Ask most business owners who is responsible for their cybersecurity and the answer comes quickly: "Our IT company handles that." Ask to see where the contract says so, and the room usually gets quiet.
The agreement you signed with your managed service provider (MSP), usually a master services agreement (MSA) plus a statement of work, is what decides who is responsible when something goes wrong. It is not what the sales meeting promised, and it is not what you assume a monthly fee covers. For many businesses, the gap between the two is where most of the risk sits.
You may assume your provider handles your security, backups, monitoring and compliance, and will pay if they make a mistake. Your contract may say otherwise.
What to look for in your MSP contract
These terms are common in managed IT agreements. Each one moves risk from the provider back to you.
- A statement that cybersecurity isn't included. Some agreements say plainly that the provider does not provide cybersecurity services, or that security is a separate, optional service. If you never bought it, nobody may be responsible for it.
- "No guarantee" language. The provider promises reasonable efforts and states that a breach can still happen. A breach is not automatically their failure.
- Services limited to the statement of work. Anything not listed, such as a new server, a cloud application or a second office, may be out of scope.
- A low liability cap. Liability is often limited to a few months of fees, a small fraction of what a serious incident costs.
- Excluded losses. Lost profits, downtime, lost data and lost customers are often excluded, even though they are usually the largest cost of an incident.
- Limited monitoring. Monitoring may cover only named devices or business hours, with after-hours response billed extra or not included.
- Backups are your job. You may be required to keep your own independent backup, or the provider may disclaim responsibility for lost data.
- Compliance is your job. You may be responsible for meeting HIPAA, the FTC Safeguards Rule, Texas breach laws and other requirements unless the agreement explicitly says otherwise.
- Your insurance pays first. You may be required to carry your own cyber insurance, and it may be expected to respond before the provider's.
- Declined recommendations. The provider may not be responsible for losses tied to a recommendation you didn't adopt, such as MFA or managed backup. A signed declination form makes that risk yours.
- You cover their costs. An indemnification clause may require you to pay the provider's costs for claims tied to your own actions or inaction.
- Third-party tools "as is." Security software and cloud services may be passed through from other vendors, with the provider not responsible when those tools fail.
- Hard exit terms. Long terms, transition fees or slow handover of passwords and documentation can make it costly to leave.
None of these terms is unusual, and providers use them to manage their own risk. But together they can mean much of the risk you thought you handed off is still yours. Not every agreement includes all of them, and some providers accept more responsibility than others. The only way to know is to read yours.
Outsourcing IT doesn't outsource the risk
Federal guidance makes the same point. CISA's guidance for MSP customers states that outsourcing does not relieve an organization of its risk management responsibilities, and recommends spelling out the provider's, the customer's and shared duties in the agreement. A joint advisory from CISA, the NSA, the FBI and international partners tells customers to confirm their contracts say who handles hardening, threat detection and incident response, how fast the MSP will tell you about an incident affecting your systems, and how recovery will meet your needs.
In other words: if your contract doesn't say your provider owns it, assume you do.
Why no MSP can make you compliant on its own
Even the best provider can't make your business compliant by itself. Rules such as HIPAA and the FTC Safeguards Rule place duties on the business, not just on its computers. A provider can turn on MFA, encrypt data, run backups, collect logs and produce reports. Only your business can:
- Name who is responsible. HIPAA requires a designated security official, and the FTC Safeguards Rule requires a Qualified Individual. If that person works for your provider, the Safeguards Rule still requires someone senior in your business to oversee them.
- Approve and enforce policies. Acceptable use, passwords, remote work and data handling policies only work if leadership adopts them and holds employees to them.
- Make sure people do their part. Staff have to complete training, follow payment verification steps and report suspicious activity.
- Decide what data you keep. You decide what customer and employee data you collect, who can access it and how long you keep it, and you tell your provider when people join, change roles or leave.
- Manage your other vendors. Agreements with software vendors, billing services and other partners that handle your data are yours to sign and track.
- Fund and approve the work. A recommendation that's never approved stays a gap.
- Own the response to a breach. The legal duty to notify affected people and, when required, regulators such as the Texas Attorney General belongs to your business.
Compliance is a shared program: the provider supplies the technology, evidence and guidance, and your business supplies the decisions, people and follow-through. Be cautious of any promise to "make you compliant" that asks nothing of you.
How to review your MSP contract
- Get the whole agreement. Ask for the MSA, every statement of work, any policies the agreement points to, and any declination or waiver forms you've signed.
- Turn the liability cap into dollars. Find the limitation of liability section and work out the actual number. Compare it with what a week of downtime would cost. Our article on ransomware and downtime costs can help you estimate that.
- List the exclusions. Note which losses are excluded, such as lost profits, data loss and third-party software failures, and which services are "out of scope."
- Build a responsibility list. For each area (MFA, endpoint protection, patching, email security, monitoring, incident response, backup testing, compliance and security training), write down who the contract says owns it: the provider, you, or both.
- Check what you declined. A recommendation you turned down two years ago may be the gap an attacker uses.
- Line it up with your cyber insurance. Make sure your policy, your insurer's requirements and your MSA all agree on who does what. Our cyber liability insurance page explains what insurers expect.
- Review the exit terms. Know how you get your data, passwords and documentation back if you leave.
- Have your attorney review it. Enforceability varies by state and by the facts. This article is general information, not legal advice.
Our ten questions to ask your IT provider are a good follow-up once you've read the contract.
The real gap is leadership, not paperwork
A contract can define who does what. It can't make risk decisions for you. Someone needs to look at your business, decide which risks to fix, which to insure and which to accept, and make sure leadership understands what was declined and why. In a large company, that's a chief technology officer or chief information security officer. Most small and midsize businesses don't have one, so those decisions default to whoever signs the IT invoice.
That's the case for a provider that brings CTO-level leadership and treats cybersecurity as the core of the service, not an add-on. When you evaluate one, look for:
- a written, plain-language list of what they own, what you own and what you share
- security controls such as MFA, endpoint detection and response, and tested backups built into the standard service rather than sold as options
- regular risk reviews with leadership, not just ticket reports
- recommendations tied to your cyber insurance requirements and compliance obligations
- honest answers about their own liability terms
Our guide on how to choose a managed IT provider covers the selection process in more detail.
Where to start
This week, pull your MSA and find two things: the liability cap in dollars, and every recommendation you've declined. Those two answers show how much risk you're carrying on your own.
HUFF DATA SYSTEMS provides CTO-level technology leadership, cybersecurity services and managed IT for Texas businesses. If you'd like a second set of eyes on what your current agreement actually covers, talk with our team.
Sources
- HIPAA Security Rule administrative safeguards (45 CFR 164.308), eCFR
- FTC Safeguards Rule: What Your Business Needs to Know, Federal Trade Commission
- Risk Considerations for Managed Service Provider Customers, CISA
- Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A), CISA, NSA, FBI and international partners