Cybersecurity
Local co-managed IT teams usually know where drift comes from. It shows up in one office with special firewall rules, a backup exception carried over from a prior incident, or a local admin shortcut that never got rolled back. The hard part is turning that awareness into a simple 90-day program that both the internal team and the MSP can follow without creating more process than the environment can support.
Days 1 to 30: identify the biggest local drift sources
Start by comparing the settings that most often create operational trouble: firewall policy differences, endpoint protection gaps, admin-role sprawl, backup inconsistencies, and remote-access exceptions. Do not attempt a full-environment cleanup first. Pull out the handful of differences that create repeat help desk load or make recovery less predictable.
At the same time, assign ownership between internal IT and the MSP so every baseline item has one accountable team.
Days 31 to 60: lock the baseline and control exceptions
Choose the standard settings that should apply across every local site or business unit. Then review each exception and either retire it, document it, or set an expiration date. This is where most teams discover that “temporary” changes have been living in production for months.
Your goal is not perfection. It is to stop new drift from being introduced while the old high-risk items are cleaned up.
Days 61 to 90: add evidence and recurring review
By the final month, the team should be able to show which baseline settings were standardized, which exceptions remain open, and which issues require budget or vendor changes. Build one recurring review that looks at the same evidence each month so drift control becomes operational discipline instead of a one-time cleanup project.
What to measure
- How many high-risk exceptions remain open after 30, 60, and 90 days.
- Whether each critical platform has a current baseline and a named owner.
- How often support tickets are caused by inconsistent settings between locations or user groups.
- How long it takes to return an out-of-standard system to the approved configuration.
Who should own the roadmap
The internal IT lead should own the local business context, the MSP should own evidence that managed systems stay aligned, and leadership should approve the small number of exceptions that remain for business reasons. If drift control has no owner on one of those three sides, the roadmap usually stalls after the initial cleanup phase.
Suggested next step
Request a free assessment if you want help building a 90-day drift remediation plan for your local sites and shared platforms.