-step verification.
Require named provider accounts, two-step verification on all of them, and least privilege.
Get a list of every app, service account and remote tool the provider installs, and review it yearly.
Write patching (14 days for critical updates), backups, logs, incident notice and exit into the contract.
Watch a backup restore at least once a year.
When you leave, remove every account, app and tool on the last day and change shared passwords.

Choosing an IT Support Provider or MSP Securely: What Small Businesses Should Ask and Check