MSP Cybersecurity: The Baseline A Small MSP Sells And Runs

MSP cybersecurity is the security work a managed service provider runs for its clients and for its own business. For a small MSP, that means a written baseline (MFA, patching, tested backups, endpoint and email protection, training, incident response), sold per user, with 24/7 monitoring handed to a specialist.

This guide comes from the team behind SherpaDesk, a helpdesk and professional services automation (PSA) tool a small IT team can run alone.

What Is MSP Cybersecurity?

It has two sides: the security service you run for clients, and the security of your own business.

Your access to every client makes a cybersecurity MSP a target. CISA's performance goals warn that "adversaries can exploit vulnerabilities by abusing trusted third-party relationships."

Why Security Matters Now For Small MSPs

Verizon's 2026 Data Breach Investigations Report analyzed more than 22,000 breaches across 145 countries.

• Software vulnerabilities are now the main way in. They started 31% of breaches, more than stolen passwords. The median critical vulnerability took 43 days to fix fully.
• Partners are part of the attack. Breaches with third-party involvement rose 60% in a year and now make up 48% of all breaches.

CISA's Cybersecurity Performance Goals 2.0 add a goal on MSP risk. It asks clients to "proactively address any security gaps that fall outside the scope of the contract."

The Security Baseline To Sell Every Client

Start with these ten controls drawn from CISA's CPG 2.0 goals. Adapt them to the client's risks.

Triage urgent alerts, such as malware detections or a failed backup, within the response window agreed with the client; NIST says to estimate each incident's severity and urgency. The weekly review covers unresolved work only.

Give each patch a due date from exploitation risk, exposure, and how important the system is. CISA says to use its Known Exploited Vulnerabilities catalog to prioritize, and internet-facing systems go first. Review overdue patches every week. When something can't be fixed, record the exception, the compensating control, and a review date. The work closes when the next scan or report shows it fixed.

Roll out MFA in order: enroll a client admin, test the recovery access, then move users over. Log apps that can't do MFA as dated exceptions.

Before DMARC goes to "reject," list every service that sends mail as the client's domain; the UK's NCSC tightens policy once SPF and DKIM cover them. DMARC doesn't replace filtering for malicious links and attachments.

Backups And A Disaster Recovery Plan That Works

A disaster recovery plan is the written procedure for restoring a client's critical systems after an outage or attack. CISA's backup goal asks for copies stored "offsite and offline," recovery tested "no less than once per year," and integrity checked before any restore. Set test frequency from the client's recovery targets.

The recovery time objective (RTO) is how long a system can stay down "before negatively impacting the organization's mission." The recovery point objective (RPO) is how much data the client can afford to lose, and it sets how often you back up.

1. List systems by priority

   Rank what the client can't work without, and agree an RTO and RPO for each. Back up license keys and configurations too.

2. Name who declares a disaster

   Write down who starts the plan, who calls whom, and a backup channel if email is down.

3. Write one short run sheet per scenario

   Each sheet names a lead, the restore order, and vendor contacts.

4. Keep a copy you can reach offline

   Name where it is: a printed copy at the client's office and one with your on-call tech. CISA's recovery goal plans for losing internet access.

5. Test, record, then fix what failed

   Record the recovery time and the age of the recovered data, whether each met the RTO and RPO, and whether the app works. Then book the next test. After a test or an incident, run a post-incident review.

   Common mistake: counting "the backup job succeeded" as a restore test.

Penetration Testing, Scans And Ethical Hackers

CISA asks organizations to "regularly engage third-party cybersecurity experts" for tests such as penetration tests and tabletop exercises, then fix what they find. NIST describes a penetration test as testing in which "evaluators mimic real-world attacks" to find ways around a system's security.

Scans and penetration tests both need written permission and an agreed scope. Ethical hackers also need a way to reach you. CISA asks for a public way to report vulnerabilities and names a security.txt file (RFC 9116) as a common method. Name who reads the reports and who follows up. Publishing it doesn't grant permission to test.

Secure Your Own Helpdesk And Tools

Your helpdesk is a security risk because your techs reset passwords for client users. A CISA and FBI advisory describes attackers who "posed as employees to convince IT and/or helpdesk staff" to reset passwords and move MFA to a device the attacker controls. Our Ticket Trick post shows another inbox risk.

Write a routine and check it:

• Verify before any reset. Call back on the number already on file, never one the caller gives you.
• Use phishing-resistant MFA for techs. The advisory recommends FIDO/WebAuthn or PKI-based MFA, starting with your RMM and admin portals.
• Keep passwords out of tickets. Store and share credentials through a password manager. Collect only the sensitive details a fix needs, ask users to redact the rest, and limit who can open attachments you keep.
• Drill it. Once a quarter, stage a spoofed reset request; the tech shows the verification step and the escalation.
• Review your own techs' access every quarter. CISA suggests quarterly reviews of permissions. Remove client access a tech no longer needs, and revoke everything the day someone leaves, contractors included.

Security For School IT Teams

In a 2026 Center for Internet Security survey of 426 K-12 cybersecurity and tech leaders, 51% of schools and districts reported a cyber incident in the past year. For a cybersecurity MSP that serves districts, the baseline applies, with three school decisions:

• Train students as well as staff. CISA asks for yearly training for everyone who uses the organization's systems, and training before access for new employees. In a district, count students in.
• Plan account changes at term boundaries. Disable accounts when students graduate or staff leave, and accounts left unused for a set period.
• Rank recovery around teaching. Decide which comes back first, the student information system or the learning platform, and how classes run on paper meanwhile.

Public districts may qualify for CISA's no-cost scanning, open to state and local governments and critical infrastructure organizations.

How To Package And Price Security

Put the baseline in every managed services agreement. Sell additional services as named add-ons.

Total each client's recurring delivery costs and divide by billed users: licenses and vendor minimums, servers and devices, reporting, false positives, incident coordination, integration fixes. Price one-time deployment as a separate project.

CISA says contracts "should detail how and when MSPs notify the customer of an incident." Our managed services agreement guide shows where that clause goes.

Compliance for regulated clients

Some duties are already yours. If you handle a healthcare client's electronic patient data as a business associate, the HIPAA Security Rule applies to you as well. Readiness work for SOC 2 or CMMC is an optional service you can sell or refer. Either way, identify the obligations with the client's compliance specialist. Assign each control to you or the client in the agreement, keep the evidence, and review it at least yearly.

When To Bring In An MSSP

A cybersecurity MSP doesn't need its own security operations center (SOC). Bring in a managed security service provider (MSSP) or a managed detection and response (MDR) provider when a client needs alerts watched around the clock. Our MSP vs MSSP guide compares them.

Before you sign, settle four questions in writing: who investigates an alert, who can isolate a device, who calls the client, and who responds after hours.

Then put the commitments in the contract: acknowledgment and containment targets, an escalation contact, reporting frequency, and which of monitoring, investigation, containment, recovery, and forensics are included. Buy penetration testing separately unless the contract names it.

Track And Bill Security Work In SherpaDesk

About the author

Patrick Clements Co-founder & CEO, SherpaDesk

Patrick co-founded SherpaDesk and has led it as CEO since 2013. He has worked with IT service providers since 1998, first on network projects for schools and government offices, then on the helpdesk software their technicians use every day.

All Articles