Do not approve an outsourced support provider on the strength of an ISO 27001 badge or SOC 2 logo alone. Verify that its assurance evidence covers the service, systems, people, locations and subcontractors involved in your arrangement, then assess the provider’s actual access to each client environment. Put the remaining requirements into the contract and record who accepts any residual risk.
Start by matching the assurance evidence to the work
A certificate or SOC report is useful only to the extent that its scope fits the service you are buying. A document covering a provider’s corporate office or a different product may not establish how its outsourced support team operates.
Ask for the current ISO 27001 certificate and scope statement, and the full SOC 2 report under appropriate confidentiality terms. For each, record the covered entity, activities, systems, locations, relevant staff, exclusions and dates. Compare those details with the support work and access routes you plan to authorize. A summary page or marketing logo cannot answer all of those questions.
How to verify an MSP’s ISO 27001 certification
Check the certificate’s validity and the associated scope statement. Confirm which entity and locations are covered, what activities are included, and whether the outsourced support service and its relevant operations fall within that boundary. Note exclusions or gaps between the certified scope and the service you intend to use. ISO 27001 certification is evidence about an information security management system within its stated scope; it does not, by itself, establish that a particular client-access arrangement is appropriate.
Recommended Free Tools
#1 Best Overall
What to look for in a SOC 2 report from an IT support provider
AICPA describes SOC 2 as an examination of service-organization controls relevant to security, availability, processing integrity, confidentiality or privacy. Which Trust Services Criteria are included depends on the engagement and report. Read the system description and identify the service and systems covered, the reporting period, included criteria, auditor-described exceptions, and any subservice organizations treated as carved out or included. Also note customer responsibilities assumed by the report: they may affect what the MSP must provide itself.
Ask the provider to explain material changes since the report period ended and any gap between that period and your proposed start date. A SOC 3 report is intended for general use and is less detailed than a SOC 2 report, so it should not be treated as a substitute when you need detailed evidence for a supplier assessment. As AICPA’s overview of service-organization engagements explains, outsourcing can bring benefits as well as risks the outsourcing organization must identify, assess and manage; receiving a report does not transfer that responsibility.
Do not treat ISO 27001 and SOC 2 as interchangeable
They are different forms of assurance, and their boundaries may differ. Review each document on its own terms, then ask whether it covers the same service and operational environment you are evaluating. One provider’s certificate is not directly comparable to another provider’s report excerpt unless you understand what each actually covers.
Compare providers on the same evidence
Use the same questions for every candidate. This helps avoid comparing a broad certificate from one provider with a narrow report excerpt from another as though they proved the same thing.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Comparison area | What to verify |
|---|---|
| Service and system scope | Does the assurance boundary include the contracted support service, relevant platforms, remote-support environment and staff performing the work? What is excluded? |
| Evidence dates | What issue date or reporting period does the document cover? Is there a gap before service begins, and what material changes has the provider made since? |
| Client access | Which roles need access, to which client systems, at what privilege and for which tasks? Can access be limited by client, approval and duration, and can activity be attributed in records? |
| Subcontractors and locations | Which subcontractors participate or handle data, where do they operate or process information, and how are changes disclosed and obligations passed down? |
| Contract and cooperation | Are incident notification, investigation support, relevant assurance evidence, assessment rights, data handling and exit obligations explicit? |
| Ongoing oversight | Will the provider report meaningful service or control changes and provide relevant evidence periodically? How will exceptions be addressed? |
Map provider access before onboarding
A provider’s assurance documents do not replace a task-by-task access review. Before granting access, map what the provider needs to do in each client environment and how you will supervise it. Canadian Centre for Cyber Security procurement guidance for SOC services delivered by MSPs and MSSPs identifies access controls and audit trails as subjects for concrete requirements.
- List the work and environments. For each support task, identify the client systems and information involved, including the remote-support route the provider will use.
- Identify the people and roles. Determine which provider roles need access and ensure activity can be attributed to an individual rather than an undifferentiated shared identity.
- Set the minimum necessary privilege. Specify what each role may do, the approval needed, and whether access can be limited to a particular task, client or time window.
- Define review and removal. Decide how the MSP or client will inspect provider activity and who will adjust or remove access when a person, task or service no longer requires it.
- Record unresolved risks. Document evidence gaps, exceptions, compensating controls, conditions for access and the person authorized to accept remaining risk.
The exact technical controls depend on the client environment and risk assessment. Do not infer that a certification proves the safety of a specific access model.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Put security duties and exit requirements in the contract
Use the service agreement and, where appropriate, a security exhibit or data-processing addendum to make expectations enforceable. Canadian Centre procurement guidance for MSP/MSSP security operations contracts and TCSA commentary on ISO supplier agreements provide relevant themes, but clauses should be tailored to the service, governing law and client commitments.
- Authorized access and confidentiality: identify permitted purposes, approved access routes and confidentiality duties.
- Incident response: define notification expectations, named contacts, practical time windows and the provider’s cooperation with investigation and response.
- Assurance and assessment: specify which current evidence the provider will supply, how exceptions or material changes will be handled, and what audit or assessment rights apply.
- Subcontractors and processing locations: require relevant disclosure, clarify how changes are notified, and require applicable security obligations to flow down.
- Data handling and exit: address permitted data use, return of data and verified destruction when the service ends.
Microsoft’s Supplier Security and Privacy Assurance Program illustrates one organization’s supplier-governance approach: for covered data, its program requires disclosure of subcontractors and processing regions, and certain contexts can trigger additional independent assurance. Those are Microsoft program requirements, not universal rules for every MSP or support provider.
Review suppliers throughout the relationship
Set an initial evidence review, then choose a risk-based check-in schedule that reflects the access granted, information sensitivity and client commitments. Reopen the assessment when the service scope or support architecture changes, a new subcontractor is involved, ownership changes, staffing arrangements shift, or assurance documents are updated. Supplier due diligence and oversight are lifecycle concerns, not one-time approval tasks.
Keep a concise, auditable assessment record with the provider and service identity, evidence received and dates, scope mapping, exceptions, access design, subcontractors, relevant contract clauses, decision owner, residual risks and next review date. That record makes the approval rationale and any conditions visible to the people responsible for the service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
