What a Managed Service Provider Does NOT (Typically!) Do

Whilst MSPs offer a broad range of IT services, there are certain areas, particularly in cyber security, that typically fall outside their scope of work. Understanding these distinctions ensures all aspects of your IT and cybersecurity needs are adequately covered.

Security Awareness and Training Programs

While MSPs handle technical IT management, developing and delivering comprehensive security awareness and training programs to educate employees on cyber security best practices is usually outside their scope. These programs are essential for ensuring that all staff are vigilant and knowledgeable about the latest threats and safe practices.

Policies and Procedures

Creating and implementing detailed IT and cyber security policies and procedures often falls outside the MSP’s role. While they can advise on best practices and enforce protocols through technology, developing comprehensive policies like incident response plans and data protection strategies typically requires specialised cybersecurity expertise.

Cyber Security Strategy

A holistic cybersecurity strategy involves identifying potential threats, assessing risks, and planning long-term security measures. This strategic approach aligns cyber security efforts with business objectives and regulatory requirements. Developing such a strategy is often the domain of dedicated cyber security consultants rather than MSPs.

Incident Response Planning

Responding to complex security incidents and conducting forensic investigations to determine the cause of breaches are specialised tasks. These activities typically require dedicated cyber security experts who can handle sophisticated threat analysis and remediation.

Insider Threat Management

Detecting and managing insider threats—where employees intentionally or unintentionally compromise security—is a specialised area. MSPs may not focus on monitoring and mitigating insider threats, which requires dedicated tools and strategies to identify and address potential risks from within the organisation.