The Bit of Your Security That Never Gets Outsourced (Even When Everything Else Does)

We like MSPs. Genuinely. A good managed service provider gives a fifteen-person organisation capabilities it could never staff itself, at a price that doesn't require a board argument. If you're a small UK outfit running on spreadsheets and goodwill, an MSP is one of the better decisions you'll make.

This is not an attack on them. It's an attack on a sentence that gets said in a lot of small boardrooms, usually by someone with a coffee in one hand: "The provider handles that."

Sometimes that's true. Often it isn't. And the gap between the two is where incidents get expensive.

Scope is a document, not a feeling

An MSP sells defined services at a defined price. That means the agreement has a scope, and everything outside it belongs to somebody else — usually you, whether or not you've noticed. Typical inclusions are helpdesk support, patching on covered endpoints, antivirus or endpoint detection licensing, backup monitoring, Microsoft 365 administration, maybe some strategic advice.

What quietly sits outside, more often than not:

• Devices nobody enrolled — the MD's personal iPad, the marketing freelancer's laptop, the warehouse tablet bought on a company card
• Shadow IT — the team who moved their project files into a personal Dropbox because SharePoint was slow in March
• Anything that looks like a policy, a process or a training culture
• Decisions about which data is sensitive, who should have access, and what happens when someone leaves
• The regulatory conversation, including whether to notify the ICO

None of that is the MSP being sneaky. It's just not what you bought. And here's the uncomfortable bit: accountability doesn't follow the invoice. If you're the data controller, the duty to report a breach is yours. If you're the policyholder, the insurer's questions land on your desk — and insurers increasingly want to see how you manage suppliers, because a lot of claims now start with a supplier.

The three assumptions worth stabbing with a pencil

"They'd spot it if something happened." Detection is a service with hours attached. Does your agreement include out-of-hours monitoring? Who receives the alert, and how quickly do they act on it? An alert that lands in a shared inbox at 6pm on Friday is not the same as a response.

"They'd report it for us." If they're a processor, their contractual duty is to notify you without undue delay. The regulator-facing decision stays with you as controller. Ask them for the clause that says how fast they'll tell you, in hours, not vibes.

"They carry the liability." Open the limitation of liability section. Most MSP contracts cap liability at fees paid in the preceding twelve months, or some similar figure. That is a reasonable commercial position and a terrible disaster plan. Their cap is not your cover.

Questions to take into the renewal meeting

Print these. Ask them out loud. Write down the answers, because in six months nobody will remember the conversation.

1. What is out of scope, on one page? Ask for the exclusions in plain English, not contract language.
2. How many devices and users are unmanaged right now? The number is usually higher than anyone expects.
3. What are your detection and response hours? And who picks up at 2am — your team or a third-party SOC?
4. What's the response time for a suspected ransomware alert? Get it in writing, with a number of minutes.
5. Is incident response included, or time and materials? If a real incident is billable by the hour, know the rate before you need it.
6. If we're breached, what do you do, in what order, and what will you give us in writing within 24 hours? You need facts fast to make a 72-hour call.
7. Who holds the admin and break-glass credentials? Can you hand them back at short notice, and how?
8. Do you have your own cyber insurance and certifications? Cyber Essentials, ISO 27001, whatever applies — ask for evidence, not adjectives.
9. Who owns backup restore testing, and when was it last actually proven? Backups that have never been restored are a rumour.
10. What happens on exit? Data return, credential rotation, timelines. Awkward now, invaluable later.
11. What's the liability cap, and what does your policy exclude? Bring the answer to your own broker.
12. Will you sit in our incident exercise once a year? Good providers say yes immediately. That tells you something.

What a healthy version looks like

A mature MSP will welcome this conversation. They'd rather have a client who understands the boundary than one who assumes everything is included until the day it isn't. The best setups we see have a short responsibility matrix — a two-column table saying who does what — reviewed annually, alongside a shared incident contact sheet and a joint rehearsal that takes under an hour.

That matrix is also gold for insurance. When your broker asks about supplier management, you have a document rather than a shrug.

The decisions that stay in the room

Even in the most outsourced setup, a handful of things remain stubbornly yours: your risk appetite, whether to notify the regulator, what you tell customers, whether to pay a ransom (which is a sanctions question as much as an ethical one), and who your named contact is when things go wrong.

The underdog defender doesn't have to be the person clicking the buttons. But they do have to stay in the room. Outsource the work by all means — just don't outsource the thinking. Your MSP will thank you for it, eventually, and your insurer definitely will.