What should I ask about the remote monitoring tools an MSP uses?

These platforms can install software, change settings and reach every client device they manage. That is a great deal of trust placed in one place, so the first question is who controls it. Ask how many people hold administrator rights, how sign-in is protected, and whether the account is in the company’s name or an individual’s.

Next, ask about the commercial side. Which vendor is each tool bought from, how is the price set, when does it renew, and does the agreement allow a transfer to a new owner? Have your lawyer read those terms. Ask whether any client contract names a tool, which could make a switch awkward.

Then ask about practice. How are alerts triaged, who responds, and are the rules tuned or left at defaults? How are client groups separated, so a mistake in one does not hit all? Ask for an example of a recent incident handled through the tool. Finally, ask what you would need to rebuild if the vendor vanished, and whether the current team could do it. The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations, such as two-factor authentication and limited administrator rights, are a useful yardstick.

Key takeaways

• Find out who holds administrator rights and how they sign in.
• Confirm the contracts are in the firm’s name and can transfer.
• Ask how alerts are triaged and how client groups are kept apart so one error cannot reach everyone.
• Check what a forced switch of tools would involve.