Questions to Ask an MSP Before You Sign or Renew B3 buyer worksheet | Reviewed October 17, 2026 https://b3cyber.com/guides/questions-to-ask-an-msp Vendor / service: ____________________ Buyer / business owner: ____________________ Review date: ____________________ Use case / scope: ____________________ EVIDENCE SCALE 0 = claim only; 1 = dated evidence reviewed; 2 = buyer-witnessed test passed. B3 meeting tool, not a certification. Do not average away a failed critical control. Choose approval blockers before testing. Phase 1: Pre-commitment / discovery [ ] Which alerts does our tier actually cover? Attach the alert classes, monitored assets, hours, exclusions and subcontracted services to the statement of work. Identify the internal owner of every gap. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What does the SLA clock measure? Separate detection, analyst triage, customer notice, authorized containment and service restoration. Require timestamps for each; ticket creation alone is not response. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What does the audit report cover? Review the SOC 2 Type II reporting period, service scope, exceptions and customer responsibilities if a report is offered. Do not treat a report on one service as proof for every service you are buying. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What will leaving cost? Request the export format, transfer window, assistance rate, deletion process and ownership of each tenant, domain and license. Put disputed invoices and access continuity on the negotiation agenda. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ CHECK YOURSELF: Can our team explain which systems are outside the agreement, and who notices a failure there? Phase 2: Technical & operational proof [ ] Can the on-call team receive and act on a test? Agree a safe off-hours exercise using a test endpoint. Record signal time, human acknowledgment, decision time and authorized action. Compare those results with the service you are buying. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Can we trace every privileged action? Review a redacted session and log export showing person, customer tenant, action, target and timestamp. Verify you can retrieve the records without depending on the same system being investigated. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Does offboarding remove usable access? Use a test identity. Revoke its directory membership, remote-management enrollment, active sessions and delegated tokens, then attempt an approved access check. Record what remained usable and why. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Can the next provider read the export? Import a representative sample into a buyer-controlled environment. Confirm attachments, dates, identifiers and configuration meaning survive the transfer. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ CHECK YOURSELF: Which results did we observe ourselves, and which are still screenshots selected by the seller? Phase 3: Incident, failure & exit scenarios [ ] What if the MSP itself is compromised? Practice notifying your alternate contact, suspending provider access and obtaining your logs through an independent path. Identify which services stop when that access is cut. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Who makes the first call? Exercise the named primary and backup contacts. Agree a contractual first-notice target for suspected customer impact and periodic updates; have counsel align it with your applicable reporting obligations. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What happens if the primary engineer is unavailable? Ask the backup engineer to follow your runbook without coaching. Record missing knowledge, keys or permissions as acceptance gaps. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Can we terminate without losing evidence? Rehearse a scoped handover. Retain required logs and incident evidence, confirm replacement access, then revoke old identities and document deletion of remaining vendor copies under the agreed retention terms. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ CHECK YOURSELF: Could we contain a provider compromise tonight without locking ourselves out of our own recovery tools? DECISION [ ] Approved for stated scope [ ] Conditional [ ] Blocked Decision owner and date: ____________________ Accepted exceptions and expiry: ____________________ Retest trigger and date: ____________________ NEXT ACTIONS Next 7 days: Request a one-page service ownership map and an export of every MSP identity with access to your environment. Assign an internal owner to unexplained privileges. Next 30 days: Run the off-hours alert exercise and the sample export/import test. Bring procurement and the technical owner to the same review; record each failed condition and a retest date. Next 90 days: Attach the tested response clocks, access boundaries, evidence rights and exit procedure to the renewal or remediation plan. Revisit them after material service or subcontractor changes.