MSP Third-Party Risk Management: Securing Your Supply Chain

Your MSP manages your clients' IT environments. But who manages yours? Every vendor, tool, and subcontractor in your stack is a potential point of failure — and the trend toward supply chain attacks means third-party risk is no longer theoretical.

The Third-Party Risk Landscape for MSPs

MSPs typically depend on a significant number of third parties:

• RMM/PSA platforms — ConnectWise, Datto, NinjaRMM, N-sight
• Backup vendors — Veeam, Acronis, Datto, StorageCraft
• Security tools — SentinelOne, CrowdStrike, Huntress, Sophos
• Cloud platforms — Microsoft 365, Azure, AWS, Google Workspace
• Communication tools — Teams, Slack, Zoom
• Hardware vendors — Dell, HP, Lenovo
• Subcontractors — NOC services, helpdesk outsourcing, project resources

Each of these represents a risk. The 2021 Kaseya VSA attack compromised approximately 1,500 businesses through a single vendor vulnerability. The 2024 ConnectWise ScreenConnect vulnerabilities demonstrated that even major platforms are not immune.

Building a Third-Party Risk Management Program

Step 1: Inventory Your Vendors

Create a comprehensive register of all third parties that access your systems, handle your data, or provide critical services. For each vendor, record:

• What service they provide
• What data they access or process
• What systems they connect to
• What level of access they have
• What the impact would be if they failed

Step 2: Assess Risk

Not all vendors carry equal risk. Assess each based on:

• Access level. A vendor with administrative access to your RMM platform carries far more risk than one providing office supplies.
• Data sensitivity. Vendors handling personal information or financial data carry higher risk.
• Criticality. What happens if this vendor's service fails? Can you operate without it?
• Security maturity. Does the vendor demonstrate strong security practices?

Step 3: Require Security Evidence

For high-risk vendors, request and review:

• SOC 2 Type II report — Independent audit of security controls
• ISO 27001 certificate — Formal information security management
• Penetration test results — Evidence of vulnerability testing
• Insurance certificates — Cyber liability and professional indemnity coverage
• Incident history — Any breaches or significant outages in the past 3 years

Step 4: Include Risk Requirements in Contracts

Your vendor contracts should include:

• Security requirements and standards
• Notification obligations for incidents or vulnerabilities
• Data handling and sovereignty requirements
• Right to audit provisions
• Termination and data return provisions
• Service level agreements with remedies for non-performance

Our MSP Contract Checklist provides a comprehensive framework for vendor agreements.

Step 5: Monitor Ongoing Risk

Third-party risk is not a one-time assessment:

• Annual reviews. Reassess vendor risk annually and after any significant incident.
• Continuous monitoring. Use threat intelligence feeds to track vendor vulnerabilities.
• Incident response integration. Ensure your incident response plan accounts for vendor-related incidents.
• Exit planning. For every critical vendor, have a documented exit strategy in case the relationship ends.

Common Third-Party Risk Scenarios

Vendor Data Breach

A vendor you use is breached, exposing your data or your clients' data. Your obligations under the Privacy Act and NDB scheme may require notification even though the breach occurred at the vendor level.

Vendor Service Failure

A critical vendor experiences an extended outage that affects your ability to deliver service. Your clients hold you responsible, not your vendor.

Vendor Vulnerability

A security vulnerability is discovered in a tool you use. You must patch or mitigate quickly while the vendor works on a fix.

Subcontractor Incident

A subcontractor you use for NOC or helpdesk services causes an incident through negligence. Your contracts and oversight processes determine your liability.

Related Guides

• MSP Vendor Management Guide — Operational vendor management
• MSP Risk Management Framework — Comprehensive risk assessment
• MSP Contract Checklist — Contract risk provisions
• Cyber Insurance MSP Requirements — Insurance requirements for vendors
• Essential 8 Implementation Checklist — Security controls including third-party management