Cybersecurity Awareness Month gives managed services providers a valid reason to reach out to clients, but sharing phishing tips and MFA reminders only scratches the surface. October presents a practical deadline to answer a much bigger question: Are you and your clients actually ready for a serious incident?
Year-end projects are competing for attention. Retail and hospitality clients are preparing for their busiest weeks, while other businesses are juggling budgets and holiday schedules. Your own technicians will be taking time off, and some clients will soon restrict changes to critical systems.
Use October to check the assumptions behind your security services while there’s still time to address what you find.
Start with the access your own team holds
An MSP’s access review should begin inside its own business. Your remote monitoring and management platform, documentation system, credential vault and backup consoles can provide extensive access to client environments. Give those systems the same scrutiny you recommend to clients.
Review technician accounts, contractor access and permissions left over from completed projects. Confirm that former employees have been removed and that current employees have only the access required for their responsibilities. Check whether multi-factor authentication is enforced across administrative tools and investigate exceptions.
Then extend that review to client environments. Look for inactive accounts, unnecessary administrator privileges and temporary access that became permanent. Include service accounts and integrations, with a clear owner and purpose for each.
The practical question is simple: If an account were compromised today, how much could someone reach with it?
Review the tools and connections you depend on
Your security stack deserves a readiness review of its own. Which vendors can access client systems or data? What permissions do integrations between your tools hold? Who receives a vendor’s security notifications, and who acts on them?
A vendor review should go beyond checking whether a security document is on file. Confirm support escalation paths, review significant changes to the service and understand how you’d respond if a critical tool became unavailable or untrusted. Audit third-party API tokens and webhook integrations across your PSA, RMM and documentation platforms to ensure legacy connections aren’t lingering with elevated permissions.
Ask clients about applications they’ve added independently, too. An AI assistant connected to company files or an automation tool with broad account permissions may fall outside the systems your team routinely monitors.
You may not manage every application a client uses. You should still make those boundaries clear and help the client understand what needs attention.
Walk through an incident with the client
An internal incident response plan covers only part of the job. Your technicians may know how to investigate an alert, but does the client know who can authorize an action that interrupts business?
Schedule a brief exercise with your service lead and the client’s decision-maker. Use a realistic scenario: On a Friday evening in November, your team detects suspicious activity in an administrator account. Containment could disrupt a system the client relies on to operate.
Who can approve that action? What authority has already been granted? Who is the backup contact if the primary decision-maker is unavailable? If your monitoring partner escalates the alert, who on your team receives it?
Work through customer communications as well. Assign responsibility for the first update, establish an update cadence and prepare a template that distinguishes confirmed facts from questions still under investigation.
Finding an outdated phone number or an unclear approval process during an exercise is an easy fix. Discovering it during an incident costs time you may not have.
Verify recovery before you promise it
A successful backup job doesn’t tell you everything you need to know about recovery. Use October to restore a representative workload and confirm that the recovered data and application are usable.
Compare the results with the client’s expectations. Which systems need to come back first? How much downtime can the business tolerate? What dependencies could delay the process?
Make sure the people covering holiday shifts can find and follow the recovery instructions. Review access to backup systems and confirm that the recovery process accounts for compromised production credentials.
If testing exposes a gap between the service you deliver and the recovery the client expects, address it now. That conversation is easier when operations are running normally.
Turn the findings into an agreed action list
Give each client a concise record of what you checked, what remains unresolved and who owns the next step. Separate work covered by the existing agreement from changes that require additional approval or spending.
Keep supporting evidence current, including access reviews, recovery test results and incident exercise notes. These records can support client security reviews and show the work behind your recommendations.
Where a client defers an improvement, document the decision and set a date to revisit it. An unresolved item should have an owner, even when the owner isn’t your MSP.
Cybersecurity Awareness Month provides a useful deadline for work that can otherwise slip behind daily support demands. By the time holiday schedules begin, you’ll want tested recovery procedures, current contacts and clear responsibilities. October’s most useful deliverable isn’t another educational newsletter – it’s a completed readiness review that leads to measurable security improvements before the year ends.
