A monthly report says the helpdesk closed 73 tickets. Is that good?
Perhaps. It may mean support is responsive. It may also mean the same printer, unstable Wi-Fi or account problem returned every week. Ticket volume describes activity; it does not tell the owner whether operations are becoming more reliable, recoverable or secure.
A useful managed service review should connect technical work to business outcomes. NIST’s Cybersecurity Framework 2.0 Small Business Quick-Start Guide was written for smaller organisations with modest or no formal cyber programme. Microsoft’s cloud operations guidance similarly frames operations around workload criticality, service commitments, monitoring, protection, recovery and cost control. [1][2] Those ideas translate well into seven management questions.
1. Do we know everything we are responsible for?
Ask for an asset and service inventory that identifies devices, servers, network equipment, cloud resources, critical applications, owners and support status. The report should highlight discoveries, retirements and assets that remain unmanaged—not simply show a total.
CIS Control 1 calls for an accurate, current inventory covering physical, virtual, remote and cloud assets. Its assessment guidance also measures completeness and unauthorised assets. [3] If the MSP and client cannot agree on what exists, patching, backup and incident response coverage cannot be demonstrated properly.
2. Were critical services usable when the business needed them?
Availability should be reported by business service, not only by device. “All servers online” is weak reassurance if the sales portal could not process an order. Define the services that matter, their operating hours, dependencies and agreed targets.
The monthly review should show material outages, duration, affected users, business impact and whether the service commitment was met. Planned maintenance and customer-caused delays should be separated from unplanned interruption so the discussion remains fair.
3. Is technical risk shrinking or ageing quietly?
Request a clear exception list: critical patches not deployed, unsupported systems, high-risk vulnerabilities, security tools not reporting, and configuration gaps. For each exception, show its age, exposure, owner, next action and target date.
A percentage alone can hide the problem. Ninety-eight per cent patch compliance may look healthy while the remaining two per cent includes an internet-facing system. The report should make that exception visible without burying management in a raw scanner export.
4. Are identities and access still appropriate?
The MSP should report privileged accounts, MFA exceptions, dormant accounts awaiting removal and access-review actions. This is particularly important when employees leave, vendors finish projects or administrators share responsibilities across multiple systems.
CISA’s small-business guidance prioritises strong authentication alongside updates, logging, backups and data protection. [4] The useful metric is not “MFA enabled”; it is which relevant accounts are covered, which are excluded and who accepted each exception.
5. Can the company actually recover?
“Backup successful” describes a job, not a recovery. Ask what data and systems are protected, where copies are held, how failures were handled and when a restore was last tested. Agree the recovery point and recovery time needed for each critical service.
A restore test should record what was recovered, how long it took, what failed and what changed afterwards. If recovery has never been exercised, the monthly report should show that as an open business risk rather than a green backup icon.
6. Did incidents lead to permanent improvement?
For significant incidents, ask for cause, containment, recovery, recurrence risk and corrective action. Response-time charts are useful, but repeated incidents deserve a problem-management action even when every individual ticket met its SLA.
Hypothetical example: a 35-person distributor records 58 closed tickets in one month. Twelve came from the same warehouse connection, and a failover test had not been completed. A ticket-only report looks busy and successful. An outcome report identifies one recurring fault, one untested continuity control and the investment decision management must make. This is an illustrative scenario, not an AXO client case.
7. What decision does management need to make next?
The final page should show the next 30 to 90 days: renewals, end-of-support systems, capacity constraints, licence waste, cloud-cost variance, security improvements and projects needing approval. Each item needs an owner, due date and business consequence if deferred.
Microsoft’s cloud operations model explicitly includes asset inventory, performance monitoring, operational compliance, workload protection, incident recovery, platform maturation and cost optimisation. [2] An MSP report should therefore end with decisions and improvement priorities, not a gallery of tool screenshots.
A practical monthly review
Keep the meeting short enough to use. Review service health, unresolved exceptions, recovery evidence and the improvement roadmap. Record decisions separately from discussion. Anything requiring the owner’s acceptance—risk, budget, downtime or project priority—should be stated plainly.
Ticket counts still have value for staffing and trend analysis. They simply should not be the headline measure of a managed service. The better question is whether the provider is helping the business understand its technology, reduce preventable disruption and recover with confidence.
To discuss a practical managed infrastructure and security operating model for your organisation, contact AXO Technologies.
Sources
[1] NIST SP 1300, published 26 February 2024; checked 7 October 2026: NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide.
[2] Microsoft Learn, updated 10 April 2026; checked 7 October 2026: Understand cloud operations functions.
[3] Center for Internet Security, CIS Controls Assessment Specification v8.1; checked 7 October 2026: CIS Control 1: Inventory and Control of Enterprise Assets.
[4] Cybersecurity and Infrastructure Security Agency; checked 7 October 2026: Small and Medium-Sized Business Resources and Cybersecurity Performance Goals FAQ.
