The MSP security baseline checklist (what we enforce on day one)

This is the checklist our engineers work from during onboarding. It’s deliberately boring. Boring is what prevents incidents. Every item is enforced by policy and continuously re-checked by Helix so it can’t drift back.

Identity

• MFA enforced for 100% of users via Conditional Access; phishing-resistant for admins.
• Legacy authentication protocols blocked.
• Break-glass accounts documented, monitored, and excluded from CA with alerting.
• Standing global admin reduced to two accounts; everything else just-in-time.
• Guest access reviewed and expiring.

Endpoints

• EDR deployed and reporting on every device; isolation tested.
• Disk encryption (BitLocker / FileVault) enforced and keys escrowed.
• Local admin removed; LAPS or equivalent for privileged access.
• OS and third-party patching automated with sandbox validation and off-peak deployment.
• Device compliance required for access to company data.

Email and collaboration

• SPF, DKIM, DMARC at p=reject (or a dated plan to get there).
• Safe links and attachments; auto-forwarding to external domains blocked.
• Sharing defaults set to internal; external sharing requires justification.
• Mailbox auditing on; retention policy applied.

Data and recovery

• Immutable backups for endpoints, servers, and SaaS (M365 / Google).
• Automated restore tests with evidence retained.
• Documented RTO/RPO per system; DR runbook reviewed quarterly.

Network

• Segmented VLANs; guest and IoT isolated from corporate.
• Firewall firmware current; management plane not exposed to the internet.
• Zero Trust remote access replacing broad VPN where feasible.

Evidence

• Every control above mapped to SOC 2, HIPAA, and CIS; evidence collected automatically into the Trust Portal.
• Monthly report to the client showing drift detected and corrected.

If your current provider can’t show you this list with checkmarks next to it, ask why.