On Thursday of last week, CISA released its “Risk Considerations for Managed Service Provider Customers” paper. This one is too big to get lost over a long holiday weekend, so it’s the first story.
The paper is specifically focused on customers, and three organizational groups in them. First, senior executives and boards of directors in what is deemed strategic decision-making; procurement professionals, called operational decision-making and network administrators, systems administrators, and front-line cybersecurity staff for tactical decision-making.
Let’s focus in one area — What should an MSP provide to an organization in advance of contract award?
The list includes:
- Detailed guidelines for incident management, including the MSP’s incident response responsibilities, warranty information, compensation for service outages, and plan to provide continuous support during a service outage
- Remediation acceptance criteria that define the steps the MSP will take to mitigate known risks
- Statement from the MSP on how data from different clients will be segmented or separated on the MSP’s networks
- Documentation of MSP’s financial health, performance record for other clients, and disclosure of any previous legal issues
And that’s just the contract basis, as the tactical guidance includes items such as:
- Understand the supply chain risks associated with your MSP, such as network security expectations
- Create a baseline for system and network behavior to detect future anomalies; continuously monitor network devices’ security information and event management appliance alerts
- Appropriate monitoring of the service provider’s presence, activities, and connections to the customer network
Frankly, if you’re delivering IT services, you should be reading and processing this guidance.
These are the questions customers will and should be asking you. Take a moment here to consider… are you prepared to show financial health to your customers? It’s not an unreasonable requirement for a business, who believes technology is a critical component of their operations, to ensure that the vendor they work with is financially sound before transferring responsibility of that resource.
How about the monitoring of your service within your customers network? I’ve mentioned monitor the monitor as a concept before. If a customer asks to do this, are you prepared?
I’ve quipped recently that there are specific tools that I, as a customer, wouldn’t want in my network. Then what?
Large consulting firms are ready for these questions. With the overwhelming majority of providers less than $5M in revenue… are they?