Home » cybersecurity » 2026 IT Manager Checklist: Six MSP Proofs That Secure Data

2026 IT Manager Checklist: Six MSP Proofs That Secure Data

MSPs improve data safety through layered technical controls covering identity, endpoints, and email, paired with 24/7 detection and response, and backed by tested immutable backups with clear contractual RTO and RPO obligations. Frameworks from NIST and CISA shape what a credible provider should deliver, while identity tools like LogMeOnce show how specific controls fit into that structure. The sections below break down each layer and the proof you should demand before signing a contract.

TL;DR:

MSP security proposals should include enforced multi-factor authentication and comprehensive endpoint detection coverage with verifiable reports.

Contracts must specify measurable RTO, RPO, backup immutability, log retention periods, and incident notification windows to ensure accountability.

Regularly scheduled restore tests, including full-system recovery, are essential to confirm backup reliability and compliance with the 3-2-1-immutability rule.

Staffed detection and response, with actual incident metrics like mean time to detect and contain, are critical to prevent full breaches.

MSP credential control tools like password managers, passwordless MFA, and encrypted storage significantly reduce privileged access risks.

Logmeonce

Strengthen Your Identity Security

Explore LogMeOnce resources for password management, passwordless MFA, cloud encryption, and dark web monitoring guidance.

Explore security resources

Table of Contents

Managed IT versus managed security: what MSPs actually do

Managed IT and managed security sound interchangeable but describe different jobs. Managed IT covers the plumbing: patching, remote monitoring and management (RMM), help desk support, and routine backups. Managed security adds a defensive layer on top: endpoint detection and response (EDR), email filtering, and often managed detection and response (MDR) that watches for active threats.

A typical MSP contract bundles RMM, patch management, backup scheduling, and basic endpoint protection as standard. Anything beyond that, such as 24/7 monitoring with human analysts reviewing alerts, usually costs more and should be spelled out separately. Some providers sell EDR as a checkbox item without the staffing to act on what it flags, which leaves a gap between having a tool and having protection.

Outsourcing IT operations never transfers legal or regulatory accountability. A business that hires an MSP still owns the outcome if a breach happens, which means leaders need to verify what their contract actually promises rather than assume broad coverage exists. Knowing the difference between managed IT and managed security is the first step toward asking the right questions in a proposal.

A six-layer checklist for auditing MSP security proposals

Before signing anything, map the proposal against six control layers. Each one has a minimum bar and a piece of evidence you should request to confirm it is real, not aspirational.

Identity: MFA enforced on every account, with a conditional access policy screenshot or admin console export as proof.
Endpoints: EDR deployed fleet-wide, with a device coverage report showing enrollment percentage.
Email: Advanced filtering and phishing simulation results, with a sample report from the last quarter.
Network: Segmentation between client environments and internal MSP systems, documented in a network diagram.
Detection and response: MDR or SOC coverage hours, with an escalation runbook and sample incident timeline.
Recovery: Immutable backups with a recent restore test report, not just a backup success log.

Patching, EDR, and basic backups are table stakes at this point. Staffed detection and response, whether branded MDR, SOC, or SIEM monitoring, tends to be the premium tier that separates providers, a distinction covered in independent MSP cybersecurity guidance. That layer is also the one most likely to determine whether an intrusion becomes a contained incident or a full breach.

Pro Tip: Turn every capability into a number: instead of accepting “we monitor 24/7,” ask for the mean time to detect and mean time to contain from the last two incidents they handled.

Contracts and SLAs: obligations to write into your MSP agreement

A proposal full of good intentions means nothing if the signed contract does not lock in specifics. During an actual incident, the contract is the only thing that determines what the MSP is obligated to do and how fast.

Recovery Time Objective (RTO): how long systems can be down; critical systems often warrant a target measured in hours, less critical ones in a day or more, though the right number depends on the workload.
Recovery Point Objective (RPO): how much data loss is acceptable, expressed as a time window since the last good backup.
Backup immutability: a stated requirement that backup copies cannot be altered or deleted, including by compromised admin credentials.
Log retention: a minimum retention period for security logs, since short retention windows can erase forensic evidence before an investigation starts.
Notification windows: a defined number of hours within which the MSP must disclose a suspected incident.

For cloud and SaaS workloads, the contract should explicitly state who owns backup and recovery under the shared responsibility model. Cloud vendors typically secure the infrastructure, not the customer’s data inside it, which is a distinction CISA’s guidance points to when recommending that businesses limit and audit third-party MSP access rather than assume broad protections exist by default.

Backups and recoverability: what modern practice actually requires

Backup strategy is where good intentions collide with reality fastest. The NIST guidance on ransomware and data loss recommends the 3-2-1 rule: three total copies of data, on two different media types, with at least one copy off-site. Modern practice adds a fourth requirement, immutability, meaning at least one copy cannot be modified or deleted even by someone holding valid admin credentials. That single feature is what stops ransomware from encrypting or wiping the backup along with the original data.

Backups that are never tested are a liability disguised as a safety net. NIST’s guidance treats periodic restore testing as mandatory evidence, not an optional nicety, because automated “backup successful” logs do not confirm that a restore will actually work.

Schedule full-system restore tests on a defined cadence, not just file-level spot checks.
Request a written restore report after each test, including time to recovery.
Confirm runbook documentation exists so recovery does not depend on one person’s memory.

More than half of enterprise workloads now run in the cloud, and a large share of businesses rely solely on the cloud vendor’s native retention instead of an independent backup, according to industry analysis of MSP SaaS backup adoption. Native retention was built for accidental deletion, not for tenant-wide compromise, which is why a credible MSP should offer third-party SaaS backup for platforms like email and collaboration suites rather than pointing to the vendor’s own recycle bin as sufficient protection.

Detection and response: turning alerts into contained incidents

Endpoint detection and response tools generate alerts. Managed detection and response is what actually reads those alerts, decides which ones matter, and acts before damage spreads. A business running EDR without a monitoring team behind it is paying for a smoke detector with no one home to hear it.

Acronis’s guidance on ransomware response points to behavioral endpoint detection combined with tested incident response plans as the combination that actually limits damage, since speed of containment determines how far an infection spreads before it is stopped. A SIEM platform with adequate log retention supports that work by giving analysts a forensic trail to reconstruct what happened.

When evaluating an MSP’s detection layer, ask for:

Coverage hours: whether monitoring is truly 24/7 or business hours with on-call escalation.
Mean time to detect and mean time to contain: actual figures from recent incidents, not marketing language.
Escalation flow: who gets notified, in what order, and how fast.
Tabletop exercise history: evidence the response plan has been rehearsed, not just written.

Staffing and rehearsed playbooks matter more than the specific tool brand. A well-staffed team running a modest toolset consistently outperforms an unmonitored stack of premium software.

MSPs need broad access to do their job, which makes their own credentials a target. CISA’s StopRansomware guidance specifically flags MSPs as high-value targets and recommends least-privilege access, separation of duties, and limits on third-party account scope to reduce the blast radius if a provider’s credentials are compromised.

Practical controls worth requiring:

Unique admin accounts per client, never shared credentials reused across the MSP’s whole customer base.
Break-glass procedures for emergency access, logged and reviewed after use.
Temporary privilege elevation instead of standing admin rights, with a time-bound expiration.

A centralized MSP password manager paired with passwordless MFA reduces the odds that a single stolen credential becomes a foothold across every client environment the provider manages.

Pro Tip: Ask for a privilege audit report and MFA enforcement log covering your account specifically, not a generic company-wide security summary.

Cloud and SaaS protections: data you cannot see is data you cannot secure

Cloud misconfigurations often start with a simple problem: nobody knows where the sensitive data actually lives. Continuous discovery and classification, an approach Google Cloud’s data protection guidance recommends, builds that missing inventory so access controls and monitoring can target the right systems.

Run ongoing discovery and classification so sensitive data is inventoried, not assumed.
Encrypt data at rest and in transit, using key management service (KMS) controls rather than default settings.
Restrict public exposure of storage buckets and shared drives, a control AWS’s data protection guidance treats as a baseline, since AWS also warns that deleted KMS keys cannot be recovered.
Require third-party SaaS backup rather than relying on built-in vendor retention, which was not designed for tenant-level compromise.

Where identity and encryption tools fit the checklist

Vendor tools are one piece of the layered picture described above, and it helps to see where specific capabilities map to the checklist. LogMeOnce’s MSP client password manager addresses the identity and privileged access layer by centralizing credential control across client accounts. Passwordless MFA strengthens the authentication layer beyond a shared password, and encrypted cloud storage supports the data-at-rest protection layer discussed in the AWS guidance above.

MSP client password manager: centralizes and audits privileged access across client environments.
Passwordless MFA: removes reliance on a single reusable credential.
Encrypted cloud storage: protects data at rest without depending on default vendor settings.

Any vendor claim, including these, is worth confirming through a trial, product documentation, or a third-party review before it factors into a purchasing decision.

Where to focus first if you manage IT this quarter

If you take one thing from this checklist, make it this: detection and response is the layer that decides outcomes, not the layer most contracts spell out clearly. Start immediate: confirm MFA is enforced everywhere, verify EDR is actually paired with a staffed MDR service, and schedule a full restore test this month rather than trusting last year’s backup log.

Near-term, get RTO, RPO, and backup immutability written into the contract in plain numbers. Strategically, budget for detection and response as a permanent line item, not a future upgrade.

— Mike

A practical next step for identity and storage security

If your MSP checklist is exposing gaps in privileged access or encrypted storage, LogMeOnce’s MSP client password manager centralizes credential control across client accounts, and its passwordless MFA and cloud storage encryption close two of the layers covered above.

Compare plans and see how the Teams, Business, and Enterprise tiers map to the identity controls your MSP checklist demands, and verify the fit with a trial before committing.

Sources

FAQ

What are 5 ways to secure data?

Enforce multi-factor authentication on all accounts, encrypt data at rest and in transit, maintain immutable backups following the 3-2-1 rule, apply least-privilege access controls, and run continuous detection and response rather than relying on tools alone. Patching and network segmentation round out a baseline defense.

What is MSP in cyber security?

An MSP, or managed service provider, is a third-party company that handles IT operations and, often as a separate service, security monitoring like endpoint detection, email filtering, and incident response. Not every MSP includes staffed security monitoring by default, so the scope should be confirmed in the contract.

What are the risks of using an MSP?

MSPs hold broad access across client systems, which makes their credentials a high-value target if not tightly controlled, a risk CISA’s guidance specifically calls out. Businesses also remain accountable for outcomes even after outsourcing, so contract gaps in backup testing or log retention can leave them exposed during an incident.

Can you give me an example of an MSP?

An MSP typically bundles remote monitoring, patch management, backup scheduling, and help desk support, sometimes paired with security services like endpoint detection or email filtering. LogMeOnce’s MSP client password manager is an example of a tool built specifically for providers managing credentials across multiple client accounts.