Your IT provider probably has more power over your business than any of your employees. They hold admin accounts on your servers, your Microsoft 365 tenant and your firewall. Their remote management software runs on every workstation. If they get compromised, so do you.
This isn't hypothetical. In July 2021, the Canadian Centre for Cyber Security issued an alert about ransomware pushed out through Kaseya VSA, a remote monitoring and management platform used by many managed service providers (MSPs). Attackers reached those providers' customers by injecting malicious code and abusing the tool's built-in features.
Yet few small businesses ever assess their provider's security. You pick an MSP for its responsiveness and price, then simply trust it. Here are the questions to ask, and what a good answer sounds like.
TL;DR
- Your IT provider is your biggest supply chain risk: they hold the most powerful access in your environment.
- Ask 12 questions about their access, MFA, logging, backups and incident handling.
- A good answer is specific, verifiable and documented. "Don't worry about it" is not an answer.
- In Quebec, if the provider can access personal information, Law 25 requires a written contract that spells out the protection measures.
Why assess your provider, even when everything's fine
In its guidance for consumers of managed services (ITSM.50.030), the Cyber Centre is clear: your organization remains the data owner and is legally responsible for data security, even when someone else manages it. You also remain accountable for incident response.
Privacy law agrees. Under Quebec's Law 25, a business that hands a mandate involving personal information to a provider must do so in writing and specify the protection measures required (section 18.3). The provider must notify your privacy officer without delay of any breach or attempted breach, and allow the privacy officer to carry out any verification relating to confidentiality. Under PIPEDA, the federal privacy commissioner likewise reminds businesses that they must protect personal information they transfer to a third party for processing.
Finally, in May 2022, the cyber security agencies of Canada, the United States, the United Kingdom, Australia and New Zealand issued a joint advisory on threats to MSPs and their customers. Among other things, it recommends that customers contractually require MFA on every MSP account used to access their environment.
The 12 questions to ask your IT provider
These questions draw on the Cyber Centre's guidance (ITSM.50.030 and ITSAP.00.070) and the 2022 joint advisory.
| # | Question | A good answer looks like... | Red flag |
|---|---|---|---|
| 1 | Which accounts do you use to access our environment? | Named accounts for each technician, with the list available on request | One shared "admin" account for the whole team |
| 2 | Is MFA mandatory on all your access to our systems and on your own tools? | Yes, everywhere, ideally phishing-resistant for admin accounts | "On most of them" or "we're working on it" |
| 3 | How is your remote monitoring and management (RMM) tool secured? | MFA, restricted access, timely updates, logged actions | No specific answer |
| 4 | Do your accounts only have the rights they need? | Least privilege; elevated rights granted when needed, then removed | Permanent global admin for everyone |
| 5 | Do you log what you do in our environment, and can we see those logs? | Yes, logs are kept and available on request | "We don't keep anything" |
| 6 | If you suffer an incident, how quickly will we be told? | A written timeline in the contract and a named contact | "We'd tell you, for sure" |
| 7 | How are our backups made and tested? | Isolated or immutable copy, documented restore tests | "It just runs on its own" |
| 8 | Where is our data stored, and who can access it? | Specific location (country, cloud provider) and a list of subcontractors | Unknown location |
| 9 | Do you use subcontractors? | Yes or no, with the same contractual requirements passed down | Undisclosed subcontracting |
| 10 | Do you have an independent audit report (SOC 2, ISO 27001) or external assessment? | Yes, with its scope, or a clear explanation of your controls if not | Refusal of any verification |
| 11 | Do you train your staff on security? | Regular training and background checks for technicians | No training at all |
| 12 | What happens to our access and data when the contract ends? | A written exit procedure: handover of access, data and documentation, then destruction | "We'll figure it out then" |
Get the answers in writing. A good provider won't be offended by these questions; most already have a document that covers them.
Clauses to put in the contract
Verbal answers don't count for much on the day of an incident. With your legal counsel's help, write into the contract:
- the personal information protection measures required by section 18.3 of Law 25 (for Quebec businesses);
- the duty to notify your privacy officer without delay of any breach or attempted breach;
- mandatory MFA on every provider account;
- your right to review the provider's activity logs in your environment;
- a notification timeline if the provider suffers an incident;
- the list of subcontractors and an obligation to tell you about any change;
- ownership of your data, passwords and documentation;
- an exit procedure: handover of access, data transfer and destruction of copies.
The customer's blind spots
Assessing your provider doesn't let you off the hook. The 2022 joint advisory recommends that customers verify, through audits, that MSP accounts are being used for appropriate purposes, and disable accounts that are no longer in use.
- Keep an emergency admin account that only you hold the credentials for, stored somewhere safe.
- Own your subscriptions: Microsoft 365, domain name, firewall licence, backup software.
- Review your provider's accounts at least once a year.
Take a 35-person engineering firm in Gatineau. When it switched providers, it discovered the old one still held three global admin accounts in its Microsoft 365 tenant, and that the domain name was registered in the provider's name. Nothing malicious, just total dependence, invisible until the day of the switch.
IT provider, security provider, or both?
An MSP keeps your IT running; it isn't necessarily a security specialist. Some small businesses pair an MSP for day-to-day operations with an independent security partner, so the people who configure the systems aren't the only ones checking them. Our comparison of MSP vs MSSP vs vCISO vs in-house helps you pick the right model. The certifications mentioned above are explained in our article on ISO 27001 vs SOC 2 for small business.
If you'd like an independent third party to ask these questions for you and check the answers inside your environment, that's exactly what we do as your ongoing security partner. And to see how a provider compromise can escalate, read our anatomy of a ransomware attack.
Frequently asked questions
Why do attackers go after managed service providers?+
Because a single provider opens the door to dozens of clients. The Canadian Centre for Cyber Security points out that managed service providers are attractive targets because they have access to numerous client systems and a lot of data. In July 2021, the attack carried out through the Kaseya VSA platform showed how ransomware could spread from providers to their customers.
Is a SOC 2 report or ISO 27001 certification enough?+
It's a good sign, not a guarantee. Check the scope: does the report cover the services you receive and the remote access tools? A SOC 2 Type 2 report tests how well controls work over a period of time, while a Type 1 only looks at a single point in time. Many small providers have neither, which makes their answers to the questions in this article even more important.
What should the contract with my IT provider include?+
In Quebec, if the provider can access personal information, Law 25 requires the mandate to be in writing and to spell out the measures the provider must take to protect confidentiality, to use the information only for the mandate and not to keep it once the contract ends. The provider must also notify your privacy officer without delay of any breach or attempted breach. Under PIPEDA, you remain accountable for information transferred to a third party for processing. Have legal counsel review the contract.
How often should we re-evaluate our IT provider?+
At least once a year, and whenever something significant changes: contract renewal, a new service, the provider being acquired, or an incident. The Cyber Centre recommends re-evaluating suppliers regularly and using third-party assessments for critical ones.
Sources
- 1.Canadian Centre for Cyber Security: Cyber security considerations for consumers of managed services (ITSM.50.030)
- 2.Canadian Centre for Cyber Security: Cyber supply chain security for small and medium-sized organizations (ITSAP.00.070)
- 3.Canadian Centre for Cyber Security: Supply chain-enabled ransomware activity affecting multiple managed service providers (July 2021)
- 4.CISA and partners (including the Cyber Centre): Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A, May 2022)
- 5.LégisQuébec: Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)
- 6.Office of the Privacy Commissioner of Canada: PIPEDA Fair Information Principle 1, Accountability