Is Your Cloud Vendor Putting Your MSP Practice At Risk?

It's important to mention here that there are quite a few cloud vendors using third party infrastructure. This is an accepted practice as long as it is done in the proper manner. What is not acceptable is using the third party infrastructure provider's certifications and audits as if they belonged to the ISV. This is a common practice in our profession and needs to come to a quick and definitive end.

ISV's need to be verified themselves, along with any third party IaaS providers. All MSPs should check with their cloud vendors to see if they comply with this practice.

Who Is Liable?

It is also an unfortunate and common practice for ISVs and cloud vendors to limit most or all liability with their partners. While a MSP may limit its own liability by getting cyber liability insurance (which will cover the data loss or breaches due to the negligence of the MSP), breaches and losses of data caused by the third party ISV (or the ISV's cloud vendor) are typically another matter and would not be covered by the MSP's insurance.

If MSPs sign agreements with their cloud vendors accepting the ISV's complete rejection of any liability due to the fault of the ISV or its cloud vendors, this type of relationship can lead to dangerous consequences. Shared liability between the MSP and its third party ISV and cloud partners is necessary for protecting the end-user customer.

Summary

MSPs have long understood the need for protecting their customers from data loss and cyber attacks. Living in the IT services world has taught most MSPs how to operate safely. ISVs are relatively new to the IT services world and need to play catch up fast.

If ISVs are unwilling to offset MSP and customer liability, it is entirely possible MSPs will start to retake control of the cloud and begin to offer cloud computing solutions themselves and reject cloud based SaaS offerings.

Let's hope it doesn't get to that point.