MSP Client Security Baseline 2027: 20 Essential Checks Based on CIS Controls

A Common Security Baseline for Every MSP Client

Most MSPs can tell you which clients have endpoint protection, backups, and Microsoft 365. Far fewer can answer a more useful question: which clients have the basic security practices in place, backed by evidence, and which gaps should be fixed first?

The difference matters. A tool being licensed is not the same as a control working. Multi-factor authentication may be enabled for some users but not administrators. Backups may run every night but have no recent restore test. An asset list may exist in the RMM while unmanaged devices sit outside it.

That is why every MSP needs a common client security baseline. The assessment should be short enough to run across the entire portfolio, specific enough to expose real work, and consistent enough to compare progress over time.

GetCybr’s 2027 MSP Client Security Baseline uses 20 essential checks. It is informed by CIS Controls v8.1, which CIS describes as a prioritised set of Safeguards against common attacks, and by the essential cyber hygiene approach behind CIS Implementation Group 1.

There is an important boundary. CIS Controls v8.1 contains 18 top-level Controls and 153 Safeguards. The 20 checks below are GetCybr’s curated baseline for an initial MSP-led conversation. They are not the official CIS Controls, a CIS certification, or a substitute for a complete CIS assessment.

The 20 Essential Security Checks

The checks are grouped into five practical areas. Each question should be answered with evidence, not intuition.

Know what the client has

1. Enterprise asset inventory

Can the client produce a current list of laptops, desktops, servers, network equipment, mobile devices, cloud resources, and other connected assets? The list should have an owner and a repeatable update process. An RMM export is useful evidence, but it may not show unmanaged or unsupported assets.

2. Software and service inventory

Does the client know which applications, SaaS products, browser extensions, and externally hosted services it depends on? Record the business owner, support status, and whether each item is still needed. Unknown software creates both vulnerability and data-handling risk.

3. Data ownership and location

Has the client identified where its sensitive business, customer, employee, and regulated data is stored? A useful answer names the system, data owner, access group, retention expectation, and backup arrangement. “It is in Microsoft 365” is not enough.

4. Supported technology

Are operating systems, applications, network devices, and security products still supported by their vendors? Document exceptions and replacement dates. Unsupported technology should appear as a visible business risk, not remain hidden in an engineer’s notes.

Control access

5. Account inventory

Can the client account for active user, administrator, service, shared, and third-party accounts? Compare identity-provider records with HR and application records. Look for dormant users, duplicate identities, and service accounts with no named owner.

6. Multi-factor authentication coverage

Is phishing-resistant or otherwise appropriate MFA enforced for administrators, remote access, email, cloud applications, and other high-risk systems? Record exclusions. A single legacy protocol or break-glass account can materially weaken the control.

7. Privileged access management

Do administrators use separate privileged accounts, and are powerful permissions limited to people who need them? Check standing global-admin access, local administrator rights, shared credentials, emergency access, and how privileged activity is reviewed.

8. Joiner, mover, and leaver process

Is access granted, changed, and revoked through a defined process tied to employment status and job role? Sample recent starters and leavers. The written procedure matters less than whether access was removed promptly in real cases.

Reduce preventable exposure

9. Secure configuration baseline

Are endpoints, servers, cloud tenants, browsers, and network devices configured against an approved standard? The MSP should be able to show what the baseline is, where exceptions exist, and how configuration drift is detected.

10. Vulnerability management

Does the client run authenticated vulnerability scanning or an equivalent process across its in-scope environment? Findings need risk-based targets, named owners, and verification after remediation. A scan report with no follow-through is only an inventory of problems.

11. Patch management

Are operating system, application, firmware, and network-device updates applied within defined timeframes? Review actual compliance and exceptions rather than relying on a policy statement. Internet-facing and actively exploited weaknesses should have a faster route.

12. Malware and endpoint protection

Are supported anti-malware or EDR controls deployed, monitored, and protected from casual tampering? Check coverage gaps, alert ownership, device isolation capability, and the escalation path from detection to response.

13. Email and web protection

Are malicious links, attachments, spoofing, and unsafe browsing addressed through technical controls and domain configuration? Review SPF, DKIM, DMARC, filtering, impersonation protection, and the process for reported phishing messages.

14. Network and remote-access protection

Are internet-facing services known and deliberately exposed? Check firewall governance, remote administration, VPN or zero-trust access, wireless segmentation, guest networks, and whether obsolete inbound rules are removed.

Detect, recover, and respond

15. Security logging and alert ownership

Are useful logs collected from identity, endpoints, email, cloud platforms, firewalls, and critical applications? More logs are not automatically better. The assessment should establish which events are monitored, who receives them, how long evidence is retained, and what happens after an alert.

16. Backup protection and restore testing

Are important systems and data backed up with suitable isolation, retention, and access controls? Ask for the date and result of the last restore test. Backup success notifications do not prove that the business can recover.

17. Incident response readiness

Does the client have a usable response plan with decision-makers, technical contacts, insurer details, legal escalation, communications responsibilities, and reporting obligations? Test it with a scenario. A document that nobody has rehearsed is weak evidence.

18. Security awareness and reporting

Do users receive relevant training and know how to report suspicious activity quickly? Review participation, role-specific needs, phishing-reporting routes, and what the organisation learns from real user reports. Completion percentages alone do not show changed behaviour.

Govern the work

19. Supplier and service-provider oversight

Does the client know which third parties can access systems or sensitive data? Critical suppliers should have an owner, a basic risk review, appropriate contract terms, and a route for reassessment when the service or risk changes.

20. Security ownership and review cadence

Is someone accountable for the security programme, remediation decisions, accepted risks, and reporting to leadership? Set a recurring review that covers open risks, control failures, incidents, overdue actions, and material changes. This is where a one-time assessment becomes an operating discipline.

How to Score the Assessment

A baseline should make uncertainty visible. Use four statuses:

• Implemented: the practice is defined, operating, and supported by current evidence.
• Partially implemented: some scope is covered, but an important gap or exception remains.
• Not implemented: the practice is absent or cannot be demonstrated.
• Not assessed: the evidence has not yet been reviewed. This is not the same as passing.

For each check, capture the evidence reviewed, the assessor’s note, the gap, the recommended action, the owner, and the target date. Avoid scoring from a yes/no questionnaire alone. Ask for a configuration export, policy, ticket, test record, report, meeting record, or other evidence that shows the practice exists.

The first assessment does not need to be perfect. Its job is to establish a defensible starting point and expose the next decisions.

What the Executive Report Should Say

The executive report is the commercial bridge between technical evidence and a client conversation. It should fit the way a managing director, finance lead, or board member makes decisions.

A useful report includes:

1. The overall baseline and assessment scope.
2. The strongest controls and the most material gaps.
3. The business consequence of each priority gap.
4. A short remediation plan with owners and target dates.
5. Decisions required from the client.
6. The proposed review cadence.

Do not bury the reader in framework terminology. “Privileged access is not reviewed” is clearer than a control reference on its own. You can map the finding to CIS Controls, NIST CSF, ISO 27001, or another framework behind the scenes, but the executive report should explain the decision in plain language.

How MSPs Can Use the Baseline

Run the baseline across every managed client, not only organisations already asking about compliance. It can support four useful conversations.

Client onboarding: establish the inherited risk before the MSP becomes accountable for day-to-day operations.

Quarterly business reviews: replace a tool-health summary with a security improvement discussion that has owners and dates.

Cyber insurance preparation: identify weak evidence before the renewal questionnaire or insurer follow-up arrives.

vCISO and compliance scoping: show which clients need a remediation project, ongoing governance, or a formal framework programme.

The MSP should not use a free assessment as a scare tactic. Show the evidence, explain the consequence, and give the client a proportionate next step. Some findings belong in ordinary managed services. Others need project work or an ongoing vCISO service. The distinction should be visible.

Run the Assessment and Generate the Report Free

GetCybr includes the 20-check Gap Assessment free forever for every client. Complete the baseline, record the evidence and findings, then generate a client-ready executive report at no cost.

You do not need to move a client into a paid service to produce the report. Paid plans begin when you add ongoing monitoring, audit support, managed compliance, advanced frameworks, or other delivery capabilities.

Start a free client Gap Assessment and use the executive report in your next client security review.

Methodology and Responsible Use

This baseline was designed for an initial MSP-led security review. It draws on the structure and priorities of CIS Controls v8.1, including the principle that organisations should start with essential cyber hygiene. CIS publishes the authoritative list of 18 CIS Controls and a separate Controls Assessment Specification for formal measurement.

GetCybr is not claiming that these 20 questions reproduce that specification. The baseline does not certify CIS implementation, guarantee security, or prove compliance with a client’s legal or contractual obligations. MSPs should expand the scope when the client’s size, data, threat exposure, regulation, or contractual commitments demand it.

The value is consistency. Every client starts with the same understandable questions. Every answer is tied to evidence. Every material gap becomes an owned action. And every leadership team receives a report it can actually use.