Written by: Charles Weaver, CEO of MSPAlliance
Many MSPs are heading into the summer months with internal projects to prepare for an increase in workload once the quarantine lifts. Some MSPs will be addressing internal controls, policies, and procedures, as they strive to achieve higher levels of security and scalability.
One of the excuses I hear from MSPs for why they do not begin working on internal controls is they do not know where to begin. There are many frameworks, standards, and laws that may influence the direction of your MSP practice. An obvious example would be following your regulated clients and adopting their control frameworks to be more appealing to them.
There are, however, some easy steps every MSP should be adopting, no matter what type of client they serve. These fundamental controls live within the Unified Certification Standard (the standard that is the foundation for the MSP Verify program). Here are a few examples of controls (and control families) all MSPs should be following.
User Access
These controls focus on internal users (your MSP employees and contractors) and the access they have to MSP and client data, systems, and networks. Specific attention should be placed on how the user is granted access and any safeguards around the process of giving users access.
Similarly, all MSPs should have an exit procedure dealing with how users are removed from systems and networks.
External Service Providers
Also known as vendor management, understanding the who, how, and when of third party entities access your MSP systems and networks is important. All MSPs should have an exact knowledge of all external providers who have temporary or permanent access to the MSP, especially when it comes to data access.
Developing a simple vendor access list can help in securing your MSP practice. During the MSP Verify process, for example, we have an application listing form everyone must complete. This form tracks all the vendors used in the delivery of your managed services, including where they are located, whether it is cloud or on-premise, methods of access, and the level of reliance the MSP has on that particular technology or vendor company.
Data Access - what you do and don't manage
Frequently in MSP Verify projects, we spend as much time on data, systems, and networks the MSP does NOT monitor or manage as we do those objects they do manage. Many clients today are more concerned about knowing where the limits are with their MSP, especially as the data becomes more sensitive, valuable, and regulated.
