The MSP Quarterly Review: Eight Questions That Keep the Relationship Honest

For many mid-market companies, the managed service provider is the IT department, the security team, and the help desk in one contract. The same provider that manages your firewalls also grades its own homework in a quarterly deck that always looks reassuring.

That is not a reason to distrust your MSP. It is a reason to structure the review. A good provider welcomes specific questions; a weak one hides behind smooth reporting. Either way, the quarterly review is where you find out which one you have.

These eight questions work without a security team of your own. They ask for evidence, not adjectives.

Key takeaways

• An MSP's report about itself is a starting point, not oversight.

• Ask for evidence: patch rates, backup test results, alert volumes, and ticket detail.

• Verify who at the provider has admin access to your systems, and how it is controlled.

• Review the contract's security commitments against what is actually delivered.

• Keep your own inventory of what the provider can reach, so exit is always possible.

The eight questions

What percentage of our systems are fully patched, and which are not?

You want a number and a named list of exceptions, not a reassurance. Patch coverage above 95 percent with named stragglers is a healthy answer. 'Everything is current' with no list is not.

Follow up on the exceptions every quarter until they close. An unpatchable system that appears three quarters running is a risk decision your company is making without noticing.

When did you last restore one of our backups, and what did it show?

Backups that are never restored are a hope, not a control. Ask for the date of the last restore test, what was restored, and how long it took.

The companion question is scope: was it a file, a whole server, or a full environment? Each tells you something different about how bad a real incident could get.

How many security alerts did you triage for us, and what came of them?

Alert volume and outcomes show whether monitoring is real. Zero alerts in a quarter usually means the sensors are quiet for the wrong reasons.

Ask for two or three alert narratives: what fired, what the analyst found, what changed. The quality of those stories tells you more than any dashboard.

Who at your company can log into our systems, and how is that controlled?

You are trusting every technician on their roster. Ask how many people hold admin access to your environment, whether accounts are individual, and how access is removed when their staff changes.

A provider that cannot answer this quickly has an access problem that becomes your incident.

What happened to other clients this quarter that we should learn from?

Good providers see incidents across their client base and generalize the lessons. Ask what threats hit similar clients and what the provider changed as a result.

This question turns their scale into your intelligence instead of just their selling point.

Which of our security contract terms did you not fully deliver?

Put the contract's security commitments on the table: response times, review cadence, reporting content. Ask the provider to mark its own gaps before you do.

The point is not gotcha. It is keeping the written commitments alive, because contracts decay silently when nobody reads them against reality.

What are you seeing in our environment that we are not asking about?

Invite the provider to surface the risk nobody budgeted for: the aging server, the shared login habit, the office with no visitor control.

Providers often know exactly where the bodies are buried and wait to be asked. This question makes asking cheap.

If we left you, what would we need that only you hold?

Ask it politely, and ask it every year. The answer reveals lock-in: documentation that lives only in their heads, admin credentials only they hold, tooling licensed under their name.

The vendor oversight discipline and the third-party risk reporting guidance both make the same point: the ability to leave is what keeps a provider relationship honest.

The related discussion of vendor oversight is worth your time alongside this one. The related discussion of third-party risk reporting is worth your time alongside this one.

Frequently asked questions

How long should the quarterly review take?

Ninety minutes with preparation. The provider sends evidence a week ahead; the meeting is for questions and decisions, not reading slides.

What if our MSP resists these questions?

Mild friction is normal; pattern resistance is information. A provider that will not show patch rates or access lists is telling you something about what those numbers look like.

Do we need our own security person to run this review?

No. These questions are business questions with evidence attached. If the answers get too technical to judge, that is the moment to bring in independent help for a day.

A Defensible Next Step

Put these eight questions on the agenda of your next MSP review and ask for the evidence a week in advance. The quality of the answers will tell you more about your security posture than the last four decks combined. Book a Decision-Clarity Call if you want a second pair of eyes on the relationship.