MSP FAQ: remote-access governance checklist after a client CVE

A critical vulnerability in a remote-access or RMM tool is also a reminder to audit who can use it. CISA, NSA and MS-ISAC guidance points to roles, MFA and logging.

In this article

Why RMM tools are a favourite target
What the governance checklist covers
Turning the guidance into a post-CVE checklist

Every time a critical vulnerability lands in a remote-access or RMM tool, MSPs face two jobs at once: patch the specific flaw, and re-check the governance around the tool itself. CISA, the NSA and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have published joint guidance aimed specifically at that second job.

Close-up of a physical security key's gold contact pad etched with a wireless signal icon — Photo: Tony Webster (CC BY 2.0), Wikimedia Commons.

Why RMM tools are a favourite target

The agencies' joint advisory on malicious use of RMM software notes that threat actors deliberately target the legitimate RMM tools MSPs and IT help desks already use, because a single compromised MSP credential can expose a large share of that MSP's customer base at once. The same dynamic played out at scale in the 2021 Kaseya VSA incident, where a compromise propagated through MSP relationships to more than 1,500 downstream organizations.

What the governance checklist covers

CISA's companion "Guide to Securing Remote Access Software" is written for the customers of MSPs as much as for MSPs themselves, and it focuses on the access model rather than any single CVE: who holds privileged remote-access roles, whether MFA is mandatory for that access, whether logging is comprehensive enough to reconstruct what a session did, and whether direct access to log servers is kept out of reach of the RMM tool itself, so an attacker who gets into the tool cannot also erase the evidence.

Turning the guidance into a post-CVE checklist

Confirm patch status first, then separately review who currently holds remote-access roles for the affected tool.
Require MFA on every remote-access account, technician and customer-facing alike.
Verify logging covers session start/end, commands run and file transfers — not just login events.
Keep log storage and the ability to delete or alter logs outside the RMM tool's own reach.
Scope each technician's remote-access role to the customer tenants they actually support.

A patched CVE closes one door; the governance review is what keeps the next one from opening the whole estate.

Sources: CISA/NSA/MS-ISAC — Protecting Against Malicious Use of RMM Software, CISA — Guide to Securing Remote Access Software.