Skip to content 
Table of Contents
Handing your IT environment to a managed service provider (MSP) is one of the best ways to reduce operational risk. It’s also, quietly, a new risk in its own right. The same provider that patches your systems, watches your network overnight and manages your backups also holds administrator access to almost everything you own.
That’s the paradox at the heart of managed IT services risk. Choose well, and a provider closes gaps your internal team could never cover alone. Choose poorly, or manage the relationship loosely, and you inherit the provider’s weaknesses on top of your own.
In July 2021, a single compromised remote management platform at Kaseya affected fewer than 60 of its direct customers. But many of those customers were MSPs themselves, and Kaseya estimated the attack reached fewer than 1,500 businesses further down the chain (The Record).
This guide to Managed IT Services Risk explains, how to measure the risk, and what regulators and security agencies expect. It also shows how to build a provider relationship that lowers your overall risk instead of moving it somewhere you can’t see. It’s written for IT leaders, CFOs and risk owners across North America.
Why MSP Risk Matters More Than Ever
Third parties are now one of the most common routes into a business:
- Third-party involvement in breaches doubled from 15% to 30% in Verizon’s 2025 Data Breach Investigations Report (Verizon).
- Supply chain compromise ranked as the second most common way attackers got in in IBM’s 2026 Cost of a Data Breach research. It was also among the biggest contributors to higher breach costs (eSecurity Planet).
- Six national cyber agencies from the US, Canada, the UK and Australia issued a joint advisory in May 2022 on protecting MSPs and their customers from cyber threats (Canadian Centre for Cyber Security).
The Kaseya incident shows why attackers find MSPs attractive. One breach of a shared platform multiplied across every customer connected to it:
About 1,500 downstream businesses ÷ about 60 direct customers = roughly 25 businesses affected for every direct customer compromised
Both figures are Kaseya’s upper estimates, so the ratio is approximate, but the pattern is clear.
That multiplier is the core of MSP risk. The question isn’t whether to use a provider. It’s how to choose and manage one so the multiplier works for you, not against you.
The 8 Categories of Managed IT Services Risk
| Risk category | What can go wrong | What reduces it |
| Privileged access | Provider accounts with broad admin rights are compromised or misused | MFA on all provider accounts, access limited to what’s needed and when, access logging |
| Tooling and supply chain | Remote management or monitoring tools are exploited to reach many customers at once | Hardened, patched provider tools, separated access, vendor security reviews |
| Provider security posture | The provider’s own controls are weaker than yours | Independent certifications such as ISO 27001 and SOC 2 Type II |
| Data handling and residency | Data is stored, copied or processed in places you didn’t approve | Agreed data locations in the contract, encryption, documented data flows |
| Service continuity | The provider has an outage, a staffing gap or a financial failure | Defined SLAs, a documented environment, a tested exit plan |
| Lock-in and concentration | Knowledge, credentials and documentation sit only with the provider | Complete documentation you own, flexible terms, a credential inventory |
| Compliance accountability | Regulators hold you responsible for failures in outsourced work | Contract terms aligned to your regulatory obligations, audit rights |
| Contract gaps | Responsibilities, notification timelines and exit terms are unclear | A clear responsibility matrix, incident notification clauses, termination assistance |
1. Privileged access
An MSP needs administrative access to do its job, and that access is also the most valuable thing an attacker can steal. The May 2022 joint advisory recommended that customers contractually require MSPs to use multi-factor authentication (MFA) on all services, products and MSP accounts that can access customer environments. It also recommended granting privileges only when and where they’re truly necessary (ACA Group summary).
2. Tooling and supply chain
Remote monitoring and management tools are what make managed IT efficient. They’re also what made the Kaseya attack so damaging. Ask your provider:
- Which tools does it use?
- How quickly does it patch them?
- How is its access to your environment kept separate from its access to other customers?
3. Provider security posture
Your provider’s security becomes part of yours. Organizational certifications such as ISO 27001 and SOC 2 Type II mean an independent auditor has reviewed how the provider manages security. That’s far stronger evidence than a list of tools or marketing claims.
4. Data handling and residency
Know where your data, backups and logs are stored. The Canadian Centre for Cyber Security recommends keeping medium and high sensitivity data within Canada when using managed services (Cyber Centre ITSM.50.030). New York’s Department of Financial Services has made a similar suggestion: regulated entities should limit or identify where third-party providers store data, especially across borders.
5. Service continuity
Providers can have outages, lose key staff or go out of business. If your environment is undocumented and your credentials live only in the provider’s systems, any of these becomes your outage too.
6. Lock-in and concentration
Lock-in isn’t only a contract issue. It’s a knowledge issue. If the provider is the only one who knows how your environment works, switching becomes slow, risky and expensive, whatever the contract says.
7. Compliance accountability
Outsourcing the work doesn’t outsource the responsibility. The 2023 interagency guidance from US banking regulators states plainly that using third parties doesn’t reduce a bank’s responsibility to operate safely and in compliance with the law (Morrison Foerster). The same principle applies across healthcare, finance and other regulated sectors.
8. Contract gaps
Many risks start in the contract. Vague language about who’s responsible for what, how fast incidents must be reported and what happens at termination leaves both sides exposed when something goes wrong.
How to Measure Your MSP Risk
A simple risk register turns these categories into priorities. Score each risk from 1 to 5 for likelihood and for impact, then multiply the two:
Risk score = likelihood × impact (maximum 25)
Here’s an illustrative example for a mid-sized company assessing its current provider:
| Risk | Likelihood (1 to 5) | Impact (1 to 5) | Score | Priority |
| Provider admin accounts without MFA | 4 | 5 | 20 | Critical |
| Environment undocumented outside the provider | 4 | 4 | 16 | High |
| No contractual incident notification timeline | 3 | 5 | 15 | High |
| Provider holds no independent security certification | 3 | 4 | 12 | Medium |
| Backups never test-restored | 3 | 4 | 12 | Medium |
| Data storage locations not documented | 2 | 4 | 8 | Low |
In this example, the total exposure is:
20 + 16 + 15 + 12 + 12 + 8 = 83 points out of a possible 150
Fixing just the top three items would remove 51 points, about 61% of the total risk score. Those three fixes are enforcing MFA, documenting the environment and adding a notification clause. That’s the value of a risk register: it shows where a small number of changes deliver most of the reduction.
What Regulators and Security Agencies Expect
Expectations across North America are converging on the same principles:
- Joint MSP advisory (US, Canada, UK, Australia, 2022):
- Enforce MFA and apply least privilege.
- Store important logs for at least six months.
- Back up and test regularly, and test incident response plans.
- Disable provider accounts when the relationship ends.
- US banking agencies (2023): manage third parties across their full lifecycle, from planning and due diligence to contracting, ongoing monitoring and termination.
- NYDFS Part 500 (final provisions effective November 1, 2025): MFA is generally required for anyone accessing information systems, along with a documented asset inventory (Greenberg Traurig).
- Canadian Centre for Cyber Security: keep sensitive data in Canada, define SLAs, control privileged access, and plan for data portability and exit.
Due Diligence: Evidence to Request Before You Sign
| Area | Evidence to request |
| Security posture | ISO 27001 certificate and SOC 2 Type II report |
| Access controls | How provider accounts use MFA, least privilege and access logging |
| Tooling | Which remote management tools are used, and how they’re patched and kept separate between customers |
| Data handling | Where your data, backups and logs will be stored |
| Incident response | Notification timelines, escalation contacts and a sample post-incident review |
| Documentation | What documentation you’ll receive at onboarding and how often it’s updated |
| Reporting | A sample monthly performance report |
| Exit | Termination assistance, credential handover and data return commitments |
Contract Clauses That Reduce Risk
Ask for these in writing:
- MFA and least-privilege requirements for every provider account that can access your environment
- Incident notification timelines short enough for you to meet your own regulatory reporting deadlines
- Audit rights, including access to independent assurance reports
- Data location and handling terms, including encryption and approved storage locations
- Documentation ownership, with all documentation, configurations and credentials belonging to you
- Subcontractor transparency, with notice of changes and the right to object
- Termination assistance, including removing provider accounts, handing over credentials and returning data in a usable format
Ongoing Risk Management After Go-Live
Risk management doesn’t end at signing. Build these habits into the relationship:
- Monthly: review performance reports, open incidents and patch compliance.
- Quarterly: review access lists, documentation updates and the risk register.
- Annually: re-request assurance reports, test backups and incident response, and rehearse the exit plan.
How Zazz Reduces Provider Risk
Zazz is a managed IT and cybersecurity partner for organizations with 20 to 500 employees, supporting 100+ businesses across North America (Zazz Managed IT Services). Its model addresses the risk categories above directly:
- Independently audited security: an ISO 27001 and SOC 2 Type II certified team, so an independent auditor has reviewed its own controls.
- Documented from day one: onboarding includes an environment audit, a credential and asset inventory, backup and patch validation, and a security risk assessment. Documentation is provided at onboarding and updated quarterly.
- Access and identity controls: data protection and access policies on every plan, with identity and access management administration on Professional and above.
- Visibility every month: monthly reports on tickets, resolution times, asset health, patching, uptime and SLA compliance, plus quarterly strategic reviews.
- One accountable owner: a dedicated Delivery Manager for every client.
- Vendor management: Zazz acts as your single point of contact with third-party vendors such as ISPs and software, hardware and cloud providers.
- Low lock-in: terms from month-to-month to annual, with no long-term contract required.
- Advanced assurance: the Enterprise plan adds vCISO advisory, active compliance management, annual external penetration testing and continuous dark web monitoring.
Frequently asked questions
What is managed IT services risk?
It’s the exposure a business takes on when an outside provider manages its IT. It includes risk from privileged access, tooling and the supply chain, data handling, service continuity, lock-in, compliance accountability and contract gaps.
Are managed service providers a security risk?
They can be, because they hold privileged access to many customer environments. But a well-chosen provider with independent certifications, strong access controls and clear contracts usually reduces a business’s overall risk.
How do you assess an MSP’s security?
- Request its ISO 27001 certificate and SOC 2 Type II report.
- Ask how provider accounts use MFA and least privilege.
- Confirm where your data will be stored.
- Review its incident notification and exit terms.
What should an MSP contract include to reduce risk?
- MFA and least-privilege requirements
- Incident notification timelines
- Audit rights
- Data location terms
- Documentation ownership
- Subcontractor transparency
- Termination assistance
Does outsourcing IT transfer compliance responsibility?
No. Regulators consistently hold the business accountable for outsourced activities. That’s why contracts, due diligence and ongoing monitoring matter.
Turn Managed IT From a Risk Into a Safeguard
Provider risk is real, but it’s also manageable. The right provider, chosen with evidence and held to clear terms, shrinks your risk instead of adding to it. To understand how your current IT arrangement scores, book a free 30-minute review with Zazz to assess your access controls, documentation, reporting and exit readiness.
