Reconcile PSA, RMM, identity, and billing inventories before managed-service scope drifts

Source facts: knowing assets and services is a continuing governance outcome

NIST’s Cybersecurity Framework 2.0 Implementation Examples provides example actions for CSF outcomes rather than prescribing one platform. For Asset Management, the examples include maintaining inventories of hardware, software, systems, and services; identifying owners; using discovery and inventory tools; and updating records as the environment changes. The CSF also connects asset knowledge with risk, protection, monitoring, response, and recovery.

CISA’s Cross-Sector Cybersecurity Performance Goals similarly recommend maintaining regularly updated inventories of assets with IP addresses where relevant, hostnames, owners, and other information needed to identify unauthorized or unmanaged systems. CISA’s MSP advisory calls for providers and customers to understand responsibilities, secure remote-management tools, restrict access, and monitor provider activity.

These sources do not declare that PSA, RMM, billing, or identity data is universally authoritative. Each system observes a different part of service delivery. An RMM agent can prove that software recently checked in, but not that the device is contractually covered. An invoice can show that a service is billed, but not that protection is deployed. A directory can contain a legitimate dormant account or a stale one. Reconciliation is the controlled process of resolving those differences.

DSE recommendation: operate an inventory reconciliation queue

Do not promise a magical single source of truth. Define which system is authoritative for each field, join the records with stable identifiers, and make every unresolved mismatch visible to an owner.

1. Define the questions. Decide what the inventory must prove: customer ownership, physical or cloud location, lifecycle state, support tier, contract inclusion, responsible party, identity owner, security coverage, backup coverage, network reachability, and retirement approval.
2. Name field authorities. The contract may own service entitlement, finance may own invoice status, the customer may own business disposition, identity may own account state, and technical platforms may own last-seen evidence. Record precedence and the process for disputing incorrect source data.
3. Create stable keys. Prefer immutable customer, tenant, subscription, device, user, and contract identifiers over names. Preserve serial number, cloud resource ID, directory object ID, agent ID, and source-system record ID. Maintain approved aliases after mergers, replacements, and renames.
4. Compare the critical sets. Identify devices billed but not managed, agents active without a contract item, protected endpoints missing RMM, users licensed but not employed, backups configured without successful recovery evidence, customer networks absent from documentation, and retired assets still reporting.
5. Route rather than hide conflicts. Give each mismatch a severity, customer, owner, due date, evidence, and allowed resolution. Do not automatically delete an agent, add billing, or grant a license solely because another system contains a record. Those actions can affect service, cost, or access.
6. Confirm with the customer. Review unresolved ownership, shadow services, exceptions, newly discovered assets, and retirement candidates with authorized customer contacts. Record the decision and effective date, especially when an asset remains reachable but is removed from managed scope.
7. Measure coverage and ageing. Report reconciliation date, record counts, match rate, unknown owners, stale check-ins, unprotected assets, contract gaps, aged exceptions, and time to resolution. Preserve snapshots so trends and audit questions can be answered.

Factual boundary: NIST and CISA describe asset-management outcomes; they do not endorse a specific MSP data model or make billing data a security authority. Discovery tools can miss offline assets, duplicate virtual systems, or observe devices outside contractual scope. Customer validation and change control remain necessary.

The best reconciliation program does more than improve reporting. It reveals where responsibility is ambiguous before an incident, renewal, or recovery attempt exposes the gap. Success means the provider and customer can explain which assets and identities are managed, what controls are expected, which record supports that claim, and who owns every exception.

Official references

• NIST, Cybersecurity Framework 2.0 Implementation Examples.
• CISA, Cross-Sector Cybersecurity Performance Goals.
• CISA, Protecting Against Cyber Threats to Managed Service Providers and their Customers.