Managed service providers: what an enterprise outsources, and what it keeps

What a managed service provider is, and how it differs from IT professional services

Seven cybersecurity agencies from the US, UK, Australia, Canada and New Zealand use one definition in their May 2022 joint advisory: an MSP delivers, operates or manages ICT services and functions under a contract, such as a service level agreement. The MSP typically manages them in the customer's network, either on the customer's premises or hosted in the MSP's data center.^1,8,9,10

NIS2, the EU's cybersecurity directive, defines an MSP as an entity that installs, manages, operates or maintains ICT products, networks, infrastructure or applications, on the customer's premises or remotely. It defines an MSSP as an MSP that carries out or assists with cybersecurity risk management. Both appear in NIS2's list of regulated sectors, under ICT service management.^3,11,12

The UK's Cyber Security and Resilience Bill defines a managed service as the ongoing management of a customer's IT systems under contract. Its examples are IT outsourcing, such as remote support, helpdesks, email and application management and IT infrastructure management, and managed security services, such as a security operations center and SIEM.^13,14,15

The US General Services Administration's IT Professional Services category (SIN 54151S) covers network services, data and records management, testing, systems analysis, integration and design, programming, conversion and implementation support.¹⁶

What MSPs offer: UK managed services market figures for 2025

The UK government commissioned a count of the market from Frontier Economics, published in May 2025. It covered MSPs registered on Companies House with at least one office in the UK, whether headquartered there or overseas.^17,18

Managed service provider on CIOPages

• Managed Detection and Response (MDR) ServicesBuyer Guide
• Third-Party Risk Management (TPRM)Buyer Guide
• Enterprise Service Management (ESM) ToolsBuyer Guide
• Privileged Access Management (PAM)Buyer Guide
• Unified Endpoint Management (UEM)Buyer Guide
• RFP questions: Managed Detection and Response (MDR) ServicesRFP questions
• RFP questions: third party supply chainRFP questions
• RFP questions: migration exitRFP questions
• RFP questions: legal contracting ipRFP questions
• RFP questions: vendor profileRFP questions
• Third-party risk managementArticle
• Technology vendor managementArticle
• ITSM modernizationArticle
• Building a third-party risk programTrench Notes
• Third-party risk management checklistFree tool
• Vendor selection scorecardFree tool
• SaaS contract red flags checklistFree download

MSP pricing models: per device, per user, fixed fee and outcome-based

Kaseya, which sells software to MSPs, ran its 2023 Global MSP Benchmark Survey of providers. It found billing models fairly evenly distributed, with no single dominant model.²²

In the same survey, 28% of MSPs that price per device charge $50 to $100 per device per month, and 22% of those that price per user charge $50 to $100 per user per month. Kaseya notes that per-device billing gets more complicated as customers add phones and tablets.^30,31,32

For outcome-based contracts, FAR 37.102 makes performance-based acquisition the preferred method for US federal agencies buying services, with a firm-fixed-price performance-based contract first in order of precedence. FAR 37.602 asks agencies to describe the work by its required results, not by how it is done or how many hours it takes.^33,34,35

The NCSC says faster response times will likely raise contract costs, and that some security features may carry extra charges. DORA requires EU financial entities' contracts to state that the provider helps with an incident at no extra cost or at a cost fixed in advance.^36,37,38

MSP SLAs and contract terms the guidance asks for

The NCSC guide is written for small and medium-sized firms. It refers IT teams in organizations of more than 250 people to its more detailed cloud security guidance.⁴²

For an EU financial entity's ICT services that support critical or important functions, DORA requires full service level descriptions with precise quantitative and qualitative performance targets, unrestricted rights of access, inspection and audit, and a statement of whether subcontracting is permitted.^43,44,45

The US interagency guidance says an SLA can set the measures and responsibilities for both parties, and that the measures can be used to penalize poor performance or reward outstanding performance.^46,47

The joint advisory and CISA's Kaseya guidance list security terms the customer should write into the contract.

• Multifactor authentication enforced on every MSP account used to access the customer's environment.⁴⁸
• No reuse of admin credentials across the MSP's customers.⁴⁹
• MSP accounts kept out of administrator groups and limited to the systems the MSP manages.⁵⁰
• Who owns hardening, detection and incident response.⁵¹
• How and when the MSP notifies the customer of an incident affecting the customer's environment.⁵²
• What the customer is buying, what it is not buying, and the contingencies for incident response and recovery.⁵³

Outsourcing accountability: US third-party guidance, DORA, NIS2 and the UK bill

The Federal Reserve, FDIC and OCC issued final interagency guidance on third-party relationships on June 7, 2023. It says a bank's use of third parties does not diminish its responsibility to meet its obligations, to the same extent as if it did the work in-house.^4,54

DORA has applied since January 17, 2025. EU financial entities that use ICT services under contract remain fully responsible at all times for compliance with DORA and financial services law.^5,55

NIS2 says MSSPs have themselves been targets of cyberattacks and, because of their close integration in customers' operations, pose a particular risk. Essential and important entities should exercise increased diligence in selecting one.^56,57

The UK bill would regulate MSPs that are not small or micro enterprises, whether or not they are established in the UK, with the Information Commission as regulator. Frontier Economics estimated that 556 to 1,019 MSPs could come into scope beyond those already covered as cloud providers. GOV.UK says the bill has completed its second reading and committee stage in the House of Commons. The measure takes effect through secondary legislation after royal assent.^{58,59,60,61,62}

Canada's national cybersecurity agency (CCCS) tells buyers of managed services that the customer is the data owner and is legally responsible for data security.⁶³

MSP supply-chain attacks: Kaseya VSA, Cloud Hopper and the 2022 joint advisory

In May 2022 the seven agencies cited reports of an increase in malicious activity targeting MSPs and said they expect the trend to continue. A vulnerable MSP gives an attacker initial access to many customer networks at once, with cascading effects.^7,64

From July 2, 2021, CISA and the FBI responded to ransomware attacks that exploited a vulnerability in Kaseya's on-premises VSA software against MSPs and their downstream customers. Kaseya reported fewer than 60 of its customers directly compromised, all on VSA on-premises, and an impact on fewer than 1,500 downstream businesses.^65,66,67,68

CISA told affected customers whose RMM service was down to revert to manual patch management. It also told MSP customers to feed log files and network monitoring data from the MSP's infrastructure into their own detection systems, for independent correlation.^69,70,71

The UK government cites two cases. Operation Cloud Hopper compromised multiple MSPs. In May 2024, an incident involving an MSP let attackers target the UK defense ministry's payroll and put the personal data of around 270,000 serving personnel, reservists and veterans at high risk.^72,73

Verizon's 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches, up 60% on the previous year's dataset.⁷⁴

MSP exit terms, and where IT outsourcing goes wrong

DORA requires exit strategies for ICT services that support critical or important functions. The exit plans must be documented, tested and reviewed periodically, and the contract must set a mandatory transition period during which the provider keeps delivering the service.^75,76,77

The US guidance asks for termination and notice terms with reasonable time frames for an orderly transition without prohibitive expense, and for the timely return or destruction of the customer's data. DORA adds termination rights with minimum notice periods.^78,79,80

• MSP accounts left active after the contract ends. The joint advisory says disabling them can be overlooked when a contract terminates.⁸¹
• Responsibility left implicit. The NCSC recommends a matrix of what the MSP does and what the customer does, and clear agreement on who is accountable for vulnerabilities, damages and incident impacts.^82,83
• Assuming the provider shares your priorities. An MSP serves many customers, so the CCCS warns that its priorities will differ from yours.⁸⁴
• Service levels that reward the wrong thing. US regulators warn against measures that encourage volume or speed without regard for accuracy.⁸⁵
• Lock-in. The CCCS defines it as the point where moving data to another provider is not financially feasible, because of penalties, proprietary formats or data ownership.⁸⁶
• End-of-life systems nobody tracks. The NCSC says the contract should name who tracks end-of-life dates and acts before support ends.⁸⁷
• Hidden concentration. The US guidance flags dependency on a single provider for multiple activities, and the joint advisory tells customers to understand their MSP's own subcontractors.^88,89