MSP onboarding

Client onboarding security checklist for MSPs and IT consultants

Published by Surveil-X · October 31, 2026 · Practical guide

Short answer Before accepting operational responsibility, document authorized scope, business contacts, assets, identities, privileged access, external exposure, email and domain ownership, backups, monitoring, incident escalation, existing risks, and inherited exceptions. An external report is the first layer, not a substitute for internal discovery.

Who this guide is for

MSPs, IT consultants, fractional IT teams, and agencies onboarding a new business client.

Key takeaways

Record the pre-existing state before making changes.
Separate client-owned, provider-owned, and third-party responsibilities.
Secure privileged access before broad discovery.
Combine outside-in and internal evidence.
Get written acceptance for inherited risks and deferred work.

Before access is granted

Confirm authorization, scope, key stakeholders, emergency contacts, critical business services, contractual boundaries, data sensitivity, regulatory constraints, and the systems explicitly excluded from the engagement.

Establish identity and ownership

Inventory domains, DNS, email platforms, cloud tenants, hosting, registrars, endpoints, networks, SaaS applications, backups, vendors, and administrative accounts. Remove shared or orphaned access where authorized and establish named privileged identities with MFA.

Capture the inherited baseline

Run an external review and collect internal evidence for patching, endpoint protection, logging, backups, restore tests, network configuration, and existing incidents or known vulnerabilities. Date the baseline so later changes are attributable.

Agree the first remediation plan

Separate urgent exposure, foundational control work, operational cleanup, and longer-term improvements. Assign owner, target decision, dependency, and acceptance status. Obtain written confirmation for material risks the client defers.

Recommended workflow

Confirm written scope and contacts.
Secure privileged identities.
Inventory assets and vendors.
Capture external and internal baselines.
Agree ownership and remediation priorities.

Use the worksheet

Turn the guide into an owned process.

Open the printable checklist for this topic, assign the missing owners, and record the evidence or decision behind every completed item.

Open printable checklist

Frequently asked questions

Is an external scan enough for onboarding?

No. It only covers publicly observable signals and should be combined with internal asset, access, backup, monitoring, and operational discovery.

Who owns pre-existing findings?

Ownership should be agreed contractually and operationally. The onboarding record should distinguish inherited conditions from provider-created changes.

When should the baseline be repeated?

Repeat after major remediation and on a risk-based schedule, especially after infrastructure or ownership changes.

Sources and further reading

This guide provides general operational information. It is not legal advice, a certification, or a substitute for a qualified security assessment scoped to your organization.