The quarterly business review your MSP schedules with you should answer three specific questions. Most QBRs skip all three.
1. What changed in our environment in the last ninety days, on purpose and by accident? New users, removed users, firewall rules added, policies edited, systems joined or retired.
2. What got patched, what did not, and why? The "did not" list matters more than the "did." A patch deferred for a business reason is acceptable. A patch deferred because nobody noticed is not.
3. What happens in the next ninety days that requires a decision from you? Renewals, vendor changes, capacity moves, license thresholds. The decisions you will be asked to make, surfaced before you have to make them.
Most QBRs spend their time on tickets closed and uptime percentages. Neither of those tells you whether your firm is in a defensible posture.
If your MSP cannot answer the three questions in a QBR, it is not because they are not doing the work. It is because they are not doing the reporting.
#ITGovernance