What should an MSP tell a client after a security alert?
Tell them what happened, what it means for them, what you did, and what they need to do or decide, in plain words and without drama. Name the device and the time, say whether it was harmless, suspicious or an incident, and what evidence supports that. If you contained something, say how and whether anything is still affected. If the client must decide, for example to disconnect a server or inform staff, say so clearly and by when. If personal data or NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. reporting may be involved, point it out early, because deadlines can start at awareness. Keep a written record. NetSenX alerts give you the explanation to pass on, and the audit log keeps what was done.
Read next
Related questions
- My MSP client got hacked. What do I do first?
- Can an attacker pivot from a client network into the MSP's tools?
- How do we detect misuse of our RMM tool in client networks?
- What should an MSP monitor to detect a compromise of its own tools?
- How can an MSP add night and weekend coverage for clients without hiring?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.