Cyber Essentials for MSPs and IT providers

Do MSPs need Cyber Essentials?

Yes, in practice. An MSP needs its own certificate because clients, prime contractors and public bodies pass their Cyber Essentials obligations to the provider that administers their systems.

An MSP holds administrative access to dozens of client environments from a single set of technicians and tools. That makes it a high-value target and a high-value assurance point: a client that wants to know its estate is secure needs to know the MSP's estate is secure. Clients increasingly ask for the MSP's certificate, and prime contractors and public bodies flow their own Cyber Essentials obligations to the IT provider that administers the supplier's systems.

Two public sector sources now tell customers to check. The NHS Data Security and Protection Toolkit asks health and care organisations to confirm that their IT suppliers, and their IT support company, hold appropriate certification (evidence item 10.2.1), and its guidance names Cyber Essentials, ideally Plus. The DfE's cyber security standards for schools and colleges suggest schools ask an outsourced IT provider whether it holds Cyber Essentials or Cyber Essentials Plus.

There is a commercial reason too. MSPs that hold Cyber Essentials Plus and can take clients through certification have a repeatable product. Certificates are renewed annually, so an MSP that manages renewals across a client base has a steady annual workload.

What does v3.3 say about MSP accounts and devices?

Two rules matter. First, accounts: all accounts that the client organisation owns are in scope, even when a supplier, contractor or MSP uses them to manage or support the infrastructure. The client must be able to confirm the technical controls are met for those accounts and demonstrate it in the assessment. That means MSP administrator accounts in the client's tenant need MFA, unique credentials per technician, separation from day-to-day use and a documented approval process, and the client must be able to say so at A7.2 and A7.5.

Second, devices: the v3.3 third-party devices table puts MSP administrator devices out of the client's scope. The client stays responsible for confirming that devices interacting with its data are configured correctly, but it cannot certify them. Only the MSP's own certificate covers them.

What should an MSP's own scope look like?

Whole organisation. Technician laptops, the RMM and PSA platforms, the documentation system holding client credentials, the remote access tooling, the email tenant and every cloud service. Sub-sets are possible but rarely sensible for an MSP, because the sensitive part of the business is the administrative tooling, and excluding it defeats the purpose.

Cyber Essentials Plus is the right level. The audit tests the MSP's own devices for patching, malware protection and account separation, and observes MFA on its cloud services from an untrusted session. Those are the controls a client most wants to know about.

How does an MSP prepare clients?

Standardise. The Plus test specification samples devices and notes that where organisations use standardised configurations, much of the estate can be covered by a small number of representative samples. An MSP that deploys the same build, the same endpoint protection and the same patching policy across a client can reduce a Plus audit to a handful of devices.

For each client, the MSP should be able to hand over: the device inventory with operating system versions (A2.6, A2.7, A2.8), the software support list, evidence that critical and high-risk updates are applied within 14 days, the list of cloud services with MFA enforcement status, the administrator account register and the firewall rule log. Those artefacts answer most of sections A2 and A4 to A8.

What about sub-sets and unsupported client systems?

Clients often run something unsupported: an old server hosting a line-of-business application, a lab network, a legacy print controller. v3.3 allows unsupported software to be removed from scope by placing it in a defined sub-set that prevents all traffic to or from the internet. The MSP designs and implements that segregation, and for Plus the assessor verifies it by technical means before testing starts. Document the firewall or VLAN rules so the verification is quick.

Will MSPs be regulated?

Not yet. The Cyber Security and Resilience (Network and Information Systems) Bill would bring medium and large managed service providers that meet its definition of a "relevant managed service provider" into the NIS Regulations 2018, with duties to secure the systems they use to deliver services and to report significant incidents. The government's factsheet on relevant managed service providers sets out the proposal. The bill completed its House of Lords third reading on 2 November 2026 and had not received Royal Assent when checked on 3 November 2026.

The bill does not require Cyber Essentials. An MSP that already runs the five controls across its own estate, and holds Plus, has the technical baseline in place whatever the final security duties turn out to be.

How much does Cyber Essentials cost an MSP?

The IASME scheme fee is £320 to £600 ex VAT by headcount for each certifying entity. Precursor's Cyber Essentials is from £1,500 with the fee included, and Cyber Essentials Plus from £3,000 with a free re-test included. MSPs certifying several clients in a year should book a scoping call to agree a repeatable process rather than treating each one from scratch.