--- title: Managed service providers canonical: https://www.secnostic.com/en/solutions/msp language: en dateModified: 2026-08-23 alternate-de: https://www.secnostic.com/de/solutions/msp --- # Managed service providers - URL: https://www.secnostic.com/en/solutions/msp - Audience: Operations across many tenants - Positioning: Scale MSP operations secnostic connects IT and OT environments, assets, risks, and evidence, cleanly separated per tenant. MSP teams work from a current technical view of each customer environment. **Many tenants, one control plane** A compromise of your tooling otherwise hits every client at once, which is exactly why [MSPs are a high-value target](https://www.cisa.gov/sites/default/files/publications/AA22-131A_Protecting_Against_Cyber_Threats_to_MSPs_and_their_Customers.pdf). Admin access therefore runs on [least privilege](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp) and just-in-time, and the coverage evidence you keep for clients also covers your own [NIS2 duty](https://eur-lex.europa.eu/eli/dir/2022/2555). **Situation.** MSPs work across many customers, IT/OT environments, and tool stacks. Without a shared data baseline, every ticket, inventory question, and vulnerability advisory turns into manual lookup work. **Challenges** - keep tenants cleanly separated without trapping service teams in tool silos - IT/OT assets, tickets, backup, identity, and security data sit in different places for each customer - unknown devices, missing agents, and outdated systems stay hidden between RMM, MDM, EDR, and OT networks - service scope and technical reality drift apart when assets, sites, and ownership are not maintained together **Approach.** secnostic sets up an isolated tenant per customer, structures IT/OT assets and service context, and turns that into repeatable workflows for onboarding, triage, coverage checks, security services, and evidence. **Outcomes** - faster ticket triage from one shared customer scope - a tenant-clean inventory for IT and OT assets - repeatable routines for onboarding and reconciliation - a tenant-clean view of EDR, MDM, identities, and vulnerabilities **One graph per tenant** Each client gets a separate tenant. RMM, EDR, MDM, backup, identity, and passive observations from OT networks deliver the raw data that the inventory graph condenses into one record per asset, with owner, site, zone, and coverage. From there come a current IT/OT estate, the coverage-gap list, and the tasks for focusAlert. No client sees another's data, and admin access stays scoped to one tenant and one role through RBAC and just-in-time elevation. **In practice, per tenant** Repeatable flows across many clients, without mixing data. - **Onboard a client**: Create tenant: A separate workspace with IT/OT scope, sites, roles, and ownership.; Connect sources: RMM, EDR, MDM, and identity deliver raw data without replacing anything at once.; Baseline in days: The sensor builds an inventory passively, including OT, without agents everywhere.; Hand over: The client has a dependable picture fast, instead of a weeks-long survey. - **Keep the IT/OT estate current**: Observe: RMM, EDR, MDM, and sensing continuously deliver new or changed assets.; Place: Each asset is mapped to tenant, site, IT/OT zone, owner, and lifecycle.; Reconcile: Conflicting sources and missing coverage become concrete data gaps.; Track: Open clarifications and actions stay linked to the asset until they are resolved. - **Close a coverage gap**: Find: Endpoints with no EDR, unmanaged in MDM, or at end-of-support become visible per client.; Place it: The gap is tied to criticality, site, and owner.; Act: The task goes to the service team, with context instead of a screenshot.; Prove: Before and after stay traceable for the client and for evidence. - **Secure admin access**: Roles: Every action is scoped by RBAC to one tenant and one role.; Just-in-time: Elevated rights apply only to the task and the time window.; Separate: A technician sees and touches only the assigned client.; Audit trail: Who did what in which tenant stays documented and tamper-evident. **What stays hidden without shared asset context** Separate tools, coverage gaps, and unclear ownership weaken operations. - **Tooling as an entry point**: Privileged RMM access across many clients turns one compromised console into a risk for all of them. - **Operational evidence by hand**: Asset coverage and risk evidence stay incomplete when they are assembled from separate exports. - **Unclear coverage**: Endpoints with no EDR, unmanaged in MDM, or at end-of-support stay invisible per client. - **Service scope drifts from reality**: IT/OT scope and real assets diverge when sites, networks, and ownership are not connected. **Deployment steps** 1. **Create tenant and scope**: Each customer gets a dedicated workspace with IT/OT scope, sites, network areas, roles, and ownership. 2. **Connect data sources**: RMM, identity, EDR, MDM, backup, cloud, scanners, and passive observations from OT networks provide raw data without forcing immediate tool replacement. 3. **Normalize assets**: Duplicate, stale, and conflicting records become a customer scope with owners, criticality, lifecycle, and service context. 4. **Run service work**: Tickets, changes, vulnerabilities, backup checks, access reviews, and onboarding tasks use the same context. 5. **Deliver evidence**: Dashboards, asset coverage, risk registers, and evidence are generated from operating data instead of manually combined exports. **What becomes visible** - **Customer tenant**: An isolated view of IT/OT assets, sources, roles, service boundaries, and open data-quality questions for each customer. - **IT/OT service scope**: Connects real assets with site, network area, ticket history, backup coverage, ownership, and service state. - **Security view**: Shows missing agents, EDR and MDM coverage, privileged accounts, vulnerabilities, EOL/EOS, and critical exposure. - **Operational evidence**: Keeps inventory, coverage, risk, open actions, and technical decisions traceable for each tenant. **FAQ** - Q: Does secnostic replace RMM or security tools? A: No. secnostic adds shared tenant, IT/OT asset, and evidence context around RMM and security tools. Existing tools remain data sources and day-to-day work systems. - Q: How are customer records separated? A: Each customer is managed as its own tenant with its own sources, roles, reports, and evidence. MSP teams can reuse standards without mixing customer data. - Q: Where should an MSP start? A: Usually with one representative customer or demo tenant: IT/OT scope, key sources, asset baseline, coverage checks, and roles are set up cleanly first. - Q: Does this help security services too? A: Yes. EDR, MDM, identity, backup, and vulnerability data are connected with asset context so prioritization, customer communication, and evidence get faster. **Sources** - [NCSC choosing a managed service provider](https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp): NCSC guidance for choosing a managed service provider and assessing security, access, and responsibilities. - [CISA/NSA MSP security advisory](https://www.cisa.gov/sites/default/files/publications/AA22-131A_Protecting_Against_Cyber_Threats_to_MSPs_and_their_Customers.pdf): Joint advisory from international cybersecurity authorities on protecting MSPs and their customers. - [CISA OT asset inventory guidance](https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators): Joint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance. - [NIST SP 800-82 Rev. 3](https://csrc.nist.gov/pubs/sp/800/82/r3/final): NIST guide to operational technology and industrial control system security. - [EU NIS2 directive](https://eur-lex.europa.eu/eli/dir/2022/2555): Consolidated text of EU Directive 2022/2555 (NIS2) on measures for a high common level of cybersecurity across the Union. - [Verizon Data Breach Investigations Report 2025](https://www.verizon.com/about/news/2025-data-breach-investigations-report): Verizon 2025 report on security incidents, confirmed data breaches, and observed attack vectors. - [NIST Cybersecurity Framework 2.0](https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final): Final NIST publication of Cybersecurity Framework 2.0 with governance, risk, and asset context. - [CIS Critical Security Controls v8.1](https://www.cisecurity.org/insights/white-papers/cis-critical-security-controls-v8-1): Center for Internet Security publication for CIS Critical Security Controls v8.1. - [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra): Microsoft Learn overview of Microsoft Entra and Microsoft Entra ID as a cloud-based identity and access management service. - [Microsoft Intune device management](https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/what-is-device-management): Microsoft Intune documentation on device management, including mobile device management and mobile application management. - [Microsoft endpoint detection and response](https://www.microsoft.com/en-us/security/business/security-101/what-is-edr-endpoint-detection-response): Microsoft explainer on endpoint detection and response for detecting, investigating, and responding to endpoint threats. - [IBM IT service management](https://www.ibm.com/think/topics/it-service-management): IBM explainer on IT service management, service requests, IT support, IT asset management, and change management.