Installed and monitored are separate questions. The Canadian Centre for Cyber Security lists installing anti-virus, anti-malware and endpoint detection and response (EDR) software on devices among its advanced practices. It also notes that a managed service provider may not include security monitoring in its service, and suggests checking which security services your provider offers.
In its guidance on logging and monitoring, the Cyber Centre describes monitoring as observing collected data to spot changes and anomalies. It recommends that security analysts or a security team do this, rather than the administrators who set up the systems.
What to ask your provider for
Then compare the provider's device list with your own, for example your staff laptops, desktops and servers. The Cyber Centre's risk assessment questions begin by asking whether you have a list of all assets connected to your network. It also strongly recommends including all systems and assets, whether owned, contracted or otherwise used, when scoping its baseline controls.
How to record each reply
Reported: what the provider states, such as a summary saying every device is covered. Record supplied: an export, screenshot or list you receive. Receiving a record does not establish that it is complete or accurate, so note what the record reports and its date.
Check performed: write down exactly what you compared and the narrow result. For example, you might find that every laptop on your own staff list also appears on the provider's list. That match covers names on two lists only. It does not establish how the tool is set up on those laptops.
Unknown or outside scope: questions with no answer yet, and items the provider says are not in the agreement. For those items, ask who is responsible rather than assuming. If a reply changes after you raise a gap, record the provider's explanation, whether a corrected record was promised, and whether one was received.
What these records cannot tell you
A list of check-in dates reports when the tool's records say each device last checked in. Even if that list is accurate, it does not establish whether alerts were reviewed or what was done about them. Ask for the monitoring arrangement separately.
A device missing from a list, or a slow reply, is consistent with several explanations, such as a retired device, an unclear request or workload. The cause stays unresolved until you ask, so treat it as a question to raise rather than a finding.
Using the answers in your decision
Bring the unresolved items to your next provider meeting. Depending on the answers, you might keep the arrangement as it is, ask for changes to coverage or monitoring, clarify the agreement at renewal, or look at alternatives. Our guide on auditing the IT provider you already have covers the wider review.
actually. offers an independent review of evidence about your existing IT provider.
The review is a paid service.
If you want an independent second look at the records you receive, see the actually. review.