How do I review an MSP’s documentation of client networks and passwords?

Pick clients at random rather than letting the seller choose. For each, ask for the network diagram, the list of devices and the vendor contacts, then have a technician confirm one or two details on site or remotely. If the diagram and the reality disagree, assume the rest of the file is equally loose.

Passwords deserve their own look. Ask where credentials are kept, who can open the vault, and whether access is logged. Shared spreadsheets, sticky notes and personal accounts are warning signs. Ask how a departing technician’s access is removed, and when that last happened. Check dates too. Documentation written at set-up and never touched since describes a network that no longer exists, so look for recent edits, and ask who is responsible for keeping each client’s file up to date.

Then ask what the client has agreed about these records. Some clients expect to own their documentation and may want it handed back if the firm changes hands. Ask your lawyer to read the service agreements for who holds what, and ask the seller how clients have reacted when records were requested. Finally, plan the transfer. Decide which credentials you will change on day one, who does it, and how you will tell clients so the change reads as care rather than alarm.

Key takeaways

• Sample several clients at random and test the documents against the real network.
• Look at how passwords are stored, who can open them and whether access is logged.
• Ask your lawyer who owns the records under each client contract.