Managed service provider (MSP)
A managed service provider (MSP) is an outside company you pay to run or support your IT. Under Cyber Essentials v3.3 the accounts your MSP uses are in scope, you must show the controls are met on anything they manage, and the person named at A2.10 must be a member of your organisation.
- Term
- Managed service provider
- Also known as
- MSP, IT support company, Outsourced IT
- Category
- Malware, cloud and threats
- Requirement area
- D(v) Accounts used by third parties
- Reviewed against
- Requirements v3.3
What does the term managed service provider mean in Cyber Essentials?
A managed service provider (MSP) is an outside company you pay to run or support your IT.
All accounts that your organisation owns are in scope, even when those accounts are used by a third party, such as a supplier, contractor or Managed Service Provider (MSP) to manage or support your infrastructure.
How does managed service provider apply to Cyber Essentials?
In plain terms
An MSP is your outsourced IT department. Instead of employing an IT manager, you pay a firm to set up new starters, apply updates, fix problems and look after your systems, often remotely. They hold the keys to much of your IT, which is why Cyber Essentials cares how those keys are used.
What Cyber Essentials asks
The requirements put MSP accounts in scope, in the wording quoted above, and add: "If you’re using externally managed services (such as remote administration), you must be able to confirm that the Cyber Essentials technical controls are being met and be able to demonstrate this in your assessment answers."
- A2.10 asks who is responsible for managing your IT systems. That person "must be a member of your organisation and cannot be a person employed by your outsourced IT provider."
- A4.9 asks whether your firewall settings can be reached over the internet, for example to let "an IT support company" change them. If yes, A4.10 needs a documented business need and A4.11 needs MFA or an IP allow list.
- The user access control questions (A7.1 to A7.9) apply to MSP accounts like any other.
Devices are covered by Table 2 of the requirements: an MSP administrator's device is in scope if your organisation owns it and out of scope if the third party owns it.
Common mistakes
- One shared login for the whole MSP team. A7.2 says "Accounts must not be shared."
- Answering without checking with the MSP. The answers are validated by someone in your organisation, typically a director, before submission.
See third-party accounts and MSPs. Related: supply chain security, shared account.
Related terms
- Supply chain securitySupply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in.
- Shared accountA shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
- PaaS (Platform as a Service)Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
- Penetration testA penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
- PhishingPhishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
Frequently asked questions
A managed service provider (MSP) is an outside company you pay to run or support your IT. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, managed service provider comes up at A2.10, A4.9. Read those questions against the definition above so your answers use the term the way the assessor will.
Managed service provider relates to D(v) Accounts used by third parties in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.