Acronis Recommends Eight Security Controls for RMM Platforms to Mitigate MSP Risk

Acronis has outlined eight security controls that Managed Service Providers (MSPs) should test when evaluating Remote Monitoring and Management (RMM) software. Given that RMM platforms provide privileged access across customer environments, their security configuration is critical to limiting overall risk. The guidance covers several key areas: ensuring timely patching of RMM agents and consoles; enforcing strict privileged access controls and just-in-time access principles; establishing and testing incident recovery procedures; and implementing tenant isolation to prevent lateral movement between customer environments. Additional controls likely include network segmentation, logging and monitoring configurations, and secure deployment practices. The advisory emphasizes that these controls are preventive in nature and should be regularly assessed as part of an MSP's security posture evaluation. No specific active exploitation of RMM platforms was reported in connection with this guidance; the focus is on risk mitigation and best practices. The guidance serves as a framework for MSPs to audit their RMM deployments and reduce the attack surface associated with remote management tools.