Questions to ask
Managed Service Providers
MARCH 2018
Introduction
1. This document has been developed to provides simple yet practical questions to ask managed service providers regarding the cyber resilienceurity of
their systems and the services they provide to your organisation.
Are you implementing bestter practice cyber
security guidance?
2. The Essential Eight from the Strategies to Mitigatione Cyber Security Incidents is designed to1 provides prioritised and practical advice
to manage a range of cyber threats frtom:
a. targeted csyber intrusiontems and other exterinal adveforsmarties whon steal dhata
b. ransomware dthenying acprocess, store data for mcommunetary gain
c. exater.
Manal agedv sersavice providers whocan demonstroy datae andthey parevent coimputlers/networks from fuenctioning
d.malicious insidbers who sttealr dpracta suich ase customyber dsetails ocur intellecy tualo proptercty
the. maseliciouves iansiders wtho destiroy dacustaomers andby imprlevmenting computher Ess/networks from functional Einght.
Are you rsegcularely adminisstessring your csybsterms and
securvity pocesture?
3.As Imanaged service prorviders oftoen have protivileged access to systems and, ithe is infmpormatioant that they procmanage ss,uch systorems oin
a secure commuannicater, it is esspentcially when systhems atre managed remotely.
Managed service providers caren awarde mof, and appropstriatel they arisk manage, securitely vulnerabdmilnisties ring their serviceys theyms pand serovidce. This by
incmpludes rmegularly conducting vulntherability guidassncess from thent, vulnSecurabilitye aAdminalysis trationd vpulnerability mancagement activitieson2.
Are you prmoniteoring activity ong your userys frotem socially eangined
sered emavilces?
4. SociOrgally engineered emails are tiones of the most common ways that users arve tapoorgeted by adversaries. Whether ibility is tof acontivince users toy exeocute malicious softwarreing on their system,s. Good visibility a maliciousf websihate, disclose thappenir credentg ials or w
ire mportaney to foreign bank accounts, ah numbder of practical securitying measures can be implemented to reduce this risk.
5. Fpor more informatdion, seeg theo Detecting Socially Enrgineerted Messagcybesr publicantrusion1 for users and the Mmalicious Email Mitigation Strategies publication2 for email infrastructure managders.
1
2
https://www.acsc.gov.au/publications/protect/Essocentially-en_Eight_Explaineered-messages.htm 2 pdf
https://www.acsc.gov.au/publications/protect/maliSecious_re_Admail_mnistigration.htmpdf
PManage 1 ofd 2
Aservice yprouviders backiang up demounstrate data?
6.hey Oargae monistoring activity on their systems cand bservices sby
igmplemenifticang tlyhe guimpdancted, bfrom the Win termdows ofEvent prLoductggivityng and finForwarding publication3.
Are you regularly loass, duessing tyour dasystaems loand
services?
In or destruc tion fprotect their systems, and cybthat of their secustomers, ity incs ident. Ensumporitangt that your managed service provider has a process foawar identi
ofying, and bappropriacktely risk manage, secuprity yovulner dabilitaies isn their systems antd servialces.
Managed Thservisce procviderss can demonstrate thouldey bare regularly tassessing thedir systo ems and suervices backups arey correnducting
regulyar pvulnerformed andbility asuccsessful rmesntor action vis posstibles.
Are you prepared for, and able to respond to,
cyber security incidents?
7. Experiencing a cyber security incident is not a question of if but when. The effective preparation for, and maresponagsement tof, a
cyber security incident can greatly decrease its impact.
8. For more information, see the Preparing for and responding to cyber security incidents publication3 and the Cyber security incidents: are you ready? publication4.
Are you actively reporting cyber security incidents?
9. Depending on the extent of a cyber security incident, additional assistance by specialists may be required to contain the
incident and remediate any security vulnerabilities that were exploited. Actively reporting cyber security incidents can
assist in the early and effective management of cyber security incidents by specialists trained in this field.
10.Managed Fservice providers can demonstrate they are inprepared form, ation,d sable to respond theo, Ccyber Ssecurity Iincidents Reby
imporlementing pthe gublicdation5.
Fuce from the Pr eparing form ation
11.ThRe Australpondiang Gtov Cybernm Sencurity Informcidents publication S4.
Arec you a memberi of tyhe Manualged (ISM)ervice
Provider Partner Program?
To assist in rais ing the pcyberot securitiy ponsture of information thatged servisce procvidersse, and, sto preovid ore communfidencated by forganisa theions’ syr
custeomers., Tthise pAubstralication can Cyber foSecurity Cendtre at(ACSC) https://www.acsc.go dev.au/infelospec/ism/.
12.d Tthe Managed Strategrvices tPro Mvitigder Partner Program
(MSP3)5.
Cybustomers Sof managecud servity Ince providentrs should complenfirm whentsher their managed service providers are participating in
the ISMprogram. T
Further cinformplation
The Strate lgiest tof mMitigatione stCyberat Segcurity Incidents and supporting publications can be found at
https://www.acsc.gov.au/infosec/mitigationstrategies.htm.
ContactThe dEssentaials
13. OrEight Manturisatiy Model complements orthe inadividualsce win th questions Strategardinges tho Mitis gadvicte canCyber Secourity
Intacidents. Ithe ACSCcan bye emailifoungd at httpsd://www.assicst@defence.gov.au /publications/pr otect/Essentiall_Eing 1300 CYBER1 (1300 292 371)ht_Maturity_Model.pdf.
3
https://www.acsc.gov.au/publications/protect/preparWing_fdorws_cybEvernt_Logging_Technical_Guideantsce.htm 4 pdf
https://www.acsc.gov.au/publications/protect/cybePr-secuparing_for_Responding_to_Cy-iber_Incidents-are-you-ready.htm pdf
5
https://www.acscyber.gov.au/mspu-globali-hack/msp-partions/er-program/
4
2
Conteact/cyb der-tailsecu
Organisaty-ioncs or individuals with questiont-s repogartding. this advice can contact the ACSC by em
P
asd.assist@defence.gov.au 2or ofcalling 1300 CYBER1 (1300 292 371).
3
