Internal MSSP subcontractor review checklist

Overview

Many MSPs engage a managed SOC, help desk, or project partner for scale. Your contractual and reputational exposure remains with the client, so supplier diligence must be as rigorous as you expect from your own vendors.

Review dimensions

• Certifications and attestation reports (for example SOC 2) with scope that matches services you resell.
• Incident response playbooks aligned with your runbooks: severities, escalation paths, and client notification obligations.
• Data residency, sub-processing, and logging locations documented in the Data Processing Agreement (DPA).
• Named escalation contacts validated quarterly, including after-hours numbers and secure comms channels.

Contract flow

Confirm how liability, indemnity, and cyber insurance flow through the chain; legal review of caps, carve-outs, and notice periods before you sign client MSA language that references the subcontractor.

Monitoring

Track SLA breaches and recurring ticket themes in quarterly business reviews; trend misses against root cause (capacity, tooling, training) and correct with the vendor before clients notice a pattern.

Exit

Exercise data portability and termination clauses in a controlled drill: export of tickets, logs, and configuration artefacts without disrupting production monitoring.

Documentation

Retain selection rationale, due diligence results, and annual re-review sign-off in a single vendor evidence folder for audits and renewals.