Authorize and scope
Name the decision owners, record included and excluded systems, define shared responsibilities, and capture maintenance or action constraints before access changes.
30 controls · 16 discovery questions · Public CSV · No signup
Free MSP client onboarding and go-live checklist.
An onboarding is not complete when agents install or passwords arrive. Use the questionnaire to collect the operating facts, reconcile the work in the evidence register, and pass a documented go-live review before steady-state support begins.
Download the questionnaireDownload the evidence registerSequence the six-week onboarding planReconcile endpoint inventoryProve backup recoveryAssign onboarding evidence to RMM or PSAAssign RMM and ITAM lifecycle recordsOpen the full 10-step MSP client onboarding guidePlan the first client QBR
Discover and reconcile
Compare customer records with observed endpoints, services, vendors, risks, open work, dependencies, and critical-system ownership. Use the endpoint inventory and CMDB template to keep device identity, source provenance, freshness, and exceptions explicit.
Establish controlled access
Create named least-privilege access with MFA, test every required trust path, and give shared or temporary credentials an owner and expiry.
Prove the operating model
Pilot RMM placement, alert routing, patch behavior, remote actions, audit records, backup recovery, ticket ownership, and escalation before broader rollout.
Accept with exceptions visible
Obtain named customer acceptance only after every residual risk, missing asset, failed control, and documentation gap has an owner, due date, and follow-up.
Evidence register preview
The downloadable register contains 30 controls. These five gates show the evidence standard: name the owner, attach a current source, define what passes, and keep every exception visible until someone closes it.
| Gate | Evidence to retain | Acceptance test | Stop condition |
|---|---|---|---|
| Authority and scope | Signed scope, named approvers, exclusions, maintenance windows, and escalation contacts | Each managed action has an accountable customer and MSP owner | Technicians must infer whether a system or action is authorized |
| Asset baseline | Reconciled endpoint, identity, network, purchasing, and existing-tool records with observation dates | Every discovered asset is managed, excluded, retired, offline, duplicated, or assigned to an exception | The device count contains unexplained gaps |
| Privileged access | Named accounts, MFA status, client-scoped roles, vault references, and emergency-access procedure | Required work succeeds without shared cross-customer credentials | A technician has broader access than the approved service boundary |
| Recovery | Backup scope, recent job evidence, recovery owner, restore result, RPO, and RTO | At least one representative restore is observed and recorded with the backup restore test checklist | Backup status is visible but recovery remains unproven |
| Pilot and acceptance | Representative endpoint results, alerts, approved actions, rollback evidence, exceptions, and named sign-off | The pilot proves monitoring, escalation, action evidence, and clean rollback before wider deployment | Alert delivery, endpoint identity, or rollback cannot be demonstrated |
MSP client go-live checklist: six gates before steady-state support
Use these gates as a final service-readiness review, not as a substitute for the 30-control register. A gate passes only when the named owner can show current evidence and every exception has a due date and decision owner.
| Go-live gate | Ready when | Do not go live when |
|---|---|---|
| Authority and contacts | Scope, exclusions, approvers, service owner, escalation contacts, and after-hours authority are recorded and acknowledged | A technician must guess who can authorize a privileged or disruptive action |
| Inventory and ownership | Users, endpoints, sites, critical applications, vendors, identities, and existing management tools are reconciled to an observed baseline | Unexplained asset gaps or duplicate management identities remain |
| Access and security | Named least-privilege accounts, MFA, vault references, remote-support approval, and emergency access have been tested | Shared credentials, missing MFA, or cross-customer access are required for routine work |
| Monitoring and service desk | Representative alerts create correctly owned work, notifications reach the intended people, and maintenance behavior is understood | Alert delivery, ticket routing, priority, acknowledgement, or escalation cannot be demonstrated |
| Recovery and change control | A representative restore, patch or controlled change, rollback path, and customer communication workflow have current evidence | Backup status is visible but recovery is untested, or a high-impact change has no rollback owner |
| Acceptance and handoff | Open risks and exceptions are accepted by named owners, runbooks are findable, support entry points are communicated, and the client signs off | Known gaps are hidden in notes, lack owners, or have no agreed follow-up date |