The One-Page Service Review a Busy Owner Can Actually Run
A one-page IT provider service review holds ten questions and runs in 30 minutes. Each line earns its place, because a published interval sets the bar or the evidence already sits on a screen. CISA asks for quarterly reviews of access permissions and for backup restore tests no less than once per year.
- Ten lines fit on one page. Six carry a published interval, and four ask for a screen that already exists.
- Quarterly is the tightest published cadence on the page, set by CISA for reviews of access permissions and role assignments.
- Four obvious questions are excluded on purpose. Entra ID Free keeps sign-in logs for seven days, and firewall defaults are often shorter.
- Give no notice. A list sent ten days ahead measures your provider's preparation rather than the state of your systems.
- No authority publishes a service review template for an outsourced IT provider, which is why every vendor checklist defends none of its lines.
What goes on a one-page IT provider service review?
A one-page IT provider service review holds ten questions and runs in 30 minutes. Six carry a published interval, so a date either sits inside the window or it does not. Four ask for something already on a screen. Four more questions are deliberately left off, because the record expires before you could ask.
Every line below states the reason it earns its place. That reason is the only thing separating this page from the checklist a vendor hands out at a trade show. A line with no basis behind it produces an opinion, and you already have one of those.
We made the critical case in Is Your MSP's Quarterly Business Review a Sales Meeting?. This is the constructive half. A quarterly meeting needs its agenda sent in advance, because half of it rests on data somebody must assemble. This half hour is a different instrument and works for the opposite reason.
Why no notice beats a prepared deck
Give no notice and you measure your systems. Give ten days and you measure your provider's preparation. Both readings are worth having, and they are not the same instrument.
A prepared report tells you what your provider can assemble when asked. A live screen tells you what is true now, including whether anyone knows where to look. The second finds a problem in half an hour, because nothing on the page can be built between your email and the call.
The same artifact flips value with the tense of your question. A screenshot of today's administrator list is nearly worthless to an auditor, who tests a past period and samples from history, as the audit evidence nobody collects sets out. In a 30-minute service review that screenshot is the strongest thing in the room, because your question is about the present. IBM reports an average of 247 days to identify and contain an active breach across all industries, so a calm dashboard reports what was detected rather than what happened.
Six lines with a published interval behind them
Six lines inherit their pass mark from a published interval, so the answer is a date and the verdict is arithmetic. CISA's performance goals supply five and the FTC supplies the sixth.
- Access review. CISA asks organizations to perform quarterly reviews of access permissions and role assignments. Ask the date of the last one and who ran it. Auditing your MSP's access lists what the record holds.
- Restore test. CISA asks you to test backups and recovery on a recurring basis, no less than once per year. Ask the date and the duration, because a success email is not a restore test.
- Incident response drill. CISA states that IR plans should be reviewed and drilled, at a minimum, on an annual basis. Ask the drill date and the after action report it produced, the artifact an untested incident response plan tells you to demand.
- Security awareness training. CISA asks you to provide at least annual cybersecurity training for all organizational users. Ask for completion per person, dated, not one percentage.
- Network documentation. CISA states that network reviews should be performed and tracked on an annual basis. Ask when the diagram was last reviewed, not whether one exists. The IT asset register you can demand covers the fields.
- Vulnerability assessment. The FTC Safeguards Rule requires vulnerability assessments at least every six months, and whenever there are material changes to your operations or business arrangements, absent effective continuous monitoring. That rule binds financial institutions under the FTC's jurisdiction, so treat six months as a published yardstick rather than your obligation.
Note the shortest interval there. Quarterly is the tightest cadence any of these sources sets, and that is where the review's own schedule comes from. You cannot source the meeting. You can source every question inside it, then hold the meeting as often as its shortest line requires.
Two further published intervals sit in reserve. CISA asks that policies for managing the cybersecurity program are reviewed at least annually, and that you review user access and disable accounts when inactive for a specified period, giving 30 days as the example.
Four lines that ask for something already on a screen
Four lines ask for a screen rather than a document, because a screen cannot be assembled in the ten minutes before your call. Ask your provider to share their display and navigate while you watch.
- The admin account list. Who holds global administrator in your tenant today, and which of them work for you. Who is your global admin? covers a safe answer.
- Patch state right now. The live console view, not last month's PDF. Patch compliance rate explained sets out how that percentage gets flattered.
- The last backup job and the last restore job. Two rows in the same console. Most providers show the first instantly and go looking for the second.
- Tickets open past 30 days. A filter, not a report. First response or resolution explains why a headline service level agreement number hides that tail, and ticket data only helps once you can see it.
Then name what genuinely needs preparing and move it to the quarterly meeting. An access review record, an after action report, a risk register with owners, and ticket volume trended across four quarters all have to be produced by a person. Asking for those live is unfair and teaches you nothing.
A posture number belongs in the live block with a caveat. Microsoft publishes Secure Score in its own portal and updates it in real time, and also states that it isn't an absolute measurement of how likely your system or data could be breached. Secure Score is not a grade explains the rest.
Four questions we leave off, because the record has already expired
Four obvious questions are excluded, because a retention window has already destroyed the answer. Ask them anyway and you spend a line to collect the words we would have to check.
- Who signed in to that account in July. On Microsoft Entra ID Free, audit logs and sign-ins are both retained for seven days, against 30 days on P1 and P2. Microsoft adds that log retention changes aren't retroactive, and data that has already expired can't be recovered unless it was previously archived. See log retention and breach dwell time.
- Show me the firewall logs from that incident. Sophos found missing logs due to data retention issues doubled over last year, largely driven by firewall appliances where the default was only seven days, and in some cases, 24 hours, across 661 incident response and MDR cases handled between November 1, 2024 and October 31, 2025.
- Pull the files of the person who left in June. Microsoft states the default retention period for OneDrive is also 30 days, after which the account is moved to the site collection recycle bin, where it's kept for 93 days. It adds that the Recycle Bin isn't indexed and therefore searches don't find content there, so a search returns nothing while the data exists. See departed employee OneDrive data.
- Pull last year's mailbox activity. Microsoft records that the default retention period for Audit (Standard) changed from 90 days to 180 days, so anything older is usually gone on a standard licence. Microsoft 365 deletion windows collects the rest.
Replace each unanswerable question with a live one, which is the trick. Instead of asking what happened in July, ask what the retention setting reads today and who changed it last. That has an answer, it takes 30 seconds on a screen, and it decides whether next quarter's version will be answerable.
One regulator pushes the same way. The FTC Safeguards Rule requires covered firms to dispose of customer information no later than two years after the last date the information is used and to periodically review your data retention policy to minimize the unnecessary retention of data. Short retention is sometimes the compliant answer, so a missing record is only a failing when nobody chose it.
Which lines rest on a published definition, and which are sensible questions
Four terms on the page carry a definition published by a standards body, and the rest are sensible questions. Saying which is which keeps the service review honest when your provider disputes a number.
- Recovery time objective. NIST defines it as the overall length of time an information system's components can be in the recovery phase before negatively impacting the organization's mission or mission/business processes.
- Recovery point objective. NIST defines it as the point in time to which data must be recovered after an outage, and RTO and RPO explained covers how to set both numbers.
- Mean time to detect. NIST defines it as a metric that tracks the average amount of time that a problem exists before it is found.
- Risk register. NIST defines it as a central record of current risks, and related information, for a given scope or organization, comprising accepted risks and risks with a planned mitigation path. A risk exception register shows the accepted half in practice.
Everything else is a question, which is not a weakness once you label it. Time to first response is defined by your own service level agreement rather than any standard, which is why two providers quote the same number and mean different things. Ask for the definition in writing beside the figure, which makes the line verifiable rather than arguable.
Nobody authoritative publishes this page
No standards body or regulator publishes a service review template for an outsourced IT provider. What exists is duties without a cadence, and principles without a question set.
CISA's current baseline added a goal for this relationship. Goal 1.E sets the outcome that the risks posed by a managed service provider are identified, recorded, assessed, prioritized, monitored, and updated over the course of the relationship, naming no interval and no artifact. Supervising the IT provider you already have establishes that no authority will name a review interval at all, which is why this page borrows its intervals from the activities.
The joint advisory from CISA, the NSA, the FBI and allied agencies goes further on duties and no further on method, telling customers to verify, via audits, that MSP accounts are being used for appropriate purposes and activities and to ensure these plans are tested at regular intervals. The UK's national cyber authority proposes a series of 12 principles, designed to help you establish effective control and oversight of your supply chain, and states on the same page who the guidance is for: large organisations, the public sector and cyber security professionals. Principles aimed at an organisation with a procurement function are not a thirty-minute review for an owner with twenty staff.
So a vendor checklist is not weak for being a vendor's. It is weak because no line states its basis. Apply one test to any checklist, including this one. For each line, name the published interval it measures against, or the screen the answer already sits on. Delete every line that answers neither.
How to run the half hour
Run it in four blocks, with one person writing down dates, and send the dates back the same day.
- Minutes 0 to 8. The dates. Work the six interval lines and write a date beside each. No discussion yet.
- Minutes 8 to 18. The screens. Ask your provider to share their display and navigate the four live views while you watch.
- Minutes 18 to 25. The settings. Read the retention values rather than asking for history, and note who changed each one last.
- Minutes 25 to 30. The gaps. Read back every line with no date on it. Those are the findings, and they go in writing.
A missing date is a finding rather than an accusation, and it is often yours as much as theirs. Most of these activities were never assigned to anybody, the pattern in who owns what. Document each gap with an owner and a date in the room, then monitor the same lines next quarter. Where a gap came from a request nobody escalated, fix the routing before you buy anything.
If three or four lines come back without a date twice running, the problem is capacity rather than goodwill. Across our own directory the median market carries 16 listed providers on page one, so an independent shortlist of vetted firms exists wherever you are.
A line that cannot name its published interval or its screen is somebody's marketing. Delete it, and the page gets shorter and better at the same time.
FAQ
How often should I review my IT provider?
Quarterly, if you build the page from published intervals. No authority sets an interval for the review itself, but CISA asks for quarterly reviews of access permissions and role assignments, which is the tightest cadence on the page. Hold the review as often as its shortest line requires, and the schedule stops being arbitrary.
What should I ask my IT provider in a 30-minute review?
Ask for ten things. Six dates, covering the last access review, restore test, incident response drill, training round, network review and vulnerability assessment. Four live screens, covering global administrators, current patch state, the last restore job, and tickets open past 30 days. Dates and screens both resist preparation.
Should I send the questions to my provider in advance?
No, not for this review. A list sent ten days ahead measures what your provider can assemble, which is the right test for a quarterly meeting and the wrong one here. Ask only for console access in advance. Everything on a one-page review already exists, so notice adds nothing except time to tidy.
Why leave firewall logs off a service review checklist?
Because the logs are usually gone. Sophos found missing logs due to data retention issues doubled over last year, driven by firewall appliances where the default was only seven days, and in some cases, 24 hours. Ask what the retention setting reads today instead. That question has an answer you can verify.
Does any authority publish an IT provider review checklist?
No. CISA's performance goals set the outcome that managed service provider risks are monitored, and updated over the course of the relationship without naming an interval or an artifact, and the UK NCSC offers a series of 12 principles written for large organisations and the public sector rather than a question set an owner could run. Published intervals exist for the activities, never for the review.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across North America. Organic ranking is earned on rating and verified data, and paid placement is always labelled. Take this one-page review to three merit-ranked firms in your city and compare the dates they can produce.