MSP certifications: which badges are real credentials
MSP certifications fall into four kinds. An examined credential names one person, like a CISSP, which takes five years of verified experience in two of eight domains. A vendor partner tier scores the company, partly on sales. An attestation covers controls. A trustmark is a program you join. Ask who holds it and whether it is current.
- Four kinds of badge sit on an MSP website. An examined credential held by a named person, a vendor partner tier held by the company, an organizational attestation about its controls, and a trade-association trustmark.
- CISSP is the hardest badge in the row to earn. It takes five years of verified full-time work experience in two of the eight exam domains, plus an endorsement from an existing certification holder.
- Microsoft scores partner designations out of 100 points. On the Security small-business track, three of the four metrics measure Microsoft revenue, product usage and customer count, and only one counts certified people.
- A Microsoft designation stays on display until its anniversary date even if the score falls below the 70-point bar, so the badge can outlive the qualification by months.
- Nothing certifies the category managed service provider, but ISO/IEC 20000-1 certifies a provider's service management system against an international standard, so ask whether they hold it and who audited it.
- The two MSP-specific programs belong to a trade association and to Microsoft, which stops accepting new enrollments in its own in September 2026.
What do MSP certifications actually prove?
MSP certifications prove four different things, and a row of badges never tells you which. An examined individual credential proves one named person passed a test on a stated date. A vendor partner designation proves the company met a vendor's scoring thresholds. An organizational attestation proves an auditor examined the company's own controls. A trade-association trustmark proves the provider joined an industry program. Sorting the logos into those four buckets changes every question you ask next.
The stakes are not academic. Verizon found a third party involved in 48 percent of breaches, a 60 percent jump in a single year. Your MSP holds administrator credentials inside your systems, so it is the third party with the deepest access you have. CISA, the NSA, the FBI and allied agencies warned that attackers deliberately target managed service providers to reach their customers. For most buyers the badge row is the only evidence they ever check.
This guide sorts the badges using what each issuing body publishes about its own credential. Nobody audits the logo row itself, so the issuer's rules are the only neutral reference available. Treat it as the badge half of provider due diligence, beside How to Choose a Managed Service Provider and Questions to Ask Before Hiring an IT Provider.
The four kinds of badge on an MSP website
Four kinds of badge appear on MSP websites, and each answers a different question. Naming the kind beats arguing about the merit.
- Examined individual credentials. One named person sat a proctored exam. CompTIA Security+, ISC2 CISSP and ISACA CISA sit here. Every one of them expires.
- Vendor partner designations. The company cleared a vendor's scoring thresholds. Microsoft's Solutions Partner designation is the most claimed. These describe the firm, and they are partly commercial.
- Organizational attestations and certifications. An external auditor examined the company's controls. SOC 2 and ISO/IEC 27001 sit here, and they are the strongest badges in the row.
- Trade-association trustmarks and audits. The provider joined an industry body's program and was reviewed against its framework. MSPAlliance's MSP Verify is the clearest example.
The categories matter because the failure modes differ. An examined credential goes stale. A partner designation can be earned largely on sales growth. An attestation covers a scope you have not read.
Examined individual credentials: what one person had to do
An examined individual credential tells you one named human passed a test on a stated date. It says nothing about the firm, and nothing about today.
CompTIA certifications expire after three years
CompTIA certifications expire, which is the most useful fact about the badges at the entry end of the row. CompTIA states that your certification expires three years from the date you earn it and must be renewed before that expiration date. Renewal runs on continuing education, since each certification requires a certain number of CEUs for renewal, with CE fees required for renewal and payable before you renew unless the holder passes a qualifying higher-level exam. An A+ or Security+ logo is a claim about a person who passed an exam at some point, and the badge art carries no date, so ask for it.
The quality signal worth knowing is accreditation, and it attaches to each certification rather than to the issuer as a whole. CompTIA announced that CloudNetX and DataAI gained ANAB ISO/IEC 17024 accreditation, alongside A+, Cloud+, CySA+, Data+, DataSys+, Linux+, Network+, PenTest+, Security+ and SecurityX, and describes the standard as internationally recognized standards for quality, validity and impartiality in assessment. ANAB is an independent accreditor, so this vouches for the exam rather than for the person who sat it. ISC2 says it was the first information security certification body accredited by ANAB, and that all nine ISC2 certifications are ANAB accredited.
CISSP takes five years of verified work experience and someone to vouch for you
CISSP is the hardest badge in the row to earn, because passing the exam is only half of it. ISC2 requires a minimum of five years cumulative, full-time experience in two or more of the eight domains of its exam outline. A degree or an approved credential satisfies up to one year of the required experience, and only one waiver is allowed. A candidate short of that can become an Associate of ISC2 by passing the CISSP examination and then have six years to earn the five years required experience. An Associate passed the exam. A CISSP passed it and had the work experience verified.
The verification step is a person, not a form. ISC2 requires the application to be endorsed by another ISC2 certified professional in good standing, who confirms that assertions regarding professional experience are true to the best of their knowledge, and it must be submitted within nine months of their exam date. Where no endorser is available, ISC2 will endorse the candidate itself, and then proof of employment is required for ISC2 endorsement. ISC2 also tightened its waiver list, which from 1 April 2026 requires a credential to have a publicly available exam outline and ANAB ISO/IEC 17024 accreditation.
The exam itself is specific and checkable. ISC2 publishes a length of exam of 3 hours with 100 to 150 items and a passing grade of 700 out of 1000 points. It weights eight domains, from Security and Risk Management at 16 percent through Identity and Access Management and Security Operations at 13 percent each down to Asset Security and Software Development Security at 10 percent each. ISC2 also warns that effective April 15, 2027, the CISSP exam will be based on a new exam outline.
CISA stays alive on an annual fee and 20 hours a year
CISA, from ISACA, looks similar at the front and behaves differently at the back. ISACA requires a minimum of 5 years of professional information systems auditing, control or security work experience, gained within the 10-year period preceding the application date for certification and verified by your supervisor or manager. Candidates have 5 years from the passing date to apply. CISA is an audit credential rather than an engineering one, which matters when a provider offers it as proof of hands-on risk management.
Keeping it is the part nobody checks. ISACA requires earning a minimum of 20 CPEs annually and a total of 120 CPEs over a 3-year period, plus an annual maintenance fee of US$45 for ISACA members and US$85 for non-members. Missing either will result in revocation of an individual's CISA designation. ISACA is blunter than most issuers about the paper on the wall, warning that if the annual requirements are not met, the three-year certificate is no longer valid. A framed certificate can be an expired credential.
That gives you a free check nobody uses. ISACA's tool needs the certification type, the certification number and the holder's last name exactly as it appears in their ISACA profile, and returns the annual expiration date and reflects the current verification status. Ask for the certificate number of the person who will work on your account.
How does renewal differ between issuers?
Renewal is where the issuers diverge most, and the difference is a fair proxy for what a badge costs to keep. Three patterns cover almost every certification on an MSP website.
- Continuing education plus a fee. CompTIA expires a certification three years from the date you earn it and requires CE fees before you renew.
- Credits plus an annual fee, enforced by suspension. ISC2 requires 120 CPE credits per three-year cycle, 90 of them in Group A and charges an AMF of U.S. $135. Miss the 90-day grace period after the cycle expiration date and the member is placed in suspended status. After two years, suspended members and associates will be terminated.
- A free, open-book assessment once a year. Microsoft renews associate, expert and specialty certifications annually and says there's no cost to renew. The assessment sits in a six-month eligibility window, is shorter than the original exam(s) and open book, and is unproctored. Microsoft Fundamentals certifications do not expire at all.
None of that makes a vendor certification worthless. It makes it different evidence. A proctored exam with verified work experience and a named endorser tests a career. A free unproctored refresh tests whether somebody kept up. A badge wall presents them as the same thing.
Vendor partner designations describe the company, and partly its sales
A vendor partner designation describes the company's relationship with the vendor, not the competence of the engineer who answers your call. Microsoft publishes exactly how its designations are earned, which makes this provable rather than cynical.
Microsoft scores partners with a partner capability score, defined as a composite score that quantifies the performance of a partner in three categories, those being performance, skilling and customer success. Each of these six solution areas has a maximum of 100 points across the three categories. To qualify, a partner needs a partner capability score for the solution area, for example Security, of at least 70 points, and every metric in the solution area is greater than zero points.
Three of the four Security metrics measure Microsoft's business
Read the Security scorecard and the balance is unmistakable. Microsoft lists four metrics, which are Performance - Net customer adds, Skilling - Intermediate certifications, Customer success - Usage growth and Customer success - Deployments. On the small and medium business track, each net new customer contributes four points for up to a maximum of 20 points, obtained from five customers. Deployments work the same way, where each net new customer contributes 3.3 points for up to a maximum of 20 points, obtained from six deployments. Usage growth is bought with consumption, since every Security Azure consumed revenue growth of USD 750 gets you one point, to a maximum of 20 points.
Only the skilling metric counts people. On the SMB track, step one earns four points even if more than one person completes it, step two earns another four for the Microsoft Security Operations Analyst certification, and then each certified individual adds eight points in Step 3. Microsoft lets the same human count across steps, noting that a person can count toward multiple steps, but only once per step. Put those published figures together. Three of the four metrics are capped at 20 points each, so 60 of the 100 available points measure Microsoft revenue, product usage and customer count. A firm that maxes all three reaches 60, and one individual holding the three listed certifications adds 16, clearing the 70-point bar on its own.
What a Solutions Partner badge does prove
A Solutions Partner designation proves three real things, and a fair buyer says so. The firm added Microsoft customers over the trailing 12 months. It grew deployments and product usage in that solution area. And it employs people who passed Microsoft's intermediate exams, with that part kept current, because Microsoft refreshes skilling subcategories typically within 10 days after certification is completed.
Two caveats decide what the badge is worth to you. The designation is scored per solution area, so a firm holding the Modern Work designation has not been measured on Security at all. And the badge is bought after it is earned. Microsoft says that once a partner achieves qualified status you're eligible to purchase a Solutions Partner designation, and that you need to purchase the solutions partner designation on the Membership offers page to get Enrolled in this solution area. That purchase step is not a scandal. It is why a partner tier is a commercial relationship as well as a measurement.
The badge can outlive the qualification by a year
A Microsoft designation stays on display for up to a year after a firm stops meeting the criteria. Microsoft states it plainly. A partner remains enrolled until your anniversary date regardless of increase or decrease in your score, and the valid-till date is 13 months from the date of the Solutions Partner designation purchase, including a one-month renewal window. So a badge you see today can reflect a score the firm last hit a year ago.
Specializations behave the same way, and they are the stronger Microsoft signal because an auditor is involved. To enroll in a Security specialization a partner must meet the requirements and schedule and pass the audit. The audit is not annual, though, because the audits and customer references requirements are revalidated every other year. After enrollment, Microsoft confirms that even if you don't meet all the qualification requirements, you'll still be enrolled in this specialization, and that a partner who loses the underlying designation won't lose your specialization inside that year. So do not ask whether a firm holds a vendor designation. Ask for its anniversary date, because that is when the claim was last tested.
Microsoft also lets a certified individual keep credit for a certification for one year after the certification's retirement date, so a designation can lapse quietly while the logo stays in the footer.
Does anything certify an MSP as a managed service provider?
Nothing certifies the category managed service provider, but something does certify how a provider runs its services, and it is the one badge in this group worth asking for by name. ISO/IEC 20000-1:2018 specifies requirements for an organization to establish, implement, maintain and continually improve a service management system, and the standard says it can be used by an organization or other party performing conformity assessments against the requirements specified in this document. It also says in terms that the organization in scope can also be known as a service provider. So a provider can hold a real, vendor-neutral certification against an international standard for service management. Ask whether they do, and ask who audited it. Beyond that, two programs aimed squarely at MSPs come closest, and each has an owner with an interest in it. One belongs to an industry trade association. The other belongs to Microsoft, which is closing it.
MSPAlliance runs the association program. It describes MSP Verify as the original audit and certification program built exclusively for Managed Service Providers, carried out by pre-approved, MSP-focused third-party auditors against its Unified Certification Standard, which it calls a globally recognized framework developed specifically for managed service providers. The result is described in MSPAlliance's own words as a Global Trustmark with recognition backed by MSPAlliance. That is honest, and it is also the boundary of the claim. An independent auditor did the work, and the body behind the mark is the trade association the provider belongs to.
Microsoft ran the vendor program, and is retiring it. Its Azure Expert MSP page now opens with a retirement notice. Effective September 15, 2026, Microsoft stops accepting new Azure Expert MSP enrollments, and renewals end in January 2027. Renewal had teeth, because partners had to meet the qualification requirements, submit the application, and schedule and complete an audit for a successful renewal. Microsoft now points partners towards the recently announced Frontier Partner specialization, which is a specialization rather than a managed-services audit.
Treat that as a finding rather than a complaint. A provider still showing an Azure Expert MSP badge in 2027 has not failed anything. The program behind it closed. Ask what replaced it.
Where SOC 2 and ISO 27001 fit in the row
SOC 2 and ISO/IEC 27001 belong in the organizational category, and they are the strongest badges most MSPs display. An external auditor examined the company's own controls, including its incident response process, which makes this the only category tested by someone with no stake in the answer. SOC 2 is an attestation rather than a certification, and the scope plus the observation period decide what it is worth to you. Read Is SOC 2 a certification? for that distinction, then Your MSP's SOC 2 does not cover you for the homework the report leaves you. Regulated buyers should add HIPAA vs CMMC vs SOC 2.
The three questions that work on any badge
Three questions sort any badge, and they work without knowing anything about the issuer in advance. Ask them in this order.
- Who holds it? A named person or the company. If a person, get the name, and confirm whether that person will touch your account.
- What did they have to do? An exam alone, an exam plus verified work experience, a vendor scoring threshold, or an external audit.
- Is it current? Get the date it was earned and the date it expires. For a company badge, get the anniversary date.
Every one of those questions has a public answer. ISACA's tool returns the annual expiration date and reflects the current verification status from a certificate number and a surname. CompTIA states the three-year expiry on its own renewal page. Microsoft publishes the full scoring framework for all six solution areas. None of this needs the provider's cooperation.
Read this beside what an MSP star rating measures, rating versus review count and what cybersecurity your MSP should include.
What to ask your provider this week
Six requests turn a badge row into something verifiable you can compare across three shortlisted firms. Send them in one email and give each firm the same list.
- Name the individuals behind each personal certification, and confirm which of them is assigned to your account.
- Ask for the earned date and the expiry date of every individual credential you were shown.
- Confirm whether a CISSP on the wall is a full CISSP or an Associate of ISC2 who has not yet had the experience verified.
- Request one certificate number for one named person, and verify it yourself with the issuer.
- Check which solution area a vendor partner designation covers, and get its anniversary date in writing.
- Compare what each firm claims against what its issuer publishes, rather than against what the other firms claim.
A provider who answers all six in one email is probably operating the way its badges imply. One who sends a logo sheet instead has also told you something. No badge, however well accredited, promises your network goes untouched. Badges narrow a shortlist. Your monthly report decides it.
A badge is a claim about a date. The only real question is which date, and who can confirm it.
FAQ
What certifications should an MSP have?
Ask for examined individual credentials held by named staff, such as CompTIA Security+, ISC2 CISSP or ISACA CISA, plus an organizational attestation like SOC 2. CISSP is the strongest personal signal, because ISC2 requires five years cumulative, full-time experience in two or more of the eight domains and an endorsement from an existing certification holder.
Do MSP certifications expire?
Yes, nearly all of them. CompTIA states that your certification expires three years from the date you earn it. ISC2 requires 120 CPE credits per three-year cycle plus an annual fee of U.S. $135. ISACA requires 20 CPEs annually, and non-compliance will result in revocation of an individual's CISA designation.
Is a Microsoft Solutions Partner the same as a certified company?
No. Microsoft scores partners out of 100 points across performance, skilling and customer success, and requires at least 70 points in the solution area. On the Security small-business track, net customer adds, deployments and usage growth are each capped at a maximum of 20 points, so most of the score measures Microsoft's business rather than an engineer's skill.
How do I verify an MSP's certifications?
Verify each one at the issuer. ISACA's tool needs the certification type, the certificate number and the surname, and returns the annual expiration date and reflects the current verification status. For a Microsoft designation, ask which solution area it covers and get the anniversary date, because a partner remains enrolled until your anniversary date regardless of increase or decrease in your score.
Is there a certification specifically for managed service providers?
Not the category itself, but a provider's service management system can be certified. ISO/IEC 20000-1:2018 sets requirements for an organization to establish, implement, maintain and continually improve a service management system and contemplates conformity assessments against the requirements specified in this document. The two MSP-specific programs are owned by interested parties: MSPAlliance describes MSP Verify as the original audit and certification program built exclusively for Managed Service Providers, with recognition backed by MSPAlliance itself, and Microsoft's Azure Expert MSP program is closing, with new enrollments stopping on September 15, 2026 and renewals ending in January 2027.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across North America. Organic ranking is earned on rating and verified data, and paid placement is always labelled. Take these three questions to three merit-ranked firms in your city and compare the answers side by side.