Show a client what their security actually covers.
Answer seven questions about one client's stack. Get a one-page statement you can hand them, in language they read without translation.
Build a client statementSecurity is invisible when it works, so clients question the line item at renewal. Most MSPs have no clear way to show what is covered, so it gets built by hand in PowerPoint once a year, if at all. Answer seven questions about one client and the Coverage Statement writes that page instead: every area of their environment, what covers it, and how closely it is watched. The areas that come back quiet are your next conversation.
The statement is your document. Your logo, your colour and your company name are the only branding on it.
Name what covers this client. Get the one-pager.
Answer endpoint first if you are not sure where to start.
The statement is written when you run it. Nothing is shown until then, so what comes back is the whole picture at once.
Nothing you enter is stored against a name or an account. Your branding stays in this browser, and you run it again for the next client.
Security coverage statement
This statement sets out the areas of your environment we monitor on your behalf, what each area covers, and how closely it is watched. It describes the arrangement in place on 23 October 2026.
| Area | What it covers | How it is covered |
| Endpoint | The laptops, desktops and servers your people work on. | Not monitored at present. |
| Network | The connection between your sites and the internet. | Not monitored at present. |
| Identity | Who can sign in, and what each account is allowed to reach. | Not monitored at present. |
| Messages arriving from outside your organisation. | Not monitored at present. | |
| Cloud | Microsoft 365 and the cloud services that hold your data. | Not monitored at present. |
| Backup and recovery | The copies of your data, and the ability to restore them. | Not monitored at present. |
| OT and IoT | Cameras, door entry, sensors and other equipment on your network. | Not monitored at present. |
Findings are reviewed during working hours and raised with you through your usual support channel. There is no overnight or weekend review in place at present.
Endpoint, Network, Identity, Email, Cloud, Backup and recovery and OT and IoT are not monitored today. We have set out separately what covering them would involve.
What each answer means.
Every area comes back as one of six answers. The client sees the plain wording. The suggested next step is for you.
The statement carries your logo, your colour and your name. Nothing on it mentions us.
Watched around the clock
Records from this area reach a security team that reads them at any hour, including overnight and at weekends.
Collected
Records are gathered in one place and reviewed during working hours. Anything that happens overnight waits until the morning.
Tool only
A product is installed and protecting the systems, but its records stay inside the product.
Not monitored
Nothing is watching this area at the moment.
Held by the client
The client looks after this area themselves, or through another supplier.
Not present
This area does not exist in the client's environment, so it is marked as not applicable.
Run it once per client.
Run it for your largest client, hand the page over at the next review, then work down the list. The client gets a picture they can follow, and you have something to point at when they ask what happens next.
Why the statement has seven rows.
Security products cover areas, and most cover more than one. The statement is laid out by area rather than by product, so the client can read one row at a time. Each area keeps its own colour throughout.
What counts as part of the stack?
Anything in the client's environment that keeps a security record. Agents, firewalls, identity providers, mailboxes, cloud tenants, controllers and sensors. It belongs on the statement whether you sold it or the client already had it.
Why is connected different from watched?
A connected source records what happens. A watched source has someone reading those records, including overnight and at weekends. The statement says which of the two is in place for each area, because the difference decides how long something can go unnoticed.
How does it treat OT and IoT?
As an area of its own, below the IT stack. Cameras, door entry, sensors and plant equipment use different protocols and rarely appear in an IT console. It gets its own row so the client sees an answer for it either way.
Questions
Book a call.
Thirty minutes with Hannah Lloyd, our co-founder and CRO. Which areas are worth covering first for a client like this one, what a 24/7 team changes, and how the numbers work for an MSP your size.
Book a callFind out more
This tool is one part of a free library.
Labs is free prompts, playbooks, templates, skills and automations for MSPs, updated daily. Sign up and all three free tools, this one, Tender and Insurance Answers, and the Estate Coverage Check, are free to use.