Acronis outlines 8 RMM security controls for MSPs to test

Acronis has outlined 8 security controls that managed service providers (MSPs) should test when evaluating remote monitoring and management (RMM) software. The checklist covers endpoint discovery, patching, privileged access, alert handling, automation, incident response, recovery and separation between customer environments.

Acronis says it developed the checklist from securing endpoint management across thousands of customer environments. Its guidance focuses on testing outcomes directly, rather than choosing tools by the length of their feature lists.

The article cites two incidents to illustrate risks around management software and delayed patching. In September 2026, BleepingComputer reported that N-able shipped an emergency hotfix for CVE-2026-86218, a maximum-severity pre-authentication remote code execution flaw in N-central. The report said it was the platform’s fourth hotfix in five weeks, with roughly 1,500 servers exposed online. In July 2025, BleepingComputer reported that attackers exploited Microsoft SharePoint “ToolShell” zero-days CVE-2025-53770 and CVE-2025-53771 before a patch existed; at least 85 on-premises servers were compromised.

The checklist recommends practical evaluation exercises, such as introducing a device into a test environment, trying restricted technician roles, testing patch deployment and rollback, and simulating an incident and recovery. It also calls for checking tenant isolation and audit trails. Acronis RMM is part of Acronis Cyber Platform, but the article notes that capabilities and licensing vary by service package.