Security for MSPs & vCISOs
Supply-chain risk, cyber insurer questionnaires, and customer audit resale-script governance beside your incumbent RMM.
Govern privileged automation with signing, separation of duties,and exportable audit-beside your RMM, verifiable in a Govern early access tenant.
MSPs are supply-chain targets. When an assessor or insurer asks *who ran what on which customer machine*, RMM operational logs rarely answer with signing attribution and exportable evidence.
Trustholm sits beside NinjaOne, ConnectWise, and PDQ-not replacing them. You keep patch and AV breadth; Trustholm adds signed PowerShell policy, dual-custody approval, and security audit export your end-customers can attach to their own audits.
Resell evidence: Per-customer Event Hub/DCR routing is built and not yet verified end-to-end in a hosted lab. Export JSON/CSV slices scoped by customer/group for vCISO deliverables.
Honest positioning: We do not hold SOC 2 Type II yet. Reproduce Shipped rows in Govern early access during insurer or enterprise diligence calls.
This page describes product capabilities for your control matrix. Trustholm does not hold SOC 2, ISO 27001, IRAP, Essential Eight, CMMC, Cyber Essentials, NIS2, or framework certification badges.
Key capabilities
- Schema-per-tenant isolation for your MSP organization
- Dual-custody (four-eyes) on by default for script publish
- Per-customer Event Hub routing (built; not yet verified end-to-end)
- One-session pilot: one agent, one signed script, one export
- Shipped/Gap tables for customer questionnaire pre-fill
| Topic | Evidence | Status | Notes |
|---|---|---|---|
| Just-in-time privilege elevation | Settings → Security JIT policy + grant queue; audit PrivilegeElevation / jit.privilege.*; Assessor Package can include elevation lifecycle | Shipped | Default off; Phase 2 packages, settings/agent/user gates, eligible roles, justification and break-glass policies shipped |
| Privileged actions audit | Web Audit logs (/audit); GET /api/audit, export JSON/CSV | Partial | Built; end-to-end export walk not yet completed. |
| Tenant isolation (MSP to MSP) | Schema-per-tenant PostgreSQL; JWT tenant binding (403 on mismatch) | Partial | Built; not yet verified in a hosted environment. |
| Customer scope inside a tenant | Delegated customer scope on software deployment, agent commands, probe deploy | Gap | Fixes in progress (WO-ZTR-312/313/316/322/323); not shipped until committed, deployed and verified. |
| Dual-custody (four-eyes) | Settings → Security toggle; Script Management blocks submitter self-approve | Shipped | On by default; ERR_DUAL_CUSTODY_VIOLATION and script.dual_custody.denied in audit |
| Microsoft Sentinel / Event Hub audit sink | azure_eventhub / azure_dcr sink; DCR template download; per-customer routing | Partial | Event Hub/DCR audit sink is built and not yet verified end-to-end in a hosted lab. Splunk/Datadog connectors are backlog. |
Frequently asked questions
- Do we need a separate Trustholm tenant per end customer?
Typically one MSP tenant with customer/group scoping inside it. Assessors evaluating end-customer separation should review your group-to-client mapping and export slices-not assume separate tenants unless your commercial model requires it.
- Will this satisfy our cyber insurer?
Insurers ask for attributable script execution evidence. Export audit rows from Govern early access and attach to your application-we supply technical artifacts, not insurance guarantees.