# How can an MSP give clients incident evidence quickly?

Keep the evidence as you go rather than reconstructing it afterwards: alerts with their timestamps and explanations, what was done and by whom, and the hosts involved. Agree with each client in advance what you will deliver after an incident and how fast, and who their contact for the authority is. In NetSenX each client's alerts and audit log stay in that client's tenant, the NIS2 Article 23 deadlines are tracked per incident, and PDF reports are available from the Starter plan. Make sure the plan's alert history covers the period an investigation is likely to need. Submitting the report to the authority stays with the client.

FAQ: [MSPs and MSSPs](https://netsenx.com/en/faq/msp) · https://netsenx.com/en/faq/how-can-an-msp-give-clients-incident-evidence-quickly

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/partners

## Related questions

- [Does an EU MSP need an EU-hosted security vendor for its clients?](https://netsenx.com/en/faq/does-an-eu-msp-need-an-eu-hosted-security-vendor)
- [How can an MSP show clients which AI tools their staff use?](https://netsenx.com/en/faq/how-can-an-msp-show-clients-which-ai-tools-their-staff-use)
- [Can an MSP offer OT monitoring to small manufacturers?](https://netsenx.com/en/faq/can-an-msp-offer-ot-monitoring-to-small-manufacturers)
- [What does an MSP need to monitor a client's PLCs passively?](https://netsenx.com/en/faq/what-does-an-msp-need-to-monitor-a-clients-plcs-passively)
- [What happens to a client's security data when they change MSP, and can they export or delete it?](https://netsenx.com/en/faq/what-happens-to-a-clients-security-data-when-they-change-msp)