SMSMC Blog
MSP Oversight & Vendor RiskOctober 2026 · 7 min read

Why MSPs and specialist firms team with an independent governance lead

Clients keep accountability for risk even when an MSP runs their IT. Here is how an MSP, specialist firms and an independent governance lead split the work in writing, and why all three gain.

By Jim Venuto

An MSP’s customer asks for a security program, a board report, an answer to a cyber-insurance questionnaire or a regulator’s checklist. The MSP runs the endpoints, the help desk and the network well. What the customer is asking for now is something else: someone to set direction, own the risk story in front of leadership, and check that the controls work, including the ones the MSP operates.

This post is for MSPs, penetration-testing and OT/ICS firms, and incident-response specialists. It sets out why that request is real, what the regulators and standards bodies say about it, and how an independent governance lead can sit above the stack without competing for it.

The customer cannot hand accountability to the MSP

U.S. government guidance is plain on this. CISA’s Risk Considerations for Managed Service Provider Customers (September 2021) says outsourcing IT to an MSP “does not absolve an organization from risk management responsibilities associated with the IT enterprise”. The same guidance keeps network access policy, controls and logs as “the organization’s responsibility” and suggests that organizations without the expertise to assess MSP risk “could hire an independent consultant to provide that analysis.”

The 2022 joint advisory from CISA, NSA, FBI and their Five Eyes partners, Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A), asks for contracts that “transparently identify ownership of ICT security roles and responsibilities,” require MFA “on all MSP accounts used to access customer environments,” and say how and when the MSP reports an incident.

NIST’s Cybersecurity Framework 2.0 (February 2024) puts the same idea in its Govern function. GV.RR-01 says organizational leadership “is responsible and accountable for cybersecurity risk.” GV.SC-02 asks that cybersecurity roles and responsibilities “for suppliers, customers, and partners” be “established, communicated, and coordinated internally and externally.” NIST SP 800-161r1 describes a “shared responsibility model, which distributes responsibilities and accountabilities” among the parties.

Put together: the customer needs someone on its side of the table who owns the program, writes the roles down and verifies the work. The MSP cannot credibly grade its own homework, and its customer’s auditor, insurer or regulator increasingly knows that.

No one firm covers every skill

The skills picture makes teaming the normal answer, not the exception:

  • ISACA’s State of Cybersecurity 2025 reports that 55 percent of cybersecurity teams are understaffed and 65 percent have unfilled positions.
  • The 2025 ISC2 Cybersecurity Workforce Study, with 16,029 respondents, found 59% cited critical or significant skills needs, up from 44% in 2024.
  • The World Economic Forum’s Global Cybersecurity Outlook 2025 found that 49% of organizations said they lacked the workforce to meet their cybersecurity objectives, a shortfall it describes as predominantly affecting the public sector.
  • CompTIA, the IT industry’s trade association, reported in its IT Industry Outlook 2025 release that 90% of channel firms are partnering with peers in response to growing technical complexity.

A town, a school district or a 200-person firm needs operations (the MSP), occasional deep specialists (testing, OT, incident response) and continuous leadership (governance). Few customers can hire all three, and few providers can staff all three well.

Who does what: a working split

RoleOwnsDoes not do
MSPDay-to-day IT and security operations: endpoints, patching, identity administration, backups, monitoring tools it runsGrade its own controls for the board, insurer or regulator
Specialist firmsScoped technical work: penetration tests, OT/ICS assessments, incident response, forensicsSet the customer’s program priorities
Independent governance leadProgram direction, risk register, policies, board and regulator reporting, vendor oversight, verification of what the others deliver (CSF 2.0 Govern)Run the stack, sell managed services or take the MSP’s work
Customer leadershipRisk decisions and acceptance, budget, final accountability (GV.RR-01)Delegate that accountability away

The governance lead turns each specialist’s report into decisions and work orders, and checks that the MSP closed the items. CISA’s MSP guidance asks for exactly that separation: service-level agreements with “a clear delineation of operational IT services and security services,” disclosure of subcontractors, and customer access to security logs.

Why each party gains

The MSP keeps the stack and the monthly relationship, and gains a partner that turns its work into evidence the customer’s board, insurer and auditor accept. Projects the governance review identifies (MFA everywhere, log retention, backup testing) are usually the MSP’s to deliver.

Specialist firms get scoped, well-prepared engagements: a clear question, the right contacts, and someone who makes sure findings are acted on rather than filed.

The customer gets one accountable program, written roles and an independent view, which is what CSF 2.0 and CISA describe.

The governance lead stays independent because it does not operate what it reviews. That independence is the product.

Put the roles and shares in writing before the first meeting

Teaming fails on ambiguity, not on skill. Before you approach a customer together, agree a short partner agreement and a work order that cover:

  1. A responsibility matrix for the customer (who owns hardening, detection, incident response, patching, backups and reporting), mapped to CSF 2.0 categories so it reads the same to every auditor.
  2. The commercial model. Three common ones: the MSP resells governance on its own paper; the MSP engages the governance lead on the governance lead’s paper; or the customer engages the governance lead directly to oversee its MSP. Say who invoices, who holds the customer contract and how any fees are shared.
  3. Non-solicitation both ways. The governance lead does not sell managed services or take the MSP’s operational work; the MSP does not reposition its own staff as the customer’s independent reviewer.
  4. Access and data handling: MFA on every partner account, least privilege, where customer data may be stored, and how partner access ends (CSF 2.0 GV.SC-10 covers activities “after the conclusion of a partnership or service agreement”).
  5. Incident roles. GV.SC-08 asks that relevant suppliers be “included in incident planning, response, and recovery activities.” Agree who calls whom, and in what order, before an incident happens, and exercise it together.
  6. How findings about the MSP are reported. Agree that issues go to the MSP first with a fair window to fix them, and that the customer still sees the result. Independence that surprises a partner is a broken partnership; independence that hides findings is no independence at all.

Where SMC fits

Security Medic Consulting is an independent governance practice. Jim Venuto founded it after a career leading security, privacy, GRC and CISO-level work for mid-size and large enterprises and public bodies. SMC does not sell managed services, run a SOC or resell hardware. It provides the governance layer above the stack and works alongside MSPs, testing and OT specialists, incident-response firms, prime contractors and M/WBE firms on the work each does best. That network of partners is the SMC Partner Network, which SMC calls the bench.

If you run an MSP or a specialist firm and your customers are asking for governance, board reporting or regulator-ready evidence, the Security Medic MSP partner page explains the engagement models. To talk through a specific customer or a standing partnership, Book a free 30-minute call, or write to support@securitymedic.com.

Sources

Tags#msp#msp-partner#nist-csf-2#guide#smb#sled