Key takeaways
- Onboarding questionnaire defines client scope: MSPs begin onboarding by collecting details on IT environment, cybersecurity tools, infrastructure, roles, and service requirements to create a customized plan aligned with client goals.
- Cyber risk assessment identifies vulnerabilities: MSPs evaluate access controls, attack surface, sensitive assets, and existing protections, noting risks like unrevoked third-party access.
- Welcome kit sets expectations and communication: Providing service summaries, SLAs, contacts, timelines, and communication protocols helps prevent misunderstandings, which contributed to 23% of SMEs leaving MSPs due to poor service experiences.
- Data migration requires careful testing: Importing data from multiple systems demands testing with dummy datasets to validate workflows, permissions, and integrations before live migration to avoid misconfigurations and potential breaches.
- Kickoff meeting aligns roles and objectives: MSPs review plans, define responsibilities, gather feedback, and document discussions while prioritizing client input to uncover risks and ensure onboarding progresses effectively.
What is the MSP Client Onboarding Process?
Congratulations! You’ve just signed a new client.
Hopefully, it’s also the beginning of a prosperous, long-term relationship. However, there are some key considerations before diving straight into delivering services.
In this blog, we’ll walk you through a step-by-step checklist on how to successfully onboard a new client from the moment you sign the contract to extending ongoing value that strengthens the partnership over time.
MSP Client Onboarding Checklist for Success
Start with an onboarding questionnaire: Each client is different. Whether they’re a smaller-sized firm or an enterprise with over 5,000 employees spread geographically, you need a clear picture of their current IT environment, challenges, priorities, and expectations. The onboarding questionnaire will serve as your roadmap, helping you uncover critical details that shape how you deliver services and set measurable goals that can be revisited during quarterly business reviews (QBRs) and ongoing performance evaluations.
A sample onboarding questionnaire should document the following details:
Service tier
Current cybersecurity tool stack (endpoint security, phishing protection, etc.)
Existing IT infrastructure (workstations and servers)
Client roles and access permissions
Contracts with existing third parties
Managed services requirements, such as cloud storage and systems management/monitoring
Incident response plans
Based on the client’s details, you’ll be able to create a customized onboarding plan that prioritizes immediate actions and aligns with their business objectives.
Assess their cyber risk posture: Conducting a cybersecurity risk assessment is an essential part of the client onboarding process. You need to have a thorough understanding of access permissions and controls, the client’s unique attack surface, which sensitive assets are at the are most at risk, what vulnerabilities exist in their systems, how endpoints and network devices are protected, and how current cybersecurity tools mitigate those risks.
There’s a good chance your client might not be aware of how many identities have privileged access, even after an employee has left the organization or a contract agreement has ended with a third-party service provider.
Why is this important? Because in 2024, 35.5% of all breaches were attributed to third parties. If access permissions and credentials aren’t rotated or revoked, their sensitive data remains exposed.
Here are some important security questions to ask clients during the onboarding process:
- Do third parties have admin access to cloud storage buckets?
- How are user identities created, modified, and deactivated?
- How are user roles and permissions assigned and reviewed?
- How is sensitive data classified and protected?
- Are there policies for managing service accounts and shared credentials?
- Are system logs collected, monitored, and analyzed for anomalies?
- Are privileged accounts regularly reviewed or revoked?
- How is access to cloud services controlled and audited?
- Is multi-factor authentication (MFA) enabled for all accounts?
Send your client a welcome kit: Expectations are the foundations for building long-term relationships and sustainable business growth. Poor expectations, such as inconsistent communication, overpromising on service deliverables, and setting unrealistic goals, can all lead directly to client churn.
Research showed that nearly a quarter (23%) of SMEs that have stopped working with MSPs did so due to poor customer service or had a bad experience with their account or sales teams. Not exactly the type of partnership either party is looking for once the agreement has been signed and set into action.
Your welcome kit should include:
- A clear summary of services and deliverables
- Defined SLAs and escalation paths for support issues
- Points of contact
- An FAQ or knowledge base for common client questions
- An introduction with a dedicated team member or account manager
- Milestones for project timelines
- Quarterly Business Review (QBR) schedule
- Communication protocols (phone, email, Slack, etc.)
Welcome kits should also include walk-through videos or practical guides that cover a range of topics, such as incident response, routine IT troubleshooting, employee security training, phishing awareness, and disaster recovery steps if a server or account is compromised. This demonstrates that you went the extra mile to keep their investment protected, beyond the initial scope of the agreement. Reassurance builds trust.
Importing data and integrations: Importing user data is a very delicate process. Pulling data from multiple sources, such as CRM platforms, email service providers, cloud environments, productivity suites, and existing cybersecurity tools, requires experienced professionals or a dedicated technical integration specialist to manage the migration, either in-house or outsourced.
A best practice is to create dummy data for testing before syncing with actual user data. Test various datasets before performing the live migration to ensure that workflows, field mappings, permissions, and integrations function properly. A single cloud misconfiguration can end in a breach. Always test before running the final live import.
The kickoff meeting: The onboarding process is almost complete. It’s now time to schedule that kickoff meeting to get the ball rolling. Use the kickoff as an opportunity to address any client concerns, review the onboarding plan in detail, define roles and responsibilities, and project timelines. Leave room for feedback, as well as discussion of any unique business requirements that may not have been covered in the initial onboarding questionnaire.
Get to know the client’s team well. Take the initiative to research them thoroughly and apply the 80/20 Rule during the meeting, where 80% of the time is spent listening to and understanding the client’s goals, pain points, and expectations, and 20% addressing additional concerns, even if the meeting runs longer than planned. This is your opportunity to establish rapport with the client and uncover hidden roadblocks that could delay the onboarding process and impact the delivery of services.
Document every detail during the conversation for reference throughout the onboarding process, ensuring that no critical information is overlooked and that all action items are prioritized accordingly. Set follow-up reminders to track progress and revisit any decisions that require client approval.
Congratulations, once again. The client onboarding process is officially completed.
Streamline the Client Onboarding Process with Guardz
Cloud data protection is a big part of the onboarding process. Guardz provides a unified cybersecurity platform that detects third-party apps used by employees or clients and scans cloud accounts for excessive permissions or other risks.
With Guardz, MSPs can quickly identify threats stemming from unusual geo-locations and suspicious user behavior, such as login activity outside of normal business hours or abnormal data transfers.
Give your new clients peace of mind by ensuring a smooth and secure onboarding process with Guardz.
Book a demo today.
