iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Choose a managed security provider (MSP) for ransomware response by verifying its written scope, access controls, escalation process, evidence handling, recovery duties, and coordination with your own people, insurer, legal advisers, and authorities. The contract should state who hardens systems, detects attacks, declares an incident, isolates systems, investigates, restores services, and communicates with stakeholders. Do not select on a claimed response-time number alone: U.S. government guidance does not establish a universal MSP response benchmark or prove any provider’s performance.
The practical test is whether the provider and your organization can execute one approved plan when normal systems, email, identity services, or remote-management tools are unavailable. Demand evidence of that plan, limit the provider’s privileges, retain independent copies of critical records and logs, and exercise the arrangement before an incident.
What a managed security provider should do during a ransomware attack
An MSP may monitor alerts, investigate suspicious activity, contain affected hosts, support eradication, coordinate restoration, and provide technical advice. Those tasks are not automatically included in every managed service. Some providers only operate monitoring tools; others offer an incident-response retainer or a broader managed detection and response service. Your agreement must distinguish routine operations from emergency work.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →CISA’s joint ransomware guidance (with MS-ISAC, NSA, and FBI) starts response with the organization’s approved incident-response plan. The early sequence is to identify impacted systems, isolate them, and then triage systems for restoration and recovery. The provider’s playbook should fit your decision authority and business priorities rather than replacing them.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Monitoring and detection
Define which endpoints, servers, cloud services, identities, network devices, and backups are monitored. Ask how the provider handles telemetry gaps, disabled agents, and alerts generated by its own administrative tools. Require a documented path from alert to human escalation, including after-hours coverage and a contact method that does not depend on the potentially compromised environment.
Containment and investigation
Containment can include disabling accounts, revoking sessions, isolating hosts, blocking traffic, or stopping a suspected management tool. The contract should say which actions the provider may take immediately, which require your approval, and how emergency authority is recorded. Investigation duties should cover collection and preservation of relevant logs, timestamps, images, and other evidence, with a named owner for chain-of-custody records.
Recovery support
Recovery is more than restoring files. Someone must confirm that backups are usable, determine whether the attacker still has access, rebuild systems in a safe order, validate security controls, and obtain business-owner approval before returning services to production. Assign each responsibility explicitly; a monitoring contract may not include clean-room rebuilding, malware eradication, identity recovery, or application testing.
Start with a responsibility matrix
Use a responsibility matrix as an attachment to the statement of work. Mark each activity as provider-owned, customer-owned, shared, excluded, or available only under a separate retainer. CISA’s MSP advisory emphasizes clear service boundaries and contingencies.
| Activity | Questions to resolve | Evidence to request |
|---|---|---|
| Hardening | Who manages secure configuration, patching, multifactor authentication, privileged accounts, and backup protection? | Scope statement, control baseline, maintenance exclusions, and exception process. |
| Detection | What assets and signals are covered, and who validates a suspected ransomware alert? | Asset list, monitoring coverage map, alert workflow, and sample escalation record. |
| Declaration and escalation | Who can declare an incident, contact executives, and invoke emergency services? | Decision tree, named contacts, alternates, and authority limits. |
| Containment | Can the provider isolate devices or disable accounts without waiting for approval? | Pre-authorized actions, approval thresholds, and emergency change procedure. |
| Investigation | Who collects evidence, performs forensic work, and briefs legal counsel? | Incident-workflow description, evidence-handling procedure, and subcontractor list. |
| Restoration | Who chooses recovery order, rebuilds systems, validates backups, and approves return to service? | Recovery runbook, dependency map, backup test results, and acceptance criteria. |
| Communications | Who informs employees, customers, regulators, law enforcement, and the insurer? | Notification matrix, approval path, templates, and out-of-band contacts. |
List exclusions in plain language. Examples include unsupported operating systems, unmanaged cloud tenants, third-party applications, on-site hands, forensic imaging, ransom-negotiation support, and restoration beyond a stated number of systems. If emergency work requires a separate authorization, specify who may approve it and how billing begins during a crisis.
Evaluate the provider as a supply-chain risk
An MSP’s privileged access can become an attack path into every customer it serves. CISA guidance recommends treating the provider relationship as a supply-chain risk. Examine not only your own controls but also the provider’s administrative environment, remote-management stack, identity system, and subcontractors.
Limit and segment access
- Inventory every provider account, service account, API key, remote-management agent, VPN, and trust relationship.
- Give each role only the systems and tasks required for its contracted service. Separate monitoring rights from administrative rights.
- Require multifactor authentication, individual accounts, time-limited elevation, and prompt removal when personnel or contracts change.
- Segment management networks from user and backup networks. Do not allow a single provider credential to reach all environments.
- Require an approval and logging process for new tools, integrations, and subcontractor access.
Monitor provider activity
Ask what customer-visible records show provider logins, commands, configuration changes, data exports, and remote sessions. Logs should identify the person or service account, target system, time in a consistent time zone, action taken, and result. Your organization should be able to export these records without asking the provider to interpret them during an incident.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Require provider-incident notification
The contract should require prompt notification of confirmed or suspected incidents affecting the provider’s infrastructure, administrative networks, credentials, or tools that could affect you. Include a continuously monitored escalation channel, alternate contacts, the information supplied in an initial notice, update intervals, and obligations to preserve relevant evidence. Notification should not be limited to incidents that the provider has already conclusively attributed.
Test whether the provider can respond when your systems are down
A provider that relies on your email, identity provider, ticketing system, or remote-access gateway may be unreachable at the moment you need it. Before signing, walk through a scenario in which those services are unavailable.
- Identify out-of-band contacts. Record telephone numbers, alternate email addresses, secure messaging options, and executive escalation contacts that do not depend on the affected tenant. Verify them with a call during contracting.
- Define identity contingencies. Ask how provider staff authenticate if your single sign-on service is compromised. Confirm the emergency process for suspending a stolen provider credential.
- Specify containment authority. Decide in advance whether the provider may isolate hosts, disable accounts, block network paths, or stop services without waiting for written approval.
- Preserve evidence before destructive actions. CISA notes that powering systems down can destroy volatile evidence; shutdown should be considered only when disconnection is not possible. Require the provider to explain how it preserves evidence while containing the threat.
- Set an update rhythm. Establish who receives the first assessment, what facts are required, and when updates occur while facts remain uncertain.
- Exercise the failure mode. Conduct a tabletop or technical exercise in which normal communications and management tools are unavailable. Record gaps, owners, and completion dates.
Do not convert an exercise into a promise that an attack will be solved within a particular number of minutes. Government guidance supports planning and escalation, not a universal response-time SLA.
Inspect the response plan and exercise evidence
Request the current joint incident-response and recovery plan, not a marketing summary. It should name primary and alternate contacts, decision authority, severity levels, communications channels, evidence requirements, recovery priorities, and handoffs among the provider, your IT staff, leadership, legal counsel, communications team, insurer, and law enforcement where appropriate.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Questions for a plan review
- What event changes an alert into a declared ransomware incident?
- Who can authorize isolation, credential resets, emergency changes, and restoration?
- How are business-critical applications ranked when several systems are encrypted?
- How are suspected attacker communications, ransom notes, and extortion claims handled?
- Which decisions require legal or executive review?
- How are employees told to use an alternate communication channel?
- How are lessons from an exercise or real incident incorporated into the plan?
Ask for an exercise schedule or after-action evidence with sensitive details redacted. A useful report identifies the scenario, participants, decisions tested, failures found, corrective owners, and due dates. Re-test after major changes to the provider, network, identity architecture, backup design, or business-critical applications. CISA’s MSP guidance specifically supports exercising incident-response and recovery planning.
Verify logging, evidence, and customer control
Ransomware response depends on records that may be deleted or encrypted in the provider’s environment. CISA recommends that customers retain offsite copies of essential records and network activity logs. Keep independent, customer-controlled copies rather than relying solely on a portal or a provider’s retention promise.
Records to retain
- Authentication, privileged-access, VPN, endpoint, firewall, DNS, cloud, and backup logs.
- Provider remote-session records, administrative commands, configuration changes, and ticket history.
- Asset inventories, network diagrams, identity-group membership, backup catalogs, and recovery dependencies.
- Incident timelines, alerts, containment actions, evidence hashes, and communications approvals.
Contract terms should state the retention period, time synchronization standard, export format, access rights during a dispute or service outage, and preservation process after an incident. Clarify whether the provider may delete records when an account closes and how you receive a complete export before termination.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Assess backups and recovery responsibilities
Ask the provider to demonstrate how it determines that a backup is clean and usable. A backup that is online, reachable with domain credentials, or replicated without isolation may be encrypted alongside production systems. Your architecture should include offline or otherwise isolated copies, geographic separation where appropriate, access controls, retention suited to your recovery objectives, and regular restoration tests.
An external hard drive for offline backups can be one component for a small environment, but one consumer device is not an organizational recovery strategy. Match media, capacity, encryption, rotation, custody, and restore testing to the number and criticality of systems. CISA guidance supports offline and customer-held offsite backups; it does not prescribe a particular device or guarantee that a single copy is sufficient.
Recovery questions to put in writing
- Who owns backup configuration, monitoring, immutability or isolation settings, and restore testing?
- Who decides the order in which identity, networking, applications, file services, and endpoints return?
- Who verifies that restored systems are patched, monitored, and free of attacker persistence?
- What business owner accepts each application before it is reopened?
- What happens if the provider cannot access the backup platform or lacks the skills for a proprietary application?
- What recovery work is included, and what requires a separate incident-response retainer?
Require written recovery objectives that reflect your own impact analysis. Do not accept a provider’s generic recovery guarantee without definitions, assumptions, dependencies, and a test method.
Coordinate the provider with insurance, legal, and public authorities
Ransomware response often involves more than IT. CISA’s ransomware guidance lists cyber insurers and other stakeholders among the parties that may be engaged. Before an incident, ask your insurer and counsel which providers, notification steps, evidence practices, and approvals are required by your policy or legal strategy. The MSP should know whom to contact, but it should not make coverage or legal decisions on your behalf.
| Stakeholder | Coordination to define |
|---|---|
| Executive leadership | Business priorities, risk acceptance, emergency authority, and public-position approval. |
| Legal counsel | Privilege strategy, notification analysis, evidence preservation, and regulatory deadlines. |
| Cyber insurer or broker | Notice procedure, approved vendors, panel requirements, and claims documentation. |
| Communications | Employee, customer, partner, media, and regulator messaging with one approval path. |
| Law enforcement | When and how technical indicators, ransom notes, or criminal evidence are shared. |
| Business owners | Recovery order, acceptable downtime, data validation, and return-to-service approval. |
Build a due-diligence package before selecting an MSP
Use the same evidence request for every candidate so that your decision compares operating capability rather than sales claims. Require answers in writing and mark unsupported assertions as unresolved.
- Define your environment. List locations, users, endpoints, servers, cloud tenants, critical applications, identity systems, backup platforms, regulatory obligations, and existing security staff.
- Describe the target service. State whether you need monitoring, managed detection and response, incident-response retainers, recovery assistance, or all of these.
- Request the responsibility matrix. Reconcile it with your internal owners and identify every exclusion and contingency.
- Map access. Obtain an account, integration, privilege, network-path, and subcontractor inventory. Reject unexplained standing access.
- Review the response plan. Check contacts, authority, out-of-band methods, evidence handling, communications, and recovery dependencies.
- Review operational evidence. Ask for representative reports, redacted exercise findings, escalation examples, log exports, and backup-restore test records where available.
- Run a scenario interview. Present a simultaneous encryption event, compromised administrator account, and unavailable email system. Require the candidate to describe the first decisions and handoffs.
- Negotiate contract controls. Convert accepted answers into enforceable scope, access, notification, retention, cooperation, and termination terms.
- Exercise after onboarding. Test contacts and procedures, then close findings before treating the service as ready.
Contract clauses that prevent dangerous ambiguity
Have qualified counsel adapt the agreement to your jurisdiction and regulatory obligations. At minimum, the commercial documents should address the following.
- Scope: covered assets, service hours, severity definitions, included response actions, exclusions, subcontractors, and separate-retainer triggers.
- Authority: pre-authorized containment actions, approval requirements, emergency changes, and evidence-preservation duties.
- Access: least-privilege design, individual accounts, multifactor authentication, time-limited elevation, segmentation, and customer review of access records.
- Notification: suspected and confirmed incidents affecting provider systems, tools, staff credentials, or administrative networks; initial notice channel; update cadence; and cooperation obligations.
- Logs and records: ownership, retention, time synchronization, export format, preservation holds, customer copies, and access during outages or disputes.
- Recovery: backup responsibilities, restoration sequence, clean-validation criteria, business acceptance, dependencies, and limits of any recovery commitment.
- Confidentiality and data handling: where telemetry and evidence are stored, who can access them, subcontractor controls, and deletion or return at termination.
- Continuity: alternate contacts, provider outage procedures, staff substitution, and assistance if the relationship ends during an incident.
- Testing: exercise frequency, participation, after-action reports, corrective-action tracking, and plan updates after material changes.
How to compare candidates without inventing a score
Use a weighted worksheet based on your risk and operating model. A provider with more features is not automatically safer if it requires broad standing privileges or leaves recovery undefined.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
| Decision axis | Strong evidence | Warning sign |
|---|---|---|
| Scope and ownership | Signed responsibility matrix with contingencies and exclusions. | “We handle everything” without task-level definitions. |
| Coverage and escalation | Written hours, severity path, alternates, and out-of-band contacts. | Only a portal or a sales contact; no outage procedure. |
| Access security | Least privilege, multifactor authentication, segmentation, and customer-visible activity logs. | Shared administrator accounts or unexplained permanent access. |
| Response readiness | Current plan, exercised scenarios, after-action corrections, and clear authority. | Undated playbook or a promise based solely on a response-time number. |
| Evidence | Customer-controlled exports, retention terms, time synchronization, and preservation process. | Logs available only through a provider portal or deleted at termination. |
| Recovery | Tested restores, clean-validation steps, business priorities, and named owners. | “Backups are included” with no restore test or recovery boundary. |
| Stakeholder coordination | Integrated contacts for leadership, legal, communications, insurer, and authorities. | No process for legal privilege, insurance notice, or public communications. |
Document why a candidate is accepted, conditionally accepted, or rejected. Conditions should have an owner and a deadline before production access is granted.
Common selection mistakes and fixes
Choosing on a headline SLA
A response-time target can describe acknowledgement rather than containment, investigation, or restoration. Ask what event starts the clock, which personnel are included, what information must be available, and what happens if your identity or communications systems are unavailable. Keep the target only if it is measurable and contractually meaningful.
Recommended Free Tools
Assuming monitoring equals incident response
An alert may be generated without anyone authorized to isolate a host, investigate persistence, or rebuild an application. Buy and document the response capability you actually need.
Giving the MSP excessive standing privilege
Broad access may simplify operations but magnifies supply-chain risk. Use segmentation, role separation, just-in-time elevation, approvals, and independent logging.
Keeping all logs with the provider
If the provider account, tenant, or management platform is compromised, the same evidence may disappear. Export essential records to customer-controlled, access-restricted storage and test retrieval.
Never exercising the plan
Contacts change, tools are replaced, and business priorities move. A tabletop that produces no corrective actions is not evidence of readiness. Schedule exercises and verify closure of findings.
Free tools Windows power users keep installed
One-click scans. No signup required.
Restoring too quickly
Reconnecting an infected system can give an attacker a path back in. Follow the approved sequence, preserve volatile evidence when possible, validate eradication and controls, and obtain business-owner approval before reopening services.
A practical readiness test for the final shortlist
Give each finalist the same scenario: ransomware is spreading, the domain administrator account is suspected compromised, email and the ticketing system are unavailable, and several business-critical servers are encrypted. Ask the candidate to explain, in order:
- How it receives and authenticates the emergency request through an out-of-band channel.
- Which actions it takes immediately under pre-authorized containment authority.
- How it protects volatile evidence and records every action.
- When and how it escalates to your executive, legal, communications, insurer, and law-enforcement contacts.
- How it determines the affected scope and separates clean systems from compromised ones.
- How it validates backups, sets restoration order, and obtains business approval.
- What it cannot do, who must perform that work, and how the handoff is documented.
Score the completeness and consistency of the answer against your responsibility matrix. The best response is not the most dramatic; it is the one that remains workable when trust, connectivity, evidence, and decision time are constrained.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
