The most important questions to ask an MSP test who monitors alerts after hours, which systems its staff can access, how it reports suspected breaches, and whether you can leave with usable data. Require dated records and a witnessed exercise before accepting the answers.
The core problem
Buyers often purchase availability and assume they purchased detection, containment and recovery. An uptime percentage does not tell you whether an alert will reach a person at 2 a.m., or whether that person can isolate an affected account.
The B3 read
The real product is the handoff between your people, the MSP and any subcontractor. If each team believes the next team owns the decision, an impressive dashboard can document a failure without stopping it.
Minimum defensible standard
Before production access, require a named responsibility map, separate response and containment targets, individually attributable access, a tested escalation path and an export that your next provider can actually use.
02 / THE EVIDENCE
The Core Decision Framework
After-hours monitoring and SLA red flags
What the vendor may claim
We monitor you 24/7.
Evidence to demand
Ask for the exact coverage of the purchased tier, including holidays. Review an anonymized alert timeline from detection through human triage, customer contact and containment authorization. Define what starts and pauses each clock.
Red flag
The SLA measures ticket acknowledgment while the analyst who can act starts work the next morning.
Third-party access and helpdesk boundaries
What the vendor may claim
Our engineers need administrator access to support you.
Evidence to demand
Require named identities, MFA, time-limited elevation and a system-by-system access list, including remote management tools and subcontractors. Witness a departed engineer’s account, sessions and API tokens being revoked.
Red flag
A shared account, permanent tenant-wide administrator rights, or an exception the MSP cannot explain or expire.
Breach notification and ownership
What the vendor may claim
We will notify you promptly if there is an incident.
Evidence to demand
Define the trigger, first notice deadline, out-of-band contacts, update cadence and evidence handoff. Include suspected compromise of the MSP or a subcontractor that could affect you; record who may contain systems without waiting for another approval.
Red flag
Notice waits for a completed investigation, a confirmed data loss figure or agreement from the vendor’s legal team.
Exit rights and data portability
What the vendor may claim
Your data belongs to you.
Evidence to demand
Obtain a sample export of tickets, asset inventory, configurations, logs and recovery instructions. Identify who controls domains, cloud tenants, encryption keys and licenses. Test an import and price transition assistance before signature.
Red flag
Ownership exists on paper, but access depends on the departing provider’s account or an unpriced professional-services engagement.
Buyer questions answered
What is the difference between an MSP response SLA and a resolution SLA?
A response SLA usually measures the first qualifying acknowledgment or action defined in the contract. A resolution SLA measures restoration or closure under its own definition. Ask for both definitions, exclusions and timestamp examples; neither automatically promises security containment.
Is a SOC 2 report enough to approve an MSP?
No. It is one source of evidence about a defined scope and period. Match it to the service you buy, review exceptions and customer duties, then test the access and incident procedures that matter in your environment.
How quickly should an MSP notify us of a breach?
Set a first-notice target tied to your impact and reporting obligations, starting from an explicitly defined suspicion or discovery trigger. A universal number would ignore your sector and contract. Require an initial incomplete notice followed by timed updates, rather than waiting for full certainty.
03 / THE WORKING CHECKLIST
Practical Evaluation Checklist
Use the questions in a review meeting. Check a box after the requirement has been reviewed, then capture the actual evidence and decision in the downloadable worksheet. Page checkmarks are temporary and are not submitted.
The B3 evidence scale
Record each material requirement as 0: claim only, 1: dated evidence reviewed, or 2: buyer-witnessed test passed. Record the owner, evidence location, test date and unresolved condition alongside the score. This is B3’s meeting tool, not an industry rating or certification.
A total must never hide a failed critical control. Choose approval blockers before testing; keep a blocked control open until it passes or an authorized buyer explicitly accepts the exception.
Phase 1: Pre-commitment / discovery
Phase 2: Technical & operational proof
Phase 3: Incident, failure & exit scenarios
04 / FROM REPORTING TO REQUIREMENTS
Daily Brief Intelligence Bridge
These links preserve the original edition and its reporting context. The control recommendations below are B3 analysis; the incidents do not establish that any particular vendor passes or fails this checklist.
The buyer-side read: A helpdesk compromise belongs in the MSP access review. Ask what its service account can reach and whether an attacker could also erase the records needed to reconstruct its actions.
The buyer-side read: B3’s warning-to-action analysis gives the monitoring drill its purpose: measure the route from signal to an authorized person. This is an evaluation scenario, not a claim that an MSP caused the reported breach.
The buyer-side read: Remote-access appliance exposure tests the boundary between patching and investigation. Require evidence of the installed build and a documented decision about whether compromise checks are needed.
Request a one-page service ownership map and an export of every MSP identity with access to your environment. Assign an internal owner to unexplained privileges.
Next 30 days
Run the off-hours alert exercise and the sample export/import test. Bring procurement and the technical owner to the same review; record each failed condition and a retest date.
Next 90 days
Attach the tested response clocks, access boundaries, evidence rights and exit procedure to the renewal or remediation plan. Revisit them after material service or subcontractor changes.
Primary sources and scope
References checked October 17, 2026. The tests and decision rules in this guide are B3 recommendations unless a source is explicitly identified.
Baseline support for monitoring, access restrictions, shared responsibilities and exercised incident plans. B3’s acceptance exercises above are proposed buyer tests, not a certification.
