Identity
Account resets, roles and Microsoft Entra administration
Supplier assurance and managed IT
Your IT provider has the keys to your business. Who secures the keyholder?
A managed service provider can protect your organisation and hold unusually powerful access to it. Both facts should shape the questions you ask.
This practical guide explains why MSP security deserves ongoing assurance, which controls matter most and how to challenge a provider constructively.
See the eight questionsStart with the relationship
Security investment can be sound, while the keyholder still goes unchecked.
A business may invest in multi-factor authentication, endpoint protection, Microsoft 365 and employee awareness, then give an external IT provider the ability to reset accounts, administer devices, change configurations and access critical systems. That is not inherently a mistake. It is how managed IT works.
The risk appears when the conversation stops at what security products a provider will deploy for the customer. The stronger question is more uncomfortable: how does the provider protect the privileged position the customer gives it?
For a CEO, CFO or operations leader, this is a supplier-assurance question, not a request to become a security engineer. You need to understand how the provider governs its access, proves controls are working and communicates if something goes wrong.
Why an MSP is different
An ordinary supplier delivers a product. An MSP may help operate your digital estate.
An MSP may have administration rights across identities, laptops, email and files, networks, backup platforms, remote support and security tooling. In a cloud-based business, that can amount to an ability to restore access, change a policy or investigate a security event very quickly.
That access is often valuable. It enables faster support, preventative maintenance and coordinated response. But it also creates a concentration of risk. One supplier can support many organisations through shared operational platforms and trusted relationships. The UK Government has used this one-to-many exposure as part of the rationale for proposed regulation of qualifying managed service providers.
The sensible response is not to avoid outsourcing. It is to give the provider relationship the same governance attention that you would give a bank, payroll bureau or other critical business dependency.
Why an MSP is different from an ordinary supplier
Privileged service access can touch several critical areas at once.
Endpoints
Device management, updates and remote support
Microsoft 365
Email, files, collaboration and tenant settings
Networks
Firewalls, Wi-Fi, connectivity and core infrastructure
Backup
Recovery settings, backup data and restore processes
Security tooling
Alerts, protection policies and investigation evidence
The question is not whether the provider has access. It is whether that access is deliberate, limited, visible and recoverable.
Why the question has become more important
Identity and trusted connections now sit at the centre of business operations.
First, more of the business is cloud-based and identity-driven. A successful sign-in, privileged role or application connection can be more consequential than a device in a particular office. Microsoft’s 2026 Digital Defense Report describes identity as the primary control plane, spanning people and non-human identities.
Second, providers rely on remote-management, backup, security, cloud and SaaS platforms. That is normal operational reality, not evidence of poor practice. It does mean customers should have reasonable visibility of relevant dependencies and confidence that provider-side suppliers are assessed rather than assumed to be safe.
Third, attackers increasingly seek trusted identities, applications, relationships and services because those paths can resemble legitimate activity. The ConnectWise Cloud Backup incident is a useful reminder that a trusted application needs the same scrutiny around access, monitoring and response as an employee account. It does not mean every integration is unsafe, or that every provider is a major weakness.
The assurance gap
Dependency is increasing faster than many supplier reviews are maturing.
The 2025/26 UK Cyber Security Breaches Survey found that 65% of medium businesses identified a cyber breach or attack in the previous 12 months. That figure does not say suppliers caused those events. It does show the level of exposure businesses are trying to manage.
In the same survey, 30% of medium businesses formally reviewed cyber risks posed by immediate suppliers, and 13% reviewed risks from their wider supply chain. That gap matters when essential services are delivered through long chains of trusted access.
A useful review is therefore proportionate rather than performative. It should identify which providers can affect essential systems, information or recovery, set a sensible review cadence and retain the decisions, evidence and actions that follow. This lets a business revisit an important dependency when services, people or the threat picture changes.
65%
of medium businesses identified a cyber breach or attack
30%
formally reviewed cyber risks from immediate suppliers
13%
reviewed risks in their wider supply chain
Baseline plus evidence
Certification matters. It is the starting point, not the end of assurance.
Cyber Essentials Plus, ISO 27001 and similar independent assurance are valuable signals. They help buyers assess whether a provider has established a security baseline and subjected it to external scrutiny.
But a certificate alone cannot explain how controls apply to your environment day to day. Buyers also need operational evidence: who can use privileged access, how it is approved and authenticated, which actions are logged, when access is removed and how third-party dependencies are governed.
The distinction is practical. Certification helps establish that a system of control exists. Operational evidence helps a customer understand how that system works in the relationship they are buying.
An ongoing model
Use assurance as a discipline, not a document request.
The NCSC supply-chain principles offer a helpful rhythm: attention throughout the relationship, not only at procurement or after an incident.
01
Understand
Map privileged access, customer dependencies and the business impact if a provider-side control fails.
02
Control
Apply minimum access, stronger authentication, segregation and clear responsibilities before an incident occurs.
03
Verify
Review evidence such as access records, logs, assurance reports, tests and service governance actions.
04
Improve
Use incidents, changes, reviews and emerging risks to refine controls instead of treating assurance as a one-off exercise.
Take this into your next review
Eight questions your IT provider should be able to answer
These questions are not an attempt to catch a provider out. They are a practical way to test whether the organisation understands and governs the access it holds.
- 1Who can obtain administrative access to our environment?
- 2How is privileged access authenticated, approved and logged?
- 3Is our environment appropriately segregated from other customers?
- 4Which third-party platforms can access our systems or data?
- 5How do you remove access when staff or suppliers leave?
- 6What happens if one of your own systems is compromised?
- 7How quickly would you tell us about an incident that could affect us?
- 8What independent evidence can you provide that your security controls operate effectively?
A direction of travel
The Bill changes expectations, not just compliance.
As of 21 October 2026, the Cyber Security and Resilience Bill is still progressing through Parliament. Current proposals intend qualifying medium and large MSPs to come within the Network and Information Systems regime. This is not legal advice, and the final scope will depend on the legislation and provider circumstances.
The wider message is clear: Government recognises that trusted technology providers can create systemic risk. Even if a provider does not ultimately fall within scope, customers should expect greater transparency and evidence from suppliers with privileged access.
Security is service quality
Excellent ticket handling is not complete service quality if privileged access cannot be explained.
Good managed IT combines support with accountability, visibility, governance, communication and continual improvement. Security should be integrated into service delivery, not handled as a separate annual exercise.
For customers, this creates a clearer shared operating model: see service, security and risk information, debate improvements and test whether privileged-access controls remain appropriate as the business changes.
That is also why Wavex treats visibility, integrated security management and service governance as connected parts of managed IT. The purpose is not more reporting for its own sake. It is evidence that helps people make and own decisions.
Frequently asked questions
Questions leaders often ask about MSP assurance.
Ask the difficult questions
Review the access you have given your IT provider.
The next time your organisation reviews an IT provider, do not only ask what it is doing to secure your business. Ask what it is doing to secure the access you have given it.
If you are reviewing current arrangements or preparing a tender, Wavex can help you understand what good security, visibility and accountability should look like.
Discuss your IT provider review
Tell us which part of your service or supplier assurance you would like to review. a sector specialist will be in touch. We aim to reply within 1 hour.