// CPCSC BYTES · EPISODE 1 · NOVEMBER 3, 2026
My IT Provider Handles That: Accountability and Evidence
An IT provider can run your systems, but your business still has to show how each important safeguard works. Agree who owns each responsibility, ask for the record that proves it was done, such as a closed ticket, an account status, or a log, and keep requests specific and proportionate. A provider who refuses to show evidence is the warning sign.
Chapters
Show notes
Your IT provider may handle the technology, but can your business demonstrate how an important safeguard works?
In the first episode of CPCSC Bytes, Hans Study explores clear responsibilities, useful evidence, employee offboarding, and remote-access sign-in requirements.
Your action this week: choose one responsibility and ask your provider to walk you through its implementation and supporting record. Agree how the evidence will be kept current.
These are practical examples, not a universal CPCSC evidence checklist.
In this episode
- Clear responsibilities between your business and your provider
- What useful evidence looks like in practice
- Proportionate requests and handling sensitive records
- This week’s provider review
- Warning signs to listen for
Go further: the CPCSC hub covers the levels and requirements, and The Study Guide to CPCSC Readiness is the long-form reference. Connect with Hans at hans.study or on socials as StudyByt3s.
Watch on YouTube
Transcript
0:00My IT provider handles that. It's a reasonable answer. You've hired people to look after the technology, and you expect them to do the work. But when a customer asks how a safeguard is implemented, can your business show what has actually been done? Welcome to CPCSC Bytes, the weekly few bits of info on the Canadian Program for Cyber Security Certification. I'm Hans Study, and today we're talking about IT provider accountability, useful evidence, and why a monthly invoice can't tell you the whole story.
0:38These days IT providers go by multiple names, from managed service providers, MSPs, to the finance director's nephew that is good with computers. A good service relationship starts with clear responsibilities. What does the provider manage? What does your team manage? Who approves access? Who disables an account when someone leaves? Who checks that an important security setting is still in place? If everybody assumes somebody else owns a task, that task can disappear between the contracts. I've worked with and even for managed service providers, and I've seen how much difference clear reporting makes. The useful conversation isn't just "are we secure?" It's "what are we doing, how does it work, and how do we know?"
1:20Let's take a simple example. An employee leaves the company. Somebody tells the provider. The employee's access is removed. What shows that the process worked? Depending on the systems involved, it might be a completed service record, an account status, or a relevant system log. The evidence needs to support the claim you're making. A document saying that access will be removed describes the intended process. It doesn't, by itself, show what happened to that account.
1:47The same distinction applies to technical settings. If a provider says that remote access requires an additional sign-in factor, ask where that requirement is enforced and how they verify it. The answer should connect the promise to the actual configuration and the process for keeping it working. Ask for logs or reports. This is something they should be able to provide.
2:09These are practical examples. They aren't a universal list of evidence that every organization must collect in exactly the same way. CPCSC preparation needs to reflect the applicable requirements, your scope, and the services you actually use. Outsourcing the work doesn't remove the need to understand those boundaries.
2:27At the same time, a request for evidence should be specific and proportionate. Nobody benefits from collecting a mountain of screenshots that doesn't answer a useful question. Start with one safeguard. Identify who owns it. Agree on what would show that it is implemented. Decide where that information is kept and when it needs updating.
2:46Handle the evidence carefully. Reports can contain account names, system details, or other sensitive information. Share them through the appropriate process with the people who need them.
2:56Here's your action for this week. Book a short review with your provider. Choose one important responsibility and ask them to walk you through the implementation and the supporting record. Ask them to provide monthly reports if possible. A good provider should be more than happy to meet and discuss this. They should be almost happy to give you evidence they are doing their job right. If something is unclear, use that conversation to define the gap and agree on the next step.
3:22If your provider starts quoting contract terms and saying things like "we don't allow third-party auditing, that would void our contract or incur penalties," or "we don't provide that information to clients, it's proprietary information, or it would cost a premium," find someone else to come take a look, yesterday. Honestly, if that is what is said, reach out to me directly and I'll take a look at things for you. The goal is a service relationship where responsibility, implementation, and evidence line up, not a game of smoke and mirrors. Smoke and mirrors won't fly for CPCSC or the auditor. It shouldn't fly with you.
3:54Thanks for joining me for CPCSC Bytes. Have comments, questions, or suggestions? Reach out to me on the web at hans.study or on socials at StudyByt3s. Remember, keep asking useful questions and make sure the answers connect to how your business actually operates. I'm Hans Study, and stay curious.