Securing Your Own MSP

Last updated

You are the highest-value target in your market

An attacker who breaches one 200-seat company gets one company. An attacker who breaches an MSP gets every client at once, delivered through the very tools built to push software silently to every endpoint you manage. That supply-chain reach is why MSPs are explicitly and deliberately targeted – privileged access to many networks, concentrated in one place.

The defining proof is Kaseya VSA, July 2, 2021. REvil exploited a zero-day authentication bypass in on-prem VSA servers and pushed ransomware through the RMM's own update and agent channel. Roughly 60 MSPs and somewhere between 800 and 1,500 downstream businesses were encrypted simultaneously, with a $70M ransom demand (Kaseya later obtained a universal decryptor without paying). One compromise, entire client bases gone in an afternoon.

This is not history. RMM tool abuse rose 277% in 2025 and featured in roughly a quarter of observed incidents. The dominant intrusion pattern is now session-token theft via adversary-in-the-middle phishing kits like Evilginx – an attack that walks straight past push-based MFA and steals the already-authenticated session instead.

Start with the CISA baseline

The canonical reference is joint advisory AA22-131A, "Protecting Against Cyber Threats to Managed Service Providers and their Customers," issued in May 2022 by CISA, NSA, FBI, and Five Eyes partners – and still the standard as of 2026. Its key asks:

  • Harden and monitor all remote access infrastructure
  • Enforce MFA everywhere, on internal and customer-facing systems alike
  • Log widely and retain logs for at least six months
  • Segregate internal admin systems from customer-facing infrastructure
  • Offboard accounts rigorously when staff or clients leave
  • Define security roles and responsibilities contractually with every client
  • Maintain – and actually exercise – incident response plans

Treat that list as your standing internal audit checklist. Everything below implements it.

Phishing-resistant MFA on every tool, no exceptions

MFA goes on every tool that touches client environments or your business – no exceptions, no service accounts quietly excluded: the RMM, the PSA, the backup console, the EDR console, distributor portals, the domain registrar, and your documentation platform (Hudu, IT Glue). A documentation platform holds every client's credentials and network maps; treat it like the crown jewels it is.

Because token theft is the dominant pattern as of 2026, push-approval MFA is no longer enough for privileged access. Move every admin, RMM, and PSA login to phishing-resistant MFA – FIDO2 hardware keys or Windows Hello. A set of hardware keys for your whole team costs less than one hour of incident response.

Separate admin accounts and least privilege

  • No shared logins, ever. Every admin action must be attributable to a named person; shared credentials also make offboarding a fire drill.
  • Daily driver ≠ admin. The account that reads email and browses never holds admin roles; admin work happens under separate named admin accounts.
  • Privileged access workstations for tenant administration, kept off email and general browsing.
  • Just-in-time elevation (Entra PIM) instead of standing global admin – hold the role for the hour you need it.
  • Checklist-driven offboarding for staff, executed same-day: every portal, every tool, every client tenant.

GDAP, not legacy DAP

Legacy DAP gave partners standing Global Admin over every customer tenant – which is why Microsoft force-retired it in 2023. GDAP replaces it with per-customer, role-scoped, time-boxed relationships (1 to 730 days), assigned to security groups instead of the whole partner tenant, with PIM-style just-in-time elevation on top for the few genuinely privileged roles.

If your partner tenant still carries broad, never-expiring delegation, migrating to properly scoped GDAP is the single highest-impact hardening move available to a Microsoft-centric MSP: it converts "one phished tech = Global Admin on every client" into "one phished tech = limited role on one tenant, for a limited time."

Harden the RMM itself

Your RMM is the ransomware distribution system an attacker dreams of – Kaseya proved the delivery mechanism works. Minimum standard:

  • IP allow-listing on the RMM console so it isn't reachable from the open internet
  • Patch the RMM within days of release – the Kaseya victims were running unpatched on-prem servers
  • Remove stale agents from offboarded clients and dead machines; every forgotten agent is a door
  • Vet the script library and restrict who can create and push scripts
  • Keep customer-facing infrastructure separated from your internal admin network, per AA22-131A

Run your shop at CIS IG1

You need a framework so hardening is a checklist, not a vibe. The channel favorite is CIS Controls v8.1: prescriptive, free, and tiered. IG1 – 56 safeguards across 15 controls, labeled "essential cyber hygiene" – is explicitly designed for small organizations without dedicated security staff, which is exactly what a young MSP is. Run your own company at IG1, graduate toward IG2 as you take on regulated clients, and map the results to NIST CSF when insurers or client executives want board-level reporting.

The bonus: the same IG1 checklist doubles as your client gap-assessment product, so hardening yourself is also product development – see Building Your Client Security Stack.

An IR plan for "our RMM is popped"

Responding to a client's incident and responding to your own are different plans; you need both. Pre-stage a runbook for your own compromise:

  1. How to sever RMM connectivity to all clients fast, and who has authority to pull that trigger
  2. Out-of-band communications – assume your email and PSA are attacker-readable
  3. Offline copies of documentation and credentials, so containment doesn't depend on compromised systems
  4. Six-plus months of retained logs so forensics has something to work with
  5. A client notification order and script – who calls whom, saying what
  6. Your own E&O/cyber policy details and carrier hotline at hand

Then exercise it. CISA specifically calls for exercised plans, and a tabletop costs one afternoon. Model the client-facing side on your incident response process, but write the self-inflicted version separately.

Your posture is a sales asset

Every control above eventually shows up in someone else's due diligence. Clients' cyber-insurance carriers ask about the MSP's own controls. CMMC-bound clients must document what their MSP touches via a shared responsibility matrix – an unhardened MSP is disqualified from that revenue entirely. And in competitive deals, "here is the CIS IG1 checklist we run our own company against, and here's our own IR tabletop schedule" is credibility that no brochure buys. Prospects extrapolate: the MSP that secures itself rigorously will secure them rigorously. Make your own posture a named section in sales conversations and QBRs – see MSP sales and marketing.

Bottom line

Harden in this order: phishing-resistant MFA on every tool, GDAP migration, RMM lockdown, separate admin accounts with just-in-time elevation, then work methodically through CIS IG1 and write and exercise the "our RMM is popped" runbook. None of it requires new headcount – mostly configuration, keys, and discipline – and every control does double duty as sales collateral. You sell security for a living; the first client is you.