Checklist

MSP Security Checklist 2026

Essential security controls every MSP should implement across their client base. Use this checklist during QBRs and security assessments.

Identity & Access Management

Enforce MFA on all admin accounts

Implement conditional access policies

Review and audit privileged access monthly

Disable legacy authentication protocols

Deploy passwordless authentication where possible

Deploy next-gen AV/EDR on all managed endpoints

Enable automated patch management

Implement application whitelisting for critical systems

Monitor for configuration drift

Enforce device compliance policies

Segment networks by function and sensitivity

Monitor for rogue devices on client networks

Implement DNS filtering

Review firewall rules quarterly

Deploy network intrusion detection

Implement 3-2-1 backup strategy

Test backup restoration monthly

Encrypt data at rest and in transit

Monitor for data exfiltration attempts

Maintain offline/immutable backup copies

Map controls to relevant frameworks (SOC2, NIST, CIS)

Automate evidence collection for audits

Conduct annual penetration testing

Maintain incident response plan and test quarterly

Document security policies and review annually

Aerie OS includes built-in compliance scanning, endpoint protection, and automated evidence collection.