Our MSP Security Posture: How We Secure Our Own House
A provider asking you to trust them with your environment should be willing to describe how they protect their own. This page does that.
UniVirtual Solutions applies every control it recommends to clients inside its own environment: enforced multi-factor authentication, endpoint detection and response, encrypted devices, immutable backup and least-privilege access. Managed service providers are an attractive target because compromising one reaches many businesses at once, which is why the question is worth asking of any provider.
The Question Every Buyer Should Ask And Few Do
Managed service providers are an attractive target precisely because compromising one provides access to many businesses at once. That is not a hypothetical: supply-chain attacks against providers have been among the most damaging security events of recent years, and any provider who has not thought hard about it is a risk to you rather than a defense.
So we think the question about MSP security is fair, and we would rather answer it before you ask. What follows is how we handle our own controls, your data, and the vendors we depend on.
MSP Security: How We Protect Our Own Environment
The same standard we sell
Our MSP security posture starts here: every control we recommend to clients is applied internally: enforced multi-factor authentication, endpoint detection and response, encrypted devices, immutable backup and least-privilege access.
Administrative separation
In our MSP security model, administrative credentials are separated from day-to-day accounts, and privileged access to client environments is logged and reviewed rather than shared informally.
Certified people only
Our engineers are certified and vetted, and access to a client environment is granted by role rather than by convenience.
What We Hold, And What We Do With It
We hold what is necessary to support you and no more: documentation of your environment, monitoring and alert data, ticket history, and backups where we provide them. That information stays within our tooling and is not sold, shared or used to train anything.
Under our MSP security posture, backups are encrypted in transit and at rest. How long backups are kept follows your own obligations, not a vendor default, and we can name the exact storage location when a compliance question calls for it. When an engagement ends, we return or destroy your data according to your instruction rather than quietly retaining it.
If we deploy AI tooling in your environment, the governance work establishes the data boundary before anything is switched on, and usage is logged to an audit standard. Your information does not go into a public model.
What We Align To
CIS Controls v8
Our internal baseline and the framework we most often use with clients, because it is practical and prioritized rather than merely comprehensive.
NIST CSF 2.0
Used for structuring risk conversations and for mapping client programs where a recognized framework is required.
Client-specific regimes
Whichever regime actually governs a client is the one we work to, from HIPAA and state privacy law to GLBA with the FTC Safeguards Rule, PCI-DSS and SOC 2.
What We Do Not Claim
We are not SOC 2 certified, and we will not imply otherwise on a marketing page. Where a client requires their provider to hold a specific certification, we will tell them plainly rather than obscuring it, and in some cases that means we are not the right fit.
We also do not provide legal advice, and we do not perform the independent audit function for our own clients’ compliance programs, because a provider auditing its own work is not an audit. Those boundaries exist to keep the assurance meaningful.
MSP Security Questions We Get Asked
Questions buyers and auditors ask about our MSP security posture.
No, and we say so plainly rather than implying otherwise. Our controls are mapped to NIST CSF, CISA guidance and CIS v8 wherever each one fits, and an engineer can take you through them line by line.
Within our supported tooling, encrypted in transit and at rest, with retention set to your obligations. We will give you specific locations when a compliance answer requires it.
No. Where we deploy AI in your environment the data boundary is established before anything is enabled, and usage is logged to an audit standard.
Certification, background checks and role-based access. Privileged access to client environments is logged and reviewed rather than shared informally.
Contact us directly at 678-374-4352 or by email. A concern raised about our own posture is treated with the same urgency as one raised about a client environment.
It is returned or destroyed according to your written instruction, and we confirm when that is done. Quietly retaining a former client’s environment documentation and backups is a liability for both parties, and we do not do it.
Yes. Larger clients and regulated businesses reasonably ask to review a provider’s controls, and we will complete your questionnaire and sit through the conversation rather than treating it as an imposition. If a question exposes a genuine gap, you will hear that rather than a deflection.
Who We Depend On, And How We Choose Them
No provider builds everything itself, and any who claims to is either misleading you or reinventing security tooling badly. What matters for MSP security is how the dependencies are chosen and how failure in one of them is handled.
For MSP security, we select vendors on detection quality and response capability rather than on margin, and we review that choice rather than treating it as permanent. Where a vendor holds client data, we assess their posture with the same questions we expect you to ask us, and we maintain the ability to move if their standard slips.
We also keep the number of dependencies deliberately small. Every additional vendor in the chain is another set of credentials, another integration and another possible route in, and the industry has learned that lesson expensively over the last few years.
What Happens If Something Happens To Us
It is a fair MSP security question and most buyers never ask it. Our own environment is backed up, documented and recoverable to the same standard we apply to clients, and our client documentation is held so that any of our engineers can pick up an environment rather than that knowledge sitting with one person.
Practically, that means two things for you. Your named engineer having a bad week does not leave you unsupported, because a named backup already knows your environment. And in the unlikely event you ever needed to leave us at short notice, your documentation is yours: an accurate record of what you run, how it is configured and where everything sits. We hand it over rather than treating it as leverage, because a provider who makes leaving difficult has stopped competing on service.
What To Look For In An MSP Security Posture
MSP security posture claims look alike on paper, so test them against the contract. A provider worth hiring will state its security incident response time, name who handles a 2 AM alert, and show that protection is built into the agreement, not quoted after a breach.
A strong security posture can be shown, not just described. Ask for the date of the last tested restore and the framework the controls are mapped to. Ours: NIST CSF, CISA guidance and CIS v8, each where it applies, with the last restore date and the control records available the day an auditor or underwriter asks.
We hold our own MSP security posture to that bar. Clients usually come to us after a provider that passed every checkbox stopped showing up when it counted.
Ask Us The Hard Questions
We would rather answer questions about our MSP security before an engagement than after an incident. Talk to a certified engineer.