Advanced lesson
Run Security as a Service, Not a Stack of Tools
Build an MSP routine that assigns owners, protects customer access and turns alerts, updates and backups into verified work.
Reviewed September 2026 · 3 minute read
Agree on the responsibility before the incident
| Work | Business owner | MSP / security provider |
|---|---|---|
| Account and door access changes | Approves who needs access and the effective time. | Implements and verifies removal across the agreed systems. |
| Patch and device risk | Approves outage windows and documented risk exceptions. | Inventories, prioritizes, stages, deploys and verifies updates. |
| Alert response | Names decision makers and acceptable interruption. | Defines monitoring hours, triage, escalation and evidence handling. |
| Backup and recovery | Sets required recovery outcomes and retention. | Operates protected copies and demonstrates an agreed restore. |
Define coverage hours, escalation contacts, included systems, evidence retention and unresolved-risk ownership. An MSP label does not mean 24/7 security monitoring or incident-response coverage.
Your remote tools are part of the security boundary
RMM means remote monitoring and management. Protect those tools with named privileged identities, strong MFA, limited roles and recorded activity. Scope technicians and automation to the correct customer; test that a technician assigned to one tenant cannot operate another.
Review installed agents, integrations, service accounts and vendor access. Revoke unneeded access and keep emergency procedures documented. A shared universal administrator secret creates a common failure point across customers.
Track outcomes you can explain
| Review item | Useful evidence |
|---|---|
| Device coverage | Known in-scope devices compared with reporting/managed devices, including missing or stale agents. |
| Patch exceptions | Actual versions, exposure, owner, due date, mitigating control and verification after update. |
| Detection and response | A safe approved test alert reaches the right person; acknowledge and close it with evidence. |
| Recovery | Restore an agreed file or service in a controlled location and demonstrate required access and integrity. |
| Access drift | Review privileged memberships, vendor grants and expired exceptions. |
Choose review frequency and remediation targets from risk and the customer agreement. Protect recovery copies from the same account or compromise that could destroy production. A green backup job alone does not prove the service can be restored.
Find the hidden gap
A dashboard says every reporting laptop is patched. The asset list includes three laptops that have not reported for a month. Write the follow-up task and its owner.
Compare your answer
Reconcile the inventory with actual reporting coverage. Locate or retire the missing devices through the approved process; assess their exposure before reconnecting them. Report both patch status and coverage gaps.
Put it into practice
Check what you learned
Choose an answer for each question, then check your understanding. Your answers stay in this browser.
Read the answers and explanations
- Find the four missing devices and explain or fix their reporting status.
A percentage based only on reporting devices can hide gaps. Reconcile the four before claiming complete coverage.
- A timed restore shows the required service and data work within the target.
The target describes recovery of the business service. Job success and spare capacity are useful but do not prove recovery time.
- The explicitly agreed escalation owner, following the documented coverage arrangement.
A service agreement must name the coverage and escalation responsibilities; a tool alert does not create an on-call service.
Sources and further reading
- CISA and partner agencies: protecting MSPs and their customers
The joint advisory explains risks created by provider access and shared responsibilities. Read it when designing the provider/customer security agreement.
- NIST SP 800-40 Rev. 4: patch management planning
Connects patch priorities, maintenance planning and verification. Use it to develop a risk-based operating process.
- CIS Control 11: data recovery
Focuses on restoring a trusted working state. Use this alongside an actual restore exercise, not just a successful backup-job message.
Keep your momentum
Ready for the next step?
If you can explain the example and your answer, try the next lesson. Revisit the feedback whenever you need it.
FryAVSI · Updated September 10, 2026
Reference this lesson or use a section’s direct link for a particular chart or example. How to cite an example.
FryAVSI · Northeast Ohio and beyond
Turn the learning into a working result.
Share the site, the requirement and the next step with our team.