MSP Due Diligence: Certification, Contracts and Insurance Pay Out After the Outage, Not During It

Good MSP due diligence checks certification, contracts and insurance, then goes further and asks who will do the work when something breaks. A certificate attests to a process, a contract assigns responsibility, and a policy pays after a loss. None of them staffs the on-call bench or restores your systems, so delivery capacity has to be part of the review.

Those three documents are often presented as the mark of a mature provider. They are worth having. They are also all built to document and transfer risk, which is a different job from preventing and fixing outages.

What the paper trail proves in MSP due diligence

Document	What it shows	When it helps you	What it can't do
Certification	A process existed and was audited	Before you sign	Guarantee the process runs every day
Contract	Who is responsible for what	During a dispute	Shorten an outage
Insurance	Some financial loss is transferred	Weeks or months after an incident	Restore a single system

Each one is useful. Each one points at protecting balance sheets after something goes wrong. That is why MSP due diligence that stops at the paperwork leaves the most expensive part of an incident unexamined.

Insurance pays after the fact

A cyber policy is risk transfer, and what it covers varies by policy. Payouts depend on the policy terms, and many policies ask what security practices are in place before they will cover a loss. Even when a claim pays, the check arrives after the recovery work is done, and someone still had to do that work.

Certification in MSP due diligence is a snapshot

An audit confirms that controls existed during the review period. It does not guarantee an engineer is free at 2 a.m. when an alert fires next spring. Treat certification as a floor in your MSP due diligence, not as proof of outcomes.

The wording matters too. The AICPA titles its guide "SOC 2 Reporting on an Examination of Controls at a Service Organization," which is a report on a CPA firm's examination, not a certificate. Ask for the report itself and read the period it covers and any exceptions the auditor found. The standard is also moving: since this note was first published, the AICPA has released exposure drafts of proposed 2027 SOC 2 Trust Services Criteria, dated October 26, 2026.

The outage is where the cost lives

The costs that hurt most during an incident are rarely the ones anyone writes down. The FBI's Internet Crime Complaint Center says in its 2025 annual report that its ransomware loss figure "does not include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services." In other words, the downtime itself sits outside even the official tally.

During that downtime, a certificate does nothing, a contract clause does nothing, and an insurance check has not arrived yet. The only thing that ends an outage is people: engineers on call, a tested runbook and enough spare capacity to run the recovery while still serving everyone else.

One compromised tool, many downstream businesses

The July 2021 attack on a widely used remote management tool shows the stakes. The National Counterintelligence and Security Center described how attackers released "a fake update that propagated malware" through managed service providers to their downstream companies, affecting approximately 1,500 businesses. The Associated Press reported the same upper figure, and Reuters put the range at 800 to 1,500 businesses worldwide. Those providers had contracts. Recovery still came down to who could restore each client's systems, and how fast.

MSP due diligence questions that test delivery

Paper and people answer different questions, and a review needs both columns.

Add these to your review alongside the certificates and the policy:

1. Who staffs the bench? Ask for the size of the on-call rotation and how nights, weekends and holidays are covered.
2. Is your environment isolated? Shared infrastructure across many tenants means one bad night can take everyone down at once.
3. How does capacity grow? When you add work, does the provider add people, or does your name join a longer queue?
4. When did they last test a restore? Ask for the date, the scope and how long it took.
5. What happens in the first hour? Ask them to walk through the runbook for a ransomware alert on one of your systems.
6. Who answers if the main contact leaves? Named backups beat a general support queue.

MSP due diligence for white-label work

If you are an agency reselling a provider's services under your own name, your client never sees the partner. When an incident drags, the client blames you. Vet only the paperwork and you end up insured against the partner's failure rather than protected from it. Thorough MSP due diligence protects your reputation as well as your client's systems.

Where LTFI fits

Certification, sound contracts and coverage are table stakes, and a mature provider should carry them. LTFI answers some of the delivery questions directly. Each company gets its own server, which Kief Studio hosts, patches and watches, with no other business's data on it, so it never shares a bad night with other tenants. Anything that sends, posts, publishes or spends waits for a person's approval, and the activity log records every action and who said yes, which is the kind of evidence good MSP due diligence asks to see. Our Harden layer explains how the server is kept locked, and our partner program covers how an MSP or agency can refer a client or offer LTFI under its own brand. For the contract side, see the partnership clauses that separate real partners from resellers. To walk through your current provider review, talk to us.

Frequently asked questions