Cyber Essentials for IT support providers (MSPs)

An IT support company holds the keys to every customer it looks after. That's exactly why attackers target MSPs, and why customers and regulators are paying attention.

Why customers ask

• One breach, many victims. Attackers use MSPs' remote access tools to reach all of their customers at once.
• Supply chain checks. Customers that need Cyber Essentials themselves often ask their IT provider for it too, and increasingly for Cyber Essentials Plus or ISO 27001.
• Credibility. If you help customers get certified, holding the certificate yourself is the obvious first question they'll ask.

The Cyber Security and Resilience Bill

The Bill, introduced in November 2025, would bring medium and large managed service providers (called "relevant managed service providers") under the UK's NIS regulations for the first time. That would mean security duties, incident reporting and a regulator.

• As of autumn 2026, the Bill had cleared the Commons and was going through the House of Lords.
• Many of its provisions depend on secondary legislation and aren't expected to apply until around 2028.
• Small MSPs may fall outside the size threshold, but their customers will still ask.

Check the latest position on GOV.UK, as the details may change before the Bill becomes law.

Getting your own house in order

1. Multi-factor login on your remote management tools, PSA and every customer admin account.
2. Separate admin accounts for each engineer, with no shared credentials.
3. Patch your own tools quickly. Remote management software is a favourite target.
4. Get Cyber Essentials Plus, then offer to guide customers through their own.