ISO 27001 for MSPs and IT support companies: for you and for your clients
If you run an MSP or IT support company, ISO 27001 reaches you from two directions. Your own clients and prospects ask whether you are certified, because you hold the keys to their systems. And your clients ask you to help them get certified, because their customers are asking. The two questions need different answers: for the first, you build and run your own ISMS; for the second, you can help a great deal without turning into a compliance consultancy.
Why clients ask their MSP about ISO 27001
From a client's point of view, an MSP is one of the highest-risk suppliers they have. You typically have:
- Admin rights across their Microsoft 365 or Google Workspace tenant, servers and firewalls.
- Remote management and monitoring (RMM) agents on every device, able to run scripts as the system account.
- Remote access tools that let your engineers reach any machine.
- Backups of their data, often in your own cloud accounts.
- Credentials in your password vault and documentation platform.
Attackers know this. Compromising one MSP can open the door to many clients at once, which is why the NCSC's supply chain guidance treats managed service providers as a supplier to look at closely.
So the questions come in several forms:
- Supplier assurance questionnaires from clients who are themselves going through ISO 27001, Cyber Essentials or a customer audit. If your client is certified, their auditor will ask how they manage you as a supplier.
- Tender requirements that ask for ISO 27001 or Cyber Essentials from any supplier with access to systems or data.
- Renewals and insurance, where a client's insurer or board wants evidence about their IT provider.
A certificate doesn't remove these questions, but it answers a large share of them at once and gives you a consistent, evidenced reply for the rest. Without one, every questionnaire is a fresh piece of work.
What your own ISMS scope looks like
Your scope is the part of the business the ISMS covers. For most MSPs it's the managed service itself: the people, tools, offices and suppliers you use to support clients. Leaving out the service desk or the RMM platform to make the scope smaller usually defeats the point, because that's exactly what clients are worried about.
ISO 27001:2022 lists 93 controls in Annex A. You decide which apply and why in your Statement of Applicability, based on your risk assessment. For an MSP, these areas carry most of the weight:
| Area | Annex A controls | What it looks like in an MSP |
|---|---|---|
| Privileged access | 8.2 Privileged access rights | Named admin accounts per engineer, no shared logins, MFA everywhere, access granted per client and removed when people leave or change role |
| Logging | 8.15 Logging | Logs from your RMM, remote access, password vault and client admin portals kept and protected, so you can show who did what in which client |
| Monitoring | 8.16 Monitoring activities | Alerts for unusual activity, such as a script pushed to every client or a login from a new country, and someone who acts on them |
| Your suppliers | 5.19 to 5.22 (supplier relationships, agreements, ICT supply chain, monitoring and review) | Your RMM, PSA, remote access, backup and security vendors assessed, contracted with security terms, and reviewed on a schedule |
| Cloud services | 5.23 Information security for use of cloud services | Clear rules for how you buy, configure and exit the cloud services you run your business and your clients' services on |
Beyond Annex A, an auditor will look at the management system around it: your scope, risk assessment, Statement of Applicability, policies, internal audit, management review and how you handle nonconformities. That part is the same for an MSP as for anyone else.
The risks worth writing down first
- A compromised RMM or remote access tool used to push malware to every client.
- A compromised engineer account with standing admin rights across many tenants.
- A supplier breach at one of your tool vendors.
- A leaver who keeps access to client systems or the password vault.
- Backups that can be deleted by the same credentials an attacker would steal.
- Too much riding on one person who knows how everything is set up.
Each one should have an owner, a treatment and a way of checking that the treatment still works.
Evidence you already have
MSPs are in a better position than most here. Your PSA holds tickets and change records, your RMM holds patch and device reports, and your password vault and identity provider hold access logs. ISO 27001 mostly asks you to decide how you work, write it down briefly, give each part an owner, and keep the reviews happening: access reviews, supplier reviews, restore tests.
Cyber Essentials first?
Many MSPs, and many of their clients, start with Cyber Essentials. It covers five technical controls, is checked by a certification body, and is often the minimum for UK public-sector work. It doesn't cover suppliers, incident response, risk management or the management system, so it isn't a substitute where ISO 27001 is asked for. It is a sensible first step, and for a client with a public-sector contract it may be what they need this year. See Cyber Essentials with ClearIMS.
Helping clients without becoming a consultancy
Once clients know you can talk about ISO 27001, some will ask you to "do it for them". Before you say yes, it's worth being clear about what the work involves.
What a client's ISMS needs that you can't supply
A large share of an ISMS isn't IT. The client has to decide its own scope and risk appetite, its top management has to approve the information security policy and take part in management review, risk owners have to accept their own risks, and the business has to run internal audits and act on findings. You can support all of that, but you can't own it. If the MSP ends up holding the ISMS, the client usually struggles at audit, because the auditor wants to see the client's management running it.
Becoming a consultancy also changes your business: different skills, different liability, project work that doesn't recur the way managed services do, and time taken from your service desk.
What you're well placed to do
- Own the technical controls you already run: patching, backups, endpoint protection, MFA, device management, logging. Give the client evidence on a schedule.
- Answer supplier questions about yourself quickly, from your own ISMS.
- Advise on technical risk treatments when the client works through its risk register.
- Join the client's management review when IT topics are on the agenda.
Two practical ways to help
Refer them. Point the client to a tool or provider that helps them build and run their own ISMS, and stay their IT provider. You keep the relationship; they get help with the parts that aren't IT.
Work in their ISMS alongside them. If the client uses a platform you can be added to, you can do your part directly: upload evidence against the controls you run, pick up tasks assigned to you, and comment on risks. The client stays in charge of approvals. This works best when the platform lets you move between clients without a separate login for each.
How ClearIMS helps
ClearIMS is for businesses that need ISO 27001 without building a compliance team. Describe the business in plain English and it drafts the scope, risk register, Statement of Applicability, policies and tasks; a named person approves every record, and the AI never approves anything. For MSPs, an adviser can work in their clients' ClearIMS alongside them, across several clients from one login, and a client can add you as a user (users are unlimited). If you introduce a client, our referral scheme pays 20% of that customer's first year once they've paid, with no targets, exclusivity or reseller pricing, and you keep the client relationship.
We make the software. Your certification is yours, awarded by your certification body.