Who Is Your Named Engineer, and What Happens When They Leave?
A named engineer is sold as a benefit and carried as a concentration of risk. The test is not whether your provider has one. It is whether a second person could run your account on Monday. BLS projects 48,700 replacement openings a year in computer support alone.
- A named engineer is one person holding your environment in their head. That is a dependency, not a service level.
- BLS projects 48,700 computer support openings a year, and says all of them come from replacing people who leave the occupation.
- CISA publishes 34 cybersecurity performance goals. Not one mentions cross-training, succession or knowledge transfer.
- The joint MSP advisory says a shared account password should be reset when staff move on. You cannot see whether that happened.
- Ask for five documents, not an assurance. A document carries a date. A promise that someone else could cover costs nothing.
Who is your named engineer, and what happens when they leave?
Your named engineer is the one person at your provider who knows how your business actually runs, and their resignation takes that knowledge with them unless somebody wrote it down. The benefit is real. The dependency is yours.
Providers sell a named engineer as continuity of care. Written down plainly it is also a concentration of risk that you carry and your provider books as efficiency. One person who already knows which server is the odd one, which application breaks on a reboot, and which director must never be locked out costs less to run than two people who both have to learn. That trade works until the day it ends.
So the test is not whether your provider has a named engineer. It is whether a second person could pick up your account on Monday, and the evidence for that is documentation you can open rather than an assurance you were given. The Bureau of Labor Statistics projects about 48,700 openings for computer support specialists each year and states that all of those openings are expected to result from the need to replace workers who transfer to other occupations or leave the labor force. Somebody is always moving.
How likely is it that your named engineer leaves?
Likely enough to plan for. Two occupations cover most of the engineers who run small business IT, and the federal projections for both describe constant replacement. Employment of computer support specialists is projected to decline 3 percent from 2025 to 2035, yet the same page still projects 48,700 openings a year. For network and computer systems administrators the figures are a 4 percent decline and about 13,400 openings a year, again all from replacement. A shrinking occupation with tens of thousands of yearly vacancies is one where people move sideways.
Tenure says the same thing from the other direction. Median tenure with a current employer was 4.1 years in January 2026, and 20.6 percent of wage and salary workers had been in the job a year or less. The information industry runs longer at 4.9 years, which is still shorter than most relationships between a small business and its provider.
The monthly churn figure needs its scope stated carefully. Quits in professional and business services averaged 2.3 percent of employment per month across 2025, against 2.0 percent across all industries. That supersector is the right area at the wrong resolution: it bundles computer systems design firms with management companies and with administrative and waste services, and the published table carries no row beneath it. The latest month, August 2026, reads 2.1 percent and is still preliminary. These pages are republished on a schedule, so the figure you see will differ from ours, which we read on 21 October 2026.
Why no security framework catches this for you
No security framework catches key person risk, because it is not filed as a security problem. CISA's Cross-Sector Cybersecurity Performance Goals run to 34 goals across six functions, and not one of them mentions cross-training, succession or knowledge transfer. The nearest is goal 3.G, where separation of duties is maintained by distributing responsibilities across multiple individuals or roles, and that control exists to prevent fraud and error rather than to survive a resignation.
The two goals that come closest both stop short. Goal 1.A asks that all roles and responsibilities involving cybersecurity should be documented in an organization's cybersecurity policy, which is a documentation duty rather than a redundancy duty. Goal 1.E, written specifically about managed service providers, tells you to develop and maintain an understanding of the services, including the security products provided by MSPs and to proactively address any security gaps that fall outside the scope of the contract. Services and contracts, with nothing about who personally holds the knowledge.
One body of rules does name people, and which one it is tells you something. New York's cybersecurity regulation for financial services requires a continuity plan identifying documents, data, facilities, infrastructure, services, personnel and competencies essential to the continued operations of the business, and separately requires the plan to name the supervisory personnel responsible for each part of it. Personnel and competencies, listed beside infrastructure as a resource you are expected to inventory. That rule binds covered financial institutions in New York, not your business, so read it as the clearest published model rather than an obligation.
Key person risk is a continuity control, not a security control. That is why it sits outside every security checklist your provider is audited against, and why nobody in the stack owns it.
What makes a named engineer hard to replace is undocumented, not unique
What makes them hard to replace is the undocumented part, and the mechanism is ordinary. Nobody is irreplaceable. Undocumented knowledge is. Google's published site reliability practice lists it among the anti-patterns, creating experts on the team whose techniques and knowledge are compartmentalized, and the same chapter explains why nobody notices. Senior engineers keep state on the world and its changes in their own heads, while newer ones are much more in need of up-to-date documentation.
Read that twice, because it is the whole problem in two sentences. The person who could write the runbook is the one person who does not need it. So the record rots quietly while the expert is present, and the rot only becomes visible on the first morning they are not. It is also why a handover email is not a handover. Google's incident practice requires that the post of incident commander be clearly handed off and that the outgoing commander should not leave the call until receiving firm acknowledgment of handoff.
Published guidance treats documentation as a continuity control only when it is current and accessible. The New York rule requires that current copies of the plans or relevant portions therein are distributed to the employees who need them, and that those employees are trained in their roles. CISA asks that network documentation be updated when network topology changes are made and that network reviews should be performed and tracked on an annual basis. A network diagram with no date on it is a drawing from an onboarding project. A dated asset register and a dated diagram show somebody has maintained the record since.
You cannot reconstruct the missing knowledge from logs afterwards either. Microsoft retains Entra ID audit and sign-in logs for seven days on the free tier and 30 days on P1 and P2. If the engineer left two months ago, the record of what they changed in your tenant has already expired.
What should happen to their access on their last day
Their accounts should be disabled the same day and any shared credential they knew should be rotated. The seven-agency advisory on managed service providers says both. It tells both sides to grant access and administrative permissions on a need-to-know basis, using the principle of least privilege, and in its offboarding guidance to disable user accounts when personnel transition. On shared logins it goes further, saying a shared account password should be reset when personnel transition.
That shared password reset is the one you cannot verify, and it is the real gap. A reset inside your provider's own vault leaves no trace in your environment. Nothing appears in your tenant, no ticket reaches you, and the engineer's name was never on the account to begin with. The advisory's answer is to remove the shared account altogether. It tells providers not to reuse admin credentials across multiple customers and asks customers to verify, via audits, that MSP accounts are being used for appropriate purposes and activities. Named individual accounts are what make a departure visible to you at all.
The stakes are ordinary rather than exotic, because your provider is your largest third party. Verizon found a third party involved in 48 percent of all breaches, and Sophos found 79 percent of ransomware attacks start with compromised identities. Privileged access that outlives the person is both of those findings at once. How fast that access is revoked, and who confirms it to you in writing, is covered in Who at Your MSP Can Log Into Your Systems at 2am?. The non-human version, logins with no owner at all, sits in Service accounts: the logins nobody owns.
Does a named engineer mean anything in writing?
Not by itself. No standards body defines a named engineer, a dedicated technician or a primary contact, and no certification tests one. The closest relevant standard certifies the provider's management system rather than its staffing: ISO/IEC 20000-1 specifies requirements for an organization to establish, implement, maintain and continually improve a service management system. That governs how work is managed. It says nothing about which human does yours.
Treat the phrase as a commercial promise, then make it verifiable. Published guidance already supplies the shape. The UK's National Cyber Security Centre tells organizations to record at least 2 contact methods and 2 or more people for key contacts, and to consider deputies and a process to enable others to make decisions, should the primary contact not be available. A national cyber authority treats the primary contact's absence as a planning assumption rather than an exception, and your service level agreement can do the same. Name the role, name the deputy, state who escalates when neither answers, and state what the provider maintains in writing for your account.
Ask about the other side too. CISA's offboarding goal expects that organizations should have a defined and enforced administrative process to off board staff. Your provider is an organization with staff, so ask to see its offboarding process and who it cross-trains on your account.
Five things to ask for that prove a second person could take over
Ask for five documents rather than five assurances. Each one is a record or an access list, so it either exists with a date on it or it does not.
- Request the runbook for your environment, with the date of its last change. It should name the odd server, the application that breaks on a reboot, and the accounts that must never be locked out.
- Name the deputy in writing, with the same two contact methods as your primary contact, and ask when that person last worked a ticket on your account.
- Date the asset register and the network diagram. An undated diagram is an onboarding artefact rather than a current record, so check five things you know exist against it.
- List every account the provider's staff hold in your systems, by individual name. A shared login means a departure is invisible to you.
- Record the recovery numbers per system, the escalation path, and the offboarding process your provider follows when one of its own people leaves.
Then read the answers for dates rather than for tone. A provider that produces four of the five inside a week and commits to the fifth in writing has behaved well. A provider that answers all five with reassurance about how experienced its team is has just told you where the knowledge lives. Recovery windows are the one item with a standard shape, and RTO and RPO explained gives you the two numbers to ask for. The wider document set sits in 8 documents your MSP should be able to hand you.
None of this makes a provider immune to losing people, and no honest provider claims it will. It makes the loss survivable, because the knowledge sits in a record you can hand to whoever inherits the account. Our own directory data shows a median of 16 listed providers per market across 730 city datasets, so if the answers come back thin, the shortlist is not.
FAQ
What is a named engineer at an MSP?
A named engineer is a single technician assigned as your main contact and account owner. No standards body defines the term and no certification tests it. ISO/IEC 20000-1 certifies a provider's service management system rather than any staffing promise, so the meaning comes only from your own contract.
What happens when my MSP's engineer leaves?
Your account moves to someone who does not know it, at the speed of whatever was written down. The provider should disable the leaver's accounts and rotate shared credentials, since the joint MSP advisory says to disable user accounts when personnel transition. Ask for the runbook date and the deputy's name.
How do I know whether my provider documented my environment?
Ask for the asset register and the network diagram, then read the dates. CISA expects documentation to be updated when network topology changes are made and reviewed annually. An undated diagram, or one that misses five things you know exist, means nobody has maintained the record since onboarding.
Is having a named engineer a bad thing?
No. It is efficient for the provider and comfortable for you, and the risk is only the part nobody writes down. Median job tenure is 4.1 years, so plan for the departure instead of hoping. A named deputy and a dated runbook keep the benefit and drop the dependency.
Should my contract name a specific engineer?
Name the role and the deputy rather than the individual. People leave, and a clause naming one person stops meaning anything the week they resign. The NCSC advises recording at least 2 contact methods and 2 or more people for key contacts, which is the shape to copy into a service level agreement.
Best IT MSP is an independent directory of managed IT providers across the US and Canada. We rank on verified rating and firmographic data, we label paid placement, and we do not sell IT services. Take these five requests to three providers in your city and compare what comes back.