About MSPAlliance.org

The Organization has a formal management structure, with an executive steering committee/board of directors responsible for the management and supervision of the company.

Strategic plans and priorities have been developed and communicated to the management of the company.

A risk management strategy is established by the organization. Risks are logged and communicated to management to ensure adequate and timely analysis. A risk treatment strategy is in place and followed.

For infrastructure, platform, or software as a service being delivered, the Organization has a process for managing and determining their legal and financial risk of software audits or third-party intellectual property claims. An inventory of in scope SaaS vendors is maintained by the organization.

External service providers (contractors, third parties, vendors), including providers of cloud, SaaS, managed services, and AI-enabled services utilized by the Organization, are evaluated, approved, and periodically reviewed by designated personnel prior to use and throughout the service lifecycle.

Policies and procedures have been formally documented to guide the daily operations of the Organization.

An Incident Response policy has been formally documented. Policies and procedures to address data breaches, ransomware payments, and cyber-attacks impacting the daily operations of the Organization are established and tested, and if applicable, it’s Customers.

Policies and procedures are reviewed and updated at least annually to ensure any modifications are approved and implemented.

The Organization shall conduct internal audits at planned intervals to provide information on whether their internal systems are meeting their control criteria.

Employees are required to sign and attest to their understanding and adherence to Organizational policies and procedures.

New employee orientation/training and continuing education programs for existing employees are implemented to address the ethical, integrity, confidentiality, privacy, security, and acceptable use standards developed by the Organization.

Organization employees receive essential cybersecurity and information security training.

The Organization has a documented policy containing procedures for effectuating the safe transfer of IT management to another provider. The Organization uses signed agreements which contain specific provisions for addressing transition services in situations where the client is changing providers.

Background checks are conducted on personnel following Organization policies and procedures.

Employees are required to sign and attest to their understanding and adherence to Organizational confidentiality and privacy policies.

Internal or Customer data classified as confidential or private is encrypted following applicable industry best practices or regulations. Where encryption is not available, inherent information security practices are in place to protect internal and customer data.

Policies and procedures are implemented to govern the identification and disclosure of the geolocation of managed data.

Policies and procedures are implemented to govern the identification and geolocation disclosure of external service provider managed data.

External service providers only monitor or gain access to Organizations and Customers' information systems only when needed. This access is monitored, logged, and reviewed according to documented policies and procedures.

Policies and procedures have been implemented to govern the communication and disclosure of external service provider access to Customer information systems and data.

Configuration data for objects managed or monitored is documented based on level of service before management of the object.

Service levels are adequately categorized and identified within Organizational systems.

Modifications to internal object configurations are documented to ensure changes are requested, reviewed, and approved following a consistent process.

Modifications to Customer object configurations are documented to ensure changes are evaluated and approved by the Customer before implementation. Configuration data is updated following implementation to reflect the current Customer configuration.

The Organization monitors the capacity of managed objects and environments. If applicable, the Organization manages and proactively plans (both internally or with the Customer) and prioritizes capacity requirements.

Vendor-supplied software and hardware patches are applied to managed objects and environments following standardized procedures. on-critical patches are evaluated for issues before release and applied during planned or accepted maintenance windows. Critical patches are applied as soon as possible to both Customer and internal environments.

A Managed service/Network/Secure Operation Center (MSOC/NOC/SOC) is used to provide effective and secure monitoring and management of Organization and Customer managed environments.

A problem management system (help desk / ticketing system) has been implemented to ensure that operational events that are not part of the Organization’s standard operations are recorded, analyzed and resolved in a timely manner.

Problem/incident documentation is categorized to allow for event correlation and the elimination of false positives.

Problems and/or incidents identified in the Customer’s environment are properly resolved and such resolution is documented and reported to both Organization and Customer management.

Organization management performs a periodic internal review of tickets and operational events.

Access to Organization and Customer systems and configuration data is restricted to authorized personnel following a documented Access Control Policy. All critical service delivery and internal applications have centralized access control mechanisms implemented.

Administrator IDs to information systems (network and in-scope critical systems) are restricted to a limited number of approved personnel.

Users authenticate to Organizational information systems and the underlying Customer data using unique user account IDs and passwords.

Logical access to the Organization’s information systems (Organization LAN (Local Area Network) and web portals) and Customer systems and data is revoked and reviewed for terminated and departing employees.

User authentication password mechanisms are implemented and require minimum standards for password length, complexity, expiration, reuse, and account lockout for failed attempts. Organization passwords are stored in a secure password repository.

Access to information systems (including Customer systems and data) is separated by functional area to ensure segregation of duties.

Access to information systems, as well as the underlying customer systems and data, is continually reviewed by the Organization’s upper management to ensure that resource access is appropriately restricted to authorized personnel.

Remote access to the Organization and Customer information systems is protected by restricting access to the Remote Access Tool using a VPN or Zero Trust Network Access (ZTNA) configuration. Remote access is monitored, logged, and reviewed by Organization management following a Remote Access Policy.

Local and wide area networks are secured through the use of managed firewalls and other devices and software. Where applicable, MDR/EDR/XDR controls and security information and event management (SIEM) systems are utilized to monitor and secure the Organization’s network.

The Organization has implemented applications and/or systems to scan and protect email and environments from email attacks and malware/viruses.

Organization has implemented an EDR (Endpoint Detection and Response) system on the network’s connected devices and traffic (web and email) to scan and protect its environment.

The Organization's wireless network is segregated from its guest wireless network.

Network security reviews (including security assessments, scans, penetration tests, etc.) of the Organization’s network are conducted periodically.

The Organization has a formal process for tracking, retaining and reviewing audit logs.

The Organization establishes and maintains an Identity and Access Management (IAM) framework to govern authentication, authorization, and identity lifecycle activities across Organizational and Customer systems, ensuring that access is appropriately provisioned, verified, monitored, and revoked in alignment with defined roles and business requirements. The IAM framework operates in conjunction with access control, authentication, and external service provider management processes, incorporating automated, monitored, and risk-based controls to enforce identity assurance, accountability, and least-privilege access across all environments.

Where applicable, Customer data backup schedules are documented and followed following contractual service agreements, with backups being monitored, with any errors being handled following operations management policies and procedures. Customer backup and/or replicated data is encrypted following contractual requirements.

Organization data backups are being completed and monitored following backup schedules, with any errors being handled following operations management policies and procedures. Backup and/or replicated data is encrypted following Organization policies and procedures.

Backup data restoration and recovery testing procedures are conducted periodically, with the results of tests being logged and monitored by the Organization.

Business continuity plans are documented and tested periodically to ensure the integrity of Organization and, if applicable, Customer data.

Objects containing internal data are handled and destroyed following end-of-life policies.

If data destruction services are delivered to Customers, objects containing Customer data are handled and destroyed following end-of-life policies.

Assets and devices are maintained in a centralized inventory list. A device management policy and supporting security measures shall be adopted to manage the risks of all devices and assets. The Organization is using an active discovery tool when managing customer assets.

Physical security controls are implemented by the Organization with respect to all work locations. Access rights of personnel are reviewed and approved by Organization upper management on a periodic basis.

Visitor logs are maintained at each facility by the Organization. Visitors are required to sign the log upon entering the building.

Physical access to the sensitive areas (including operations centers, data centers, and server rooms) is restricted to authorized personnel.

Upon termination, employee access to the Organization’s facilities is revoked.

The Organization has environmental safeguards in its NOC(s) and/or data center(s) to protect from disruptive events.

Environmental and maintenance services are performed and tested regularly following a standardized and documented process.

Physical access to collocation hardware maintained in the Organization’s facilities is restricted to individuals designated by the Customer and authorized Organization personnel.

Signed Master Service Level Agreements (MSA) are in place between the Organization and Customers.

Organization invoices are generated following signed Master Service Level Agreement contracts.

Reporting metrics are available to Customers following signed contracts.

Financial reports demonstrate profitability of a minimum of 6 of the previous 12 months, or sufficient access to funds necessary to keep the Organization operational for a 12-month period of time

The Organization demonstrates sufficient managed services revenue distribution so that the largest Customer does not represent more than 20% of total managed services revenue and the five largest Customers do not represent more than 50% of total managed services revenue.

The Organization demonstrates that a sustainable gross profit margin is realized on its managed service/cloud offerings.

The Organization shows that most of its customers and revenue come from relationships that last at least a year or longer.

The Organization maintains errors and omissions, professional liability, cyber security and any other applicable insurance policies necessary to mitigate against Organization business disruption.

The Organization maintains records to track the retention of customers (both voluntary and involuntary) and employees (both voluntary and voluntary) to ensure business continuity.