Every MSP dreads this situation. When you answer your phone, a panicked client on the other end describes something you never want to hear. Ransomware. Sabotage. A fire in the server room. When it comes to MSP client crisis situations, it’s not if they will happen; it’s when. When they do happen, the way you react in the first five minutes can set the tone for the entire recovery process — or make everything worse.
This guide walks through 10 nightmare scenarios every MSP may face, from data breaches to infrastructure failures. Each includes suggestions for how to respond immediately, and, more importantly, how to be prepared. Plus, if you do things right, it may build a stronger relationship with that client. “One person’s horror story can also be another person’s shining moment,” said Wade Yeaman, founder and former CEO of Fluid IT Services, in a previous interview.
These scenarios aren’t just hypothetical. They should serve as prompts for real internal conversations. Every MSP should run tabletop exercises with their team, asking:
- Do we have a plan for this?
- Do our clients know what to expect?
- Who does what in the first five minutes?
Don’t wait until panic sets in. Use this guide as a starting point to build or refine your incident playbooks — or at least spark the discussion that keeps your next emergency from becoming a full-blown IT disaster.
How to Be Prepared for 10 Nightmare Client Calls When Disaster Strikes
Crisis #1: The Building Is on Fire. Is Our Data Safe?
If your client’s office is on fire, your first concern is the safety of the people, then the data. You should already know the answer to the latter. If you’re managing backups properly, the data should be safe offsite. If you’re unsure, that’s your first red flag.
Steps to Prepare
- Run a disaster recovery tabletop with your team: If a client lost their physical office today, how long would it take to restore their data and operations?
- Confirm that offsite/cloud backups are encrypted, tested, and monitored.
- Educate clients in advance about your backup posture so they don’t panic when disaster hits.
Crisis #2: We’ve Been Hit With Ransomware. What Now?
Ransomware response starts before the infection. Clients need to know what’s included in their service agreement, what’s not, and the details of your response plan. Too many MSPs get caught improvising under pressure.
Steps to Prepare
- Review and document your ransomware incident playbook. Do you have a communications plan, a forensics resource, and recovery timelines?
- Train your team to isolate systems quickly and document every step for compliance and insurance purposes.
- Educate your clients on prevention and response expectations during quarterly reviews.
Crisis #3: An Employee Just Quit and Sabotaged the Network
This situation highlights the importance of strict offboarding procedures. If an ex-employee still has access to systems or admin credentials, you’re exposed.
Steps to Prepare
- Audit your account deactivation process and response time. Does your team revoke access the moment someone leaves?
- Review privilege management policies and implement role-based access.
- Create a formal offboarding checklist and train your clients to alert you before a resignation becomes a risk.
Crisis #4: Someone May Have Hacked Our System
The scary part here is ambiguity. The client isn’t sure what’s happening, just that something feels off. Your job is to take control and bring clarity.
Steps to Prepare
- Make sure your team is trained to interpret early warning signs and knows how to prioritize logs, EDR alerts, and network behaviors.
- Consider retaining a security partner for deep forensics if you don’t have the internal bench strength.
- Work with your clients to implement basic detection systems that alert you early, not after the damage is done.
Crisis #5: We Sent Money to the Wrong Account. Was the CEO’s Email Hacked?
This is almost always a business email compromise (BEC). The financial loss can be huge, and your client will want answers fast.
Steps to Prepare
- Train clients on basic security awareness. Social engineering attacks like this are preventable with better processes.
- Implement and enforce multi-factor authentication (MFA) and geo-fencing on all executive accounts.
- Develop a BEC response plan, including immediate banking actions and post-incident communication strategy.
Crisis #6: A Regulator Just Called. Are We in Trouble?
If you’re delivering compliance services, your name may come up during an investigation or audit. You better be prepared to show what controls are in place — or explain why they aren’t.
Steps to Prepare
- Document all your compliance responsibilities and who owns what: you, the client, or a third party.
- Review your SLAs and marketing materials to make sure you’re not overpromising compliance services that you aren’t qualified to deliver.
- Your internal documentation and logs must be audit-ready.
Crisis #7: Our Critical Server Is Down. We Can’t Do Business.
This is one of the most common emergencies. Yet, it is often one of the least rehearsed. Clients expect near-immediate recovery. You need to manage that expectation and deliver results.
Steps to Prepare
- Review and test your restore-from-backup process at least quarterly. Do you know your actual RTO (recovery time objective)?
- Practice a mock scenario with your team. Ex: What happens if that server dies at 10 a.m. on a Monday?
- Talk to clients about high-availability options and the cost-benefit of reducing downtime.
Crisis #8: The Internet Is Down. Everyone Is Stuck.
This is frustrating but usually not catastrophic — unless it’s the third time this month. Clients will expect a fix and an explanation.
Steps to Prepare
- Document ISP failover options for each client and configure secondary connections when possible.
- Maintain a live inventory of network hardware for each client so you can troubleshoot faster.
- Consider a quarterly network review to eliminate chronic issues before they become crisis calls.
Crisis #9: Our Shared Drive Is Gone. We Can’t Find Anything.
Data loss or access errors cause immediate disruption. Most of the time, it’s a permissions issue or accidental deletion. However, you need a fast process to determine scope and restore access.
Steps to Prepare
- Ensure file-level recovery is part of your business continuity and disaster recovery (BCDR) solution.
- Set clear access control policies and change logs. Who moved what, when, and where?
- Provide clients with regular training on how to use — and not misuse — shared drives.
Crisis #10: Our Phones Are Down. We Can’t Talk to Clients.
VoIP disruptions are painful, especially if your client relies on phone traffic to drive revenue. They expect you to know what’s going on and fix it fast.
Steps to Prepare
- Document all VoIP providers and control panels for your clients in your PSA/RMM.
- Create a checklist for troubleshooting. Is it the network, the phone system, or the provider?
- Train clients on having a basic backup plan, such as redirecting to cell phones in an outage.
Where to Go from Here
- Want more helpful guidance on selling security services? Check out our Cybersecurity Answer Center
- Have a question for our experts? Send it to editors@channelpronetwork.com
ChannelPro has created this resource to help busy MSPs streamline their decision-making process. This resource offers a starting point for evaluating key business choices, saving time and providing clarity. While this resource is designed to guide you through important considerations, we encourage you to seek more references and professional advice to ensure fully informed decisions.
Featured image: iStock / ChatGPT
