Six things MSPs should actually test before the next ransomware hit
Acronis lays out a practical checklist for managed service providers, moving the conversation past backups and antivirus to the full arc of prevention, detection and recovery.
Key points
- Acronis has published a six-point checklist for managed service providers (MSPs), the outside IT firms that run technology for smaller businesses.
- The guidance covers the full ransomware lifecycle: reducing exposure, hardening systems, detecting intrusions, preserving clean recovery points, restoring operations, and learning from each incident.
- Backups alone aren't enough, because modern ransomware crews search for and delete backup files before triggering encryption.
- The checklist is vendor guidance, not a regulation, but it maps closely to recovery expectations regulators now write into rules like the SEC's cyber disclosure requirements and NIS2.
Ransomware, the crime where attackers scramble a company's files and demand payment to unscramble them, keeps hitting the same soft target: small and mid-sized firms that outsource IT to a managed service provider. If the MSP falls, every client falls with it.
Acronis, a backup and security vendor, published a six-point checklist aimed at those providers, written up this week by BleepingComputer. It's not a standard or a rule. It's a self-assessment, and a useful one, because it reframes ransomware defence as a chain rather than a single product.
What is actually on the checklist?
The six capabilities are exposure reduction, system hardening, attack detection, recovery-point preservation, rapid restore and post-incident review. Acronis argues an MSP should demonstrate each of these across every client environment it manages, not just the flagship accounts.
| Capability | What it means in practice |
|---|---|
| Reduce exposure | Shrink the number of internet-facing systems and open accounts an attacker can reach. |
| Harden systems | Patch software, turn on multi-factor login, remove default passwords. |
| Detect attacks | Spot unusual file activity or logins before encryption starts. |
| Preserve recovery points | Keep backups that ransomware cannot reach or delete. |
| Restore quickly | Rehearse getting a client fully working again, not just the file server. |
| Review and improve | Run a post-mortem after every incident, real or simulated. |
Why does this matter beyond the MSP world?
When an MSP is hit, the blast radius is every business it serves. A single break-in can encrypt hundreds of town councils, law firms or dental practices in one night. Regulators have noticed.
The US Securities and Exchange Commission's cyber disclosure rule, adopted in final form in July 2023 under Item 1.05 of Form 8-K, requires public companies to report material cyber incidents within four business days of determining materiality. That clock doesn't pause because the incident happened at a vendor. The SEC's final rule makes clear that third-party breaches count.
In the EU, the NIS2 directive pulls managed service providers directly into scope, placing incident notification duties on the same providers Acronis is addressing. We reported on 12 August how SEC and EU disclosure duties now sit squarely on affected firms, a pressure that makes Acronis's recovery checklist more than a sales document.
What should a customer of an MSP do with this?
Ask your provider to walk you through the six points, in writing, with dates. A customer who can't get a straight answer on how quickly their systems would be restored, and from backups stored where, is flying blind.
Two questions carry most of the weight. If production systems were encrypted tonight, when would the business be operational again tomorrow? And are backups held somewhere attackers can't reach from the network?
Neither question is technical. Both are answerable.
Common questions
Is this checklist a legal requirement?
No. It's guidance from a vendor. It does, however, line up with the recovery and reporting expectations built into the SEC rule and NIS2, so treating it as a floor rather than a ceiling is reasonable.
Do backups on their own still count as ransomware protection?
Not really. Modern ransomware groups hunt for backup servers first and delete or encrypt them before hitting production. Backups only help if they're isolated and paired with detection that catches the intrusion earlier in the chain.
