In November 2025 the National Cyber Security Centre (NCSC) published guidance for small and medium-sized businesses on choosing a managed service provider. It gives your prospects and clients a ready-made list of questions to ask you.
That's good news for MSPs that take security seriously. If you can answer every question with evidence, you'll stand out from providers that can't.
Why the NCSC published it
An MSP usually has access to its clients' systems and data, often with admin rights across many organisations at once. That makes MSPs an attractive target: one compromised MSP can be a way into every client it supports. Smaller businesses are also less able to absorb downtime, so the NCSC wants them to treat security as part of choosing a provider, not an afterthought.
What the NCSC tells businesses to check
The guidance groups its advice into four areas.
1. Choosing the MSP
- Recognised certifications, with Cyber Essentials Plus named as the main example
- References or case studies from similar businesses
- A track record they can check, and openness about services and processes
- Clear service levels for response times and uptime
2. The security services you provide
- Prompt patching and security updates, including firmware
- Automated off-site backups, with restores that are tested
- Security monitoring and logging, with alerts
- Two-step verification (2SV, also called MFA) on every way in
- A clear incident response process
3. The contract
- A detailed service level agreement and clearly defined responsibilities and liabilities
- A set timeframe for telling the client about security incidents
- Regular reviews and reporting
- Least-privilege access for the MSP, and removal of old accounts and equipment
- A clear process for renewal or ending the contract
4. Risk and responsibility
- How you manage risks in your own supply chain
- Who is accountable if there's an incident
- A tested incident response and recovery plan
- Regular security training
The NCSC also tells businesses that they can check whether an MSP's Cyber Essentials certificate is genuine using IASME's public certificate search. Your prospects can now see in seconds whether you're certified.
How to show you meet it
Get Cyber Essentials Plus for your own business. It's the certification the NCSC names, and it's independently tested rather than self-assessed. Make sure the scope includes your remote management (RMM), PSA and remote access tools, because that's where attackers look first.
Write down what you already do. Many MSPs already patch, back up and monitor well but can't show it. A short security pack covering your patching timescales, backup testing, MFA policy and incident process answers most of the checklist before the prospect asks.
Put incident notification in your contracts. Agree how quickly you'll tell a client about a security incident. This lines up with the Cyber Security and Resilience Bill too, which would require medium and large MSPs to report significant incidents within 24 hours.
Lock down your own access. Use separate admin accounts, MFA everywhere and least privilege across client environments, and review and remove access you no longer need.
Test your incident plan. A plan that has never been rehearsed won't hold up when a client asks how you'd respond to a compromise of your RMM tool.
Collect case studies. The NCSC specifically suggests asking for them, so a short write-up of a client you've helped is now part of winning work.
Where we fit in
We work with MSPs in the UK and internationally as a white-label security partner. We can certify your own business to Cyber Essentials Plus, and add certification, vulnerability scanning, 24/7 monitoring and incident response to your services under your own brand. We never sell around you.
Find out more about our MSP Partnership, or read our earlier post on what the Cyber Security and Resilience Bill means for MSPs.
To talk it through, get in touch or call us on 01223 921 300.