Is your MSP preparedness audit ready?

MSP owners are in the business of preparation. Redundant systems, tested backups, documented recovery plans; you essentially sell peace of mind for a living. So why are so many running their own businesses without any of it?

The gap between what many MSPs preach and what they practice is wider than most would like to admit. Client fires eat the calendar, billable work takes priority and somewhere along the way, the very experts keeping other businesses afloat are quietly running their own on a foundation they’d never sign off on for a client.

Because of this, we asked MSP owners to get honest about the solutions they recommend but haven’t implemented, the disasters that caught them off guard and what they’d tell a fellow owner who hasn’t thought about any of this yet. What they shared is equal parts candid, cautionary and worth reading before something forces you to.

What’s one continuity or disaster recovery solution you regularly recommend to clients that you haven’t fully applied to your own business yet? Why not?

“I tell every client to test their backups quarterly and keep an offline “break-glass” credential kit. Meanwhile, our own internal runbooks live in the same PSA system we manage for everyone else, which means if our RMM or cloud PSA goes down, the documentation on how to recover it is trapped inside the tool we’re trying to recover. It is classic cobbler’s-children syndrome. Client fires always win the calendar. We bill for client DR testing; we do not bill for testing ourselves. That is the honest reason, and I am not proud of it.” – James Sanford, President of Teamspring.

“A generator for the office building. It always happens, a storm rolls through and power goes out to the building. It would be nice to have a generator at the office, but it’s just that – nice. I recommend it to clients/prospects. We don’t really need it most of the time. All of our tools are cloud based so we just pick up and move to a location that has power and Internet and continue on.” – Greg Brainerd, Owner of Braintek

“We had a secondary site before we got our second building, we are currently utilizing the cloud for our full redundancy and once the electric is complete in the new building we will have a colocation site for our business so that we can fully run from either location.  We are just waiting on the 400AMP service to the basement.” – John Kistler, Owner of J&B Technologies

“Starlink, certain properties of our clients use it as their internet options are not up to par with what they need, and it provides a backup connection if needed. We have explored the idea and use of Starlink with our employees when travelling, but our office already has multiple connections, so it is not typically needed.” – Connor Murphy, Operations Coordinator at Solve Ltd

“Dude, we’re Fort Knox. I’ve got an outside generator, I’ve got a server room that that’s in a building inside of a building with a dedicated power feed separated from that, we’ve got backups, we’ve got cluster redundant fiber, everything.”  – James Evans, CEO at American Frontier

“There is none. I practice what I preach. You ever heard the saying we eat our own dog food?” – Dean Lause, CEO at Argentum IT 

Has a real disruption ever actually tested your business? What happened, and what did it teach you?

“Internet outage due to a third party in our office building shut down our servers for over an hour, our engineer was able to fix the DNS issue regarding the unannounced change. However, this led us to have a backup connection so this issue may never happen again.” – Murphy

“Yes, way back a Hurricane came through the Houston area. At the time my phone system and server (with my email system and ticketing system) went down for a week due to the storms damage. Luckily I had pre-printed tickets that I gave to my techs and rerouted the phones to my cell. What a pain that was. After that I moved everything to cloud systems so that would not be an issue in the future.” – Brainerd

“A few years back, a severe summer storm knocked out power to our area for the better part of two days. Our office generator kicked on beautifully—except two of my techs could not get to the office because trees were across their rural roads, and our remote access jump box was hosted on premises behind that same generator. So the office had power, the clients were fine, but my people could not reach the tools from their kitchen tables. The lesson was humbling: your DR plan is only as good as your team’s ability to execute it from home at 7:00 a.m. while their own refrigerators are warming up. We moved critical access infrastructure to cloud-hosted jump points the following month.” – Sanford

“Yes, a few times. We had a datacenter in our main location and we lost power for more than an hour and when the power came back, we lost alot of equipment, computers’ power supplys’ UPSs’, it was a complete mess for about 2 weeks and I had to reinput the last day of data from the power outage. After that we moved our essential workloads to the cloud and then had backups to our main location just in case, but now I want another complete setup at a second location for the just in case something happens at either location.” – Kistler

“Power failed yesterday. Generators started; life went on. Just a completely random Thursday, no storm coming, no nothing, just sitting here on some idle Thursday afternoon, and boom. Lights just went out. whrrrrrr Generator’s running!” –Evans

What would you tell an MSP owner who hasn’t really thought about their own business continuity yet? What’s the one thing they should do this week?

“It doesn’t take long to create a disaster recovery plan, but it takes a long time to recover from not having one. Luckily, we live in the Midwest with lots of damaging storms that knock out power and have storm related damage, so we are constantly on the lookout for hardening our main location and now hardening both locations. Over the weekend, write down the way your business information flows in regard to how they make money, they figure out what needs redundancy and start adding equipment until the entire business information path is backed up.” – Kistler

“Find secondary backup solutions such as Starlink for internet in case any issues ever arise. Always have backups of your data, on the cloud, physically, or preferably both.” – Murphy

“Pick your single point of failure—the one person, password, or vendor that would stop you from invoicing or supporting clients if it disappeared tomorrow—and fix just that one thing this week. For most small MSPs, it is the owner’s cell phone. If you run the whole shop from your personal number and authenticator app, go get a second dedicated business phone, duplicate your critical MFA codes, and hand the login list to your second-in-command. You do not need a 40-page plan this week. You need to survive losing your front left pocket.” – Sanford

Is there anything about preparedness that you wish more MSP owners would say out loud?

“We need to stop pretending we are immune because we are the technical people. The industry talks about RTOs and failover sites, but we do not talk enough about the emotional reality: you cannot be your clients’ first responder if you have not prepared your own mental bandwidth. The best continuity plan in the world fails if the owner is running on two hours of sleep and a dead phone.”- Sanford

“Most business owners rely on their MSPs to keep them up and running, but don’t really know how it’s accomplished, only that ‘they’ are handling it. Have a conversation with your clients about what real downtime means and then tell them any personal stories you have, or that your clients from previous outages have had and then start to plan for it. Send them a disaster recovery document and ask them to please fill it out, business owners get pretty surprised when they realize that they don’t have a complete backup plan.” – Kistler

“Having a variety of options and adaptability when your “Plan A” goes wrong is necessary, and those usually not implemented until the problem has already occurred. MSPs should be more proactive rather than reactive when it comes to these potential scenarios, even if they have not happened yet.” – Murphy

Ask yourself the hard questions

Stop treating your own business like a low-priority ticket. Sit down this week and ask yourself the same hard questions you’d ask a new client. Where’s your single point of failure? What happens if you lose access to your tools tomorrow? What does recovery actually look like? Find the answers, find the gaps and start closing them. You’ve done it for your clients… now it’s your turn.

Related: Helping clients prepare for disaster without scaring them.