MSP client onboarding checklist: terms before access

Most MSP onboarding checklists start with discovery: network scans, asset inventory, RMM agents. They assume the paperwork is done. In practice it often isn't. The MSA is "with their lawyer", the BAA is "coming", and your technician already has domain admin.

This checklist starts one step earlier. Phase 0 covers which documents need to be accepted, by whom, before access. Phases 1–4 cover the technical onboarding, briefly, because the RMM and PSA vendors already cover that well.

Phase 0 is done when the right person at the client has accepted each document you need, and you can show it. Which documents a given client needs is a question for you and your counsel. The common set:

• Service terms or MSA. Scope, responsibilities, fees, liability. Everything else hangs off this.
• NDA, if confidentiality isn't already covered in the MSA.
• Business associate agreement (BAA), when the client is a HIPAA covered entity and you will handle protected health information. The regulation requires a written contract with specific terms (45 CFR 164.504(e)). See the HHS sample BAA, section by section.
• Data or security terms, when the client is under a law that requires its service providers to commit to safeguards by contract, such as the FTC Safeguards Rule (below).
• The right acceptor. A named contact who can agree for the client, usually the owner, practice manager or office manager. Not whoever answered the kickoff email.
• A record. For each document: which version, accepted when, by whom.
• Access gate. Standing admin credentials are issued only after the boxes above are ticked.

Doing this before access isn't only tidiness. If something breaks in week one, the terms that govern it are the ones accepted before you touched the system. And an "I agree" buried in an email thread is harder to prove than it looks; see whether an email agreement is binding.

Clients are being told to settle these terms before they hand over access. Two sources matter most for MSPs.

CISA's guidance for MSP customers. In Risk Considerations for Managed Service Provider Customers (September 2021), CISA says organizations "can define roles and responsibilities in a vendor agreement using the Shared Responsibility Model". It tells them to "solicit the following elements from any potential MSP prior to signing a contract", including:

• "Specific performance-related service level agreements";
• "Detailed guidelines for incident management, including the MSP's incident response responsibilities";
• "Documentation of vetting of employees (including subcontractors and independent consultants)".

On access, it advises that "organizations should define the vendor's required privilege and access levels prior to contract award."

The FTC Safeguards Rule. Financial institutions under the FTC's jurisdiction, which by the rule's own examples include mortgage brokers and retailers that issue their own credit cards (16 CFR 314.2), must "oversee service providers", including by "requiring your service providers by contract to implement and maintain such safeguards" (16 CFR 314.4(f)(2)). If such a client hires you, its compliance depends partly on a contract with you.

Neither source tells you what your contract should say. Both tell your clients to have one in place, with you, before the work starts.

These phases are well covered by RMM and PSA vendors' own checklists, so this is the short version.

Phase 1: discovery

• Inventory devices, users, licenses and line-of-business applications
• Map the network, internet circuits and the outgoing provider's access
• Collect existing credentials and vendor contacts; plan the handover from the previous provider

Phase 2: documentation

• Record the environment in your documentation platform
• Write down who at the client approves changes, purchases and access requests
• Agree escalation contacts and support hours

Phase 3: security baseline and tooling

• Deploy your RMM and security agents
• Rotate shared and outgoing-provider credentials; enforce MFA
• Set up named, least-privilege admin accounts for your team, matching the access levels agreed in Phase 0
• Confirm backups and test a restore

Phase 4: go-live and handover

• Walk the client through how to get support
• Confirm the agreed service levels are being measured
• Schedule the first review

The slow part of Phase 0 is rarely the client disagreeing. It's the documents sitting in someone's inbox. Yesmark is built for that step.

You put your standard service terms, NDA and BAA on Yesmark once. For a new client, you assign the documents it needs to the contact who will accept them; existing clients can be brought in from a CSV import. The contact gets an emailed link, confirms with a one-time code, and sees every document on one page, each with its full text and its own accept box that confirms they are authorized to accept for their company. They can accept all of them in one sitting, with no account. On paid plans from Pro up, Yesmark sends automatic reminders to contacts who haven't accepted. The coverage board shows which clients have no agreement, which are pending and which are covered.

Yesmark for managed service providers shows the setup. If you're the person who just inherited onboarding, your first ops hire covers that moment.

Onboarding is the first acceptance, not the last. When you change your MSA or add a subcontractor, every existing client needs to see the new version. Getting existing clients to accept your updated terms covers that rollout.