Partners
MSP partner program
MSP-safe: we design and oversee; your team operates the tools. You keep your clients and your tools, we lead the security program above them, and the client owns its risk.
An example
An illustration of how the roles fit together.
A managed service provider (MSP) runs IT for a 30-person insurance agency in the Hudson Valley: the laptops, the firewall, Microsoft 365, backups and endpoint protection. In the same quarter, the agency’s cyber insurance renewal asks whether multi-factor authentication (MFA) is enforced everywhere, whether backups are tested and whether there is a written incident response plan. As a New York-licensed agency it also has its annual NYDFS Part 500 filing due by April 15, which the owner has to stand behind. And the owner asks the MSP, “Who is in charge of our security program?”
The MSP’s engineers can produce the MFA report and the backup test log. What they are not set up to do is write the agency’s policies, run its risk assessment, prepare the owner to sign the filing, and report to the owner on whether the program works. That is governance work, and the agency’s leadership has to own it.
The MSP introduces Security Medic. We run the risk assessment, write the policy set, build the evidence package for the insurance questionnaire from the MSP’s own reports, and prepare the owner for the Part 500 filing. The MSP keeps every tool, every ticket and the client relationship. Gaps we find, such as MFA missing on an old remote access path, go back to the MSP as project work, because the MSP operates the tools.
What the partnership is
Security Medic is an independent firm. We partner with MSPs; we do not sell to them as customers, and we do not operate under an MSP’s brand.
- The MSP keeps its clients and its tools. Endpoint protection, monitoring, patching, backups, firewalls, identity administration and the helpdesk stay with the MSP, on the platforms it already runs.
- Security Medic works above the stack. We provide the fractional chief information security officer (CISO) layer: risk assessment, policies, evidence for insurers and auditors, incident response planning, vendor reviews and reporting to the client’s leadership.
- The client owns its risk. The client’s leadership approves policies, accepts or treats risks, and signs its own attestations. We prepare them to do that with proof in hand.
- Security Medic reports to the client independently, including on how well the controls the MSP operates are working. That independence is what makes the reports credible to insurers, auditors and boards, and it protects the MSP too: findings are evidence-based, shared with the MSP first, and fixed by the MSP.
Who does what
Three parties, three different jobs. The short version:
The MSP
- Operates the tools and the helpdesk
- Supplies reports and exports as evidence
- Carries out remediation projects
- Leads technical response in an incident
- Joins reporting where operations are discussed
Security Medic
- Assesses risk against the client’s obligations and a named standard
- Writes and maintains the policy set
- Assembles evidence for insurers, auditors and customers
- Leads incident response planning and tabletop exercises
- Reports to leadership and the board
The client
- Owns the risk and makes the decisions
- Approves policies and signs attestations
- Provides people and time for interviews and exercises
- Leads business decisions in an incident, with its counsel
- Receives the reports and directs priorities
The responsibilities table
For the activities that come up most, the table below writes down each party’s role:
- RResponsible: does the work.
- AAccountable: owns the outcome and signs off. Exactly one per row.
- CConsulted: gives input before the work is final.
- IInformed: is told the result.
The client is Accountable on every row. It owns its risk, approves its own policies and signs its own insurance applications, regulatory filings and audit statements. The MSP stays accountable to the client for the services in its own contract, and Security Medic for the work in its own agreement; neither takes the client’s sign-off away from it.
| Activity | MSP | Security Medic | Client | What it looks like in practice |
|---|---|---|---|---|
| Risk assessment | C | R | A | Security Medic assesses the client against its named obligation and a standard (for example NIST CSF 2.0). The MSP supplies configuration reports and answers technical questions. The client’s leadership reviews the findings and decides which risks to fix, accept or transfer. |
| Policy set (write and maintain) | C | R | A | Security Medic writes the policies (acceptable use, access control, backup, incident response, vendor management, AI use). The MSP checks that each policy matches what its tools can actually enforce. The client approves and adopts them. |
| Applying policies in the tools | R | C | A | The MSP configures the tools to match approved policy (for example MFA settings or backup schedules). Security Medic states the requirement and later checks the evidence. |
| Insurance questionnaire evidence | C | R | A | Security Medic drafts each answer and attaches proof. The MSP supplies the exports and screenshots from its tools. The client reviews and signs the application, because the attestation is the client’s. |
| Incident response plan and tabletop exercise | C | R | A | Security Medic writes the plan, with separate lanes for the MSP and Security Medic, and runs the tabletop. The MSP takes part and confirms its technical steps. The client’s leadership approves the plan and plays its decision-making role in the exercise. |
| Incident response: a live incident | R | C | A | The MSP leads technical containment and recovery. Security Medic coordinates against the plan, tracks decisions and evidence, and helps the client and its counsel work through notification obligations. The client makes the business and legal decisions. Security Medic does not give legal advice. |
| Vendor security reviews | C | R | A | Security Medic reviews the client’s key vendors (including, when the client asks, the MSP itself) and summarises the risk. The MSP answers questions about its own controls and about vendor integrations it manages. The client decides whether to accept each vendor’s risk. |
| Remediation projects (fixing gaps) | R | C | A | When an assessment finds a gap, the MSP scopes and carries out the fix. Security Medic explains the requirement behind it and checks the evidence afterwards. The client approves and funds the project. |
| Board and executive reporting | C | R | A | Security Medic reports on the program’s status, top risks and progress in business terms. The MSP supplies operational metrics and joins when operations are discussed. The client’s executives receive the report and set priorities. |
| Audit preparation | C | R | A | Security Medic builds the evidence register, runs a mock audit and tells the client how ready it is. The MSP produces technical evidence on request. The client owns the audit. The formal audit itself is done by an outside party (a CPA firm, a certification body or a regulator), never by Security Medic or the MSP. |
| Day-to-day IT and security operations | R | I | A | Endpoint protection, monitoring, patching, backups, firewalls, identity administration and helpdesk stay with the MSP on its own tools. Security Medic is told about changes that affect policy or evidence. |
- Per client, the work order can adjust a row. For example, a client with its own IT manager may take the MSP’s part on the policy row. Any change is written into that client’s work order.
- Findings about the MSP’s controls go to the MSP first. We share them with the MSP before the client report, so the MSP can respond or fix before the report is final. The client still receives the finding.
What the work is measured against
We keep two things apart, because clients and auditors need them apart.
- Obligations are what the client must meet: laws and regulations such as the NYDFS Cybersecurity Regulation (23 NYCRR Part 500), the HIPAA Security Rule and the NY SHIELD Act, and contractual obligations such as an insurer’s questionnaire or a customer’s security requirements.
- Standards and frameworks are how the client meets them and shows it: NIST Cybersecurity Framework (CSF) 2.0 as the common map, CIS Critical Security Controls v8.1, ISO/IEC 27001:2022, and the NIST AI Risk Management Framework (AI RMF) 1.0 for clients adopting AI tools.
Every engagement names the obligation, the standard used to meet it and the target level. Because we map the MSP’s existing tools to the standard, the work the MSP already does counts as evidence.
How an engagement starts
- Introduction and registration. The MSP tells us about a client with a governance need (an insurance renewal, a regulatory filing, a customer questionnaire, an audit date) and registers the opportunity, so both firms know who brought it.
- Joint call. The client, the MSP and Security Medic hold a free 30-minute call. We listen for the obligation, the deadline and what the client already has.
- Free assessment. The client completes our free online assessment: a quick, self-reported picture and a gap report, reviewed with the client at no charge.
- Scoped proposal. If the client wants to go further, we propose paid work scoped to the named obligation: an obligation-scoped assessment, an audit preparation engagement, or ongoing fractional CISO support. The client engages Security Medic directly, and the work is priced per proposal.
- Work order. Between the MSP and Security Medic, each client gets a short work order that sets out roles (using the table above), how findings flow to the MSP, and any partner arrangement for that client. Terms are set per work order and are not published.
- Kickoff. We ask the MSP for the reports we need (for example MFA coverage, backup test results, endpoint protection status) and agree on how to request more without adding helpdesk tickets.
What protects both firms
The partnership rests on a mutual non-disclosure agreement and a short master partner agreement that protects both firms’ client relationships.
What the MSP gets
Clients who stay
When a client suddenly needs a security program for a regulator, an insurer or a large customer, you have a partner to bring in instead of losing the account to a firm that also sells managed services.
Senior engineers back on engineering
Policy writing, insurance questionnaires, vendor questionnaires and audit evidence move to Security Medic. You supply the reports; we turn them into answers.
Project work with a clear reason
Each gap we find comes with the requirement behind it, so the client understands why the fix matters. You carry out the fix.
A shared incident response plan
The plan names who does what in an incident, with your technical role and our coordination role written down before anything goes wrong, and one tabletop exercise to test it.
Independent proof of your own work
When Security Medic reports that controls are working, that statement comes from a party that does not operate them.
What Security Medic never does
- We do not sell managed services, helpdesk, endpoint or monitoring products, patching or managed security operations, and we do not replace the MSP’s tools.
- We do not solicit the MSP’s clients for IT services, and we do not operate under the MSP’s brand or another firm’s name.
- We do not sign the client’s attestations for it. The client’s leadership signs, with our preparation behind them.
Book a partner call
A free 30-minute call to talk through your clients, where a governance need is coming up, and how a first joint engagement would work.
Book a free partner call