How to Choose a Managed Security Provider for a Small Business

To choose a managed security provider for a small business, pick one that will put its security duties in the contract. A joint advisory from CISA, NSA, FBI and the cybersecurity agencies of the UK, Australia, Canada and New Zealand tells MSP customers to make sure their contract requires multifactor authentication on every provider account, monitoring and logging with notice of security incidents, backups that meet your recovery needs, tested incident response plans, and a clear split of who owns which security job (CISA, NSA, FBI and partners: Protecting Against Cyber Threats to Managed Service Providers and their Customers). Compare two or three providers on those terms, then check references.

What is a managed service provider?

The advisory defines MSPs as entities that deliver, operate, or manage information and communications technology services for their customers through a contract, such as a service level agreement, and says offerings may include infrastructure, support functions and cybersecurity services (CISA advisory AA22-131A). Many small and mid-sized businesses use them to run their systems without hiring internal staff for it (CISA advisory AA22-131A).

Why does the choice of provider matter for security?

Because a provider usually has trusted connections and privileged access to your systems. The agencies warn that attackers can use a vulnerable MSP as a way into many customer networks at once, and that a compromised MSP can lead to ransomware against its customers (CISA advisory AA22-131A).

What should a managed security contract require?

The agencies tell customers to make sure the contract requires the provider to (CISA advisory AA22-131A):

• Use multifactor authentication on the services you receive and on every provider account that reaches your environment.
• Monitor and log the systems it manages, show you that activity, and notify you of confirmed or suspected security incidents.
• Never reuse administrator credentials across customers.
• Deliver software updates as an ongoing service.
• Run backups that meet your recovery needs, stored somewhere you can get them back.
• Keep incident response and recovery plans that are tested at regular intervals.
• State whether you or the provider owns hardening, detection and incident response.

What questions should I ask a managed security provider before I sign?

Ask each provider to answer in writing: who on their team will have access to our systems and how is that access protected? How long do you keep our logs, and how will you tell us about an incident? Where do our backups live, and when did you last test a restore? Which security tasks are yours and which are ours? What subcontractors or other vendors touch our data? The agencies recommend storing the most important logs for at least six months, because it can be months before an incident is detected (CISA advisory AA22-131A). Our provider questions checklist puts these side by side for two providers.

What should I do when a provider contract ends?

Disable the provider's accounts in your systems. The advisory notes that disabling MSP accounts can be overlooked when a contract terminates (CISA advisory AA22-131A).

Where can I find a managed security provider near me?

Start with the provider directory and the city pages, for example Washington, DC, Ashburn, VA and Arlington, VA. Read how to choose a cybersecurity provider for the wider checklist. If budget is the blocker, see whether an in-kind grant can cover the work, delivered at no cost to you by an approved provider.