MSP Cybersecurity Checklist 2025: Protect Against Ransomware & Threats

Cyberattacks, from ransomware to phishing attempts, continue to evolve every day. We’ve extensively discussed the cybercrime and cybersecurity statistics in the US and UK, along with seven of the most important cybersecurity statistics in 2025, so it’s safe to say that most people know (or at least are aware) of the persistent danger caused by various threat actors.

But, what does that really mean for your MSP?

After all, knowing one thing and preparing for it are two different concepts. In this practical guide, we’ve detailed an MSP cybersecurity checklist for 2025, covering topics such as building a zero-trust architecture for MSPs and evaluating tools for AI-driven threat detection.

Want a PDF copy of the checklist you can refer to later? Download it here.

MSP cybersecurity best practices for 2025

Here’s a quick table you can refer to (we’ll discuss each later on). The goal isn’t to overwhelm you by suggesting you need to take action on all of these recommendations at once. Instead, we simply want to give you a list you can refer back to and gradually work your way down as time and priorities allow.

Keep in mind that improving security isn’t a one-and-done activity; it’s an ongoing process. Just remember, any improvements you can make now will be far less time-consuming/expensive than dealing with an active attack, so don’t put off getting started.

💡Note: These MSP cybersecurity checklist recommendations obviously aren’t comprehensive. Depending on your specifics (size, infrastructure, etc.), some may not be appropriate for your business. Do what’s practical, take a layered approach, and remember, when implementing new controls, it’s always a good idea to test them first to avoid unintended disruption.

What’s new in 2025: Emerging best practices for MSPs

Restrict network access

Controlling who has access to your systems — and how they authenticate — is the cornerstone of MSP cybersecurity. Passwords alone are no longer sufficient. Attackers frequently exploit weak or reused credentials to gain a foothold in networks. By implementing strong access controls like MFA and role-based permissions, MSPs can drastically reduce the likelihood of unauthorized entry.

• Inventory and classify assets. Maintain an up-to-date inventory of all network assets, categorizing them by risk level.
• Enforce strong password policies. Utilize complex, unique passwords and implement a reliable password management solution.
• Implement MFA. Apply MFA across all systems to add an extra layer of security.
• Eliminate default usernames. Avoid using generic usernames like “admin” or “user.” We discuss this in more depth in “What is credential management?”
• Apply the least privilege principle. Ensure users have the minimum level of access necessary for their roles.
• Audit inactive accounts. Regularly review and disable accounts that are no longer in use.
• Prevent lateral movement. Use Active Directory and Windows Firewall to restrict workstation-to-workstation communication.

Network hardening

Segmenting systems, disabling unnecessary communication pathways, and actively auditing account access are key strategies for minimizing exposure. A hardened network structure significantly reduces the opportunity for attackers to move laterally inside an environment after initial compromise.

• Classify network zones by sensitivity. Define zones (e.g., public, internal, confidential) and restrict access to each based on role and function.
• Use VLANs and firewall rules. Segment your network and apply strict firewall policies to minimize unnecessary communication.
• Conduct regular audits. Review system configurations and access logs to detect misconfigurations or unauthorized behavior.
• Remove unused services and ports. Reduce your attack surface by disabling functions and closing ports that aren’t needed.

Secure remote management tools

Remote Monitoring and Management (RMM) tools are essential to MSP operations, but they also represent one of the most attractive targets for attackers. If compromised, these tools can be used to execute ransomware, exfiltrate data, or disable security controls across multiple client environments simultaneously. For this reason, it’s critical to lock down access, limit privileges, and implement robust monitoring and logging.

• Restrict tool access. Limit access to remote management tools to essential personnel.
• Regularly update software. Keep all remote management tools up-to-date with the latest security patches. Read this guide on security patching for a more in-depth explanation.
• Monitor remote sessions. Implement centralized logging and real-time monitoring of remote access sessions.

Protect Remote Desktop Protocol (RDP)

Securing RDP may be basic security 101, but failure to do so continues to be one of the leading causes of compromise. A quick Shodan scan shows millions of systems currently exposing RDP. They’re undoubtedly being subjected to brute-force attacks. Once cracked, access to compromised accounts can be purchased for a handful of dollars on dark web marketplaces.

Compromise via RDP has been the go-to attack vector for numerous ransomware variants, including CrySiS/Dharma, Shade, and SamSam, the ransomware used to infect Allscripts, numerous hospitals, and the city of Atlanta.

• Avoid exposing RDP to the internet. Only expose RDP when absolutely necessary and secure it appropriately.
• Use port scanners. Regularly scan for open RDP ports using tools like Nmap or Shodan.
• Disable unnecessary RDP access. Turn off RDP on machines that do not require it.
• Implement account lockout policies. Set policies to lock accounts after a defined number of failed login attempts.
• Restrict RDP access. Use firewalls, RD Gateways, or VPNs to control RDP access.
• Enable Network Level Authentication (NLA). Add an extra layer of authentication before establishing RDP connections.

Endpoint protection

Endpoints — from laptops to servers — are often where attacks begin. MSPs must implement advanced protection solutions like EDR or NGAV, along with a disciplined patch management strategy and strong local firewalls. Ensuring that vulnerabilities are swiftly closed and endpoint behaviors are monitored is critical to maintaining client safety.

• Deploy advanced endpoint protection. Implement a next-generation antivirus (NGAV) or endpoint detection and response (EDR) tool that uses machine learning and behavioral analysis to catch threats traditional AV might miss.
• Automate patch management. Automatically identify and deploy updates to operating systems and third-party applications to close vulnerabilities quickly. Check out this guide on how to automate patch management for additional information.
• Implement DNS filtering. Prevent access to malicious websites by blocking known harmful domains at the DNS level.
• Enable and configure host firewalls. Use host-based firewalls to restrict inbound and outbound traffic based on predefined rules and block suspicious communication.

Email and user security

Phishing remains the number one delivery method for malware and account compromise. With the rise of blackhat AI tools, the sophistication of attacks continues to grow. MSPs should enforce domain authentication (DMARC, SPF, DKIM), deliver frequent user training, and deploy modern anti-phishing filters to reduce their exposure.

• Enable DMARC, SPF, and DKIM. Authenticate your domain to prevent spoofing and increase email trustworthiness. We’ve written a guide on how to set up an email server for your business to help you get started.
• Conduct phishing simulations and security awareness training. Educate users through hands-on simulations and training to help them identify and avoid phishing and social engineering threats. We talk about this more in “Building a Culture of Security: Practical Tips to Spot Phishing”.
• Block macro-enabled documents and suspicious attachments. Automatically filter and prevent the execution of malicious documents that are commonly used to deliver ransomware or malware payloads.

Harden Windows systems

Many modern attacks exploit built-in Windows features like PowerShell, WMI, or legacy scripting tools. MSPs need to lock down or disable these “living off the land” tools whenever possible. Hardening configurations such as Credential Guard, AppLocker, and UAC settings add powerful defensive layers. Properly hardened endpoints can disrupt attacker playbooks before they ever take hold.

• Enable Credential Guard: Protect against credential dumping
• Restrict PowerShell usage: Limit the use of PowerShell to necessary functions and users.
• Implement application whitelisting: Use tools like AppLocker to control which applications can run.
• Block unnecessary binaries: Prevent the execution of potentially harmful built-in Windows tools.
• Utilize Windows firewall: Configure firewall settings to isolate endpoints and block unwanted traffic.

Secure Microsoft Office applications

Malicious Office documents continue to be one of the most popular and successful delivery vehicles for malware. The key to mitigating that threat is to disable or restrict the following features.

• Disable macros. Prevent the execution of macros in Office documents unless absolutely necessary.
• Restrict OLE and DDE. Limit the use of Object Linking and Embedding and Dynamic Data Exchange features.
• Control data connections. Manage and restrict automatic data connections in Office documents.

Monitoring & response

Detection without response is like hearing an alarm but never checking the door. MSPs must centralize logging, deploy EDR and/or SIEM tools, and configure alerts for critical events. Just as important: Build and routinely test an incident response plan so your team knows exactly what to do when an incident happens.

💡Note: There are basic things you can do here, but on the advanced end, it often involves utilizing complex tools, combing through logs, and providing 24/7 monitoring/response capabilities. Depending on your expertise, bandwidth, and requirements, you may need to consider outsourcing.

• Deploy EDR and/or SIEM for real-time visibility. Implement endpoint detection and response or a security information and event management system to catch threats and anomalies in real time.
• Establish alert baselines and monitor critical event IDs. Define which events warrant alerts and track key Windows Event IDs to detect signs of compromise.
• Centralize and isolate log storage. Store logs in a tamper-resistant, isolated location for audit readiness and forensic analysis.
• Create and test your incident response plan regularly. Build a playbook for responding to security events and run tabletop exercises to make sure your team knows exactly what to do.

Backups & disaster recovery

A well-configured backup can be the difference between recovery and ruin. MSPs should use immutable and off-site backup systems, validate their restore processes regularly, and align recovery time objectives (RTO) with client expectations. Never assume your backup is working; test it.

• Use immutable backup systems. Store backups in a write-once, read-many (WORM) format so they can’t be altered or deleted by attackers.
• Replicate data off-site and encrypt backups. Maintain encrypted copies of your backups in off-site or cloud locations to ensure availability during physical or network compromise.
• Perform full-scale restore testing. Regularly simulate disaster recovery scenarios to confirm your backups can be restored successfully.
• Review backup policies and RTO/RPO alignment quarterly. Evaluate backup frequency and recovery goals every quarter to ensure they align with evolving client and operational needs.

What’s new in 2025: Emerging best practices for MSPs

Zero-trust architecture

Always assume a breach. That’s the foundational mindset of zero-trust architecture. Every user, device, and action must be verified, authenticated, and continuously monitored. This model helps prevent lateral movement and improves enforcement of least privilege policies.

AI/ML threat detection

Modern threats evolve faster than human analysts can respond. By leveraging artificial intelligence and machine learning for behavioral detection, MSPs can identify suspicious activity in real time. AI-powered tools complement traditional defenses and provide faster, smarter alerting.

Cyber insurance alignment

More insurers are requiring proof of security controls like MFA, immutable backups, and EDR to issue or renew policies. By aligning your internal posture with insurance expectations, MSPs can better manage risk and secure appropriate coverage.

Compliance readiness

Clients in regulated industries expect MSPs to follow recognized security frameworks. Aligning your practices with standards like NIST CSF, ISO/IEC 27001, or CMMC 2.0 demonstrates maturity and helps attract (and retain) security-conscious customers. Some great resources to check out:

• NinjaOne: Your Ally in Navigating NIS2 Readiness
• NinjaOne is ISO27001 Compliant
• What Is ISO Compliance? Overview & Importance
• A Guide on CMMC 2.0 Certification: How to Get CMMC Certified

Continuous improvement is key to MSP cybersecurity success

Depending on how much you’ve already invested in security, this list may feel overwhelming. If that’s the case, just remember, security isn’t something anyone gets 100% on. Things are always changing, and the goal isn’t to become magically bullet-proof; it’s simply to make sure you’re consistently taking small steps forward.

Use this guide to prioritize and implement MSP cybersecurity best practices for 2025, and focus on steady, incremental improvements. Do a few things from this list at a time. Or even just one thing. Then do another. Aim for incremental progress. Everything you do can have an impact. If you’re lowering your risk or raising the bar for attackers, even slightly, then you’re doing your job.

Want a PDF copy of the checklist emailed to you? Download it here.