How should I evaluate a CSP partner's security practices before signing up?

A few concrete things worth asking:

Questions worth asking

• Do they enforce MFA for their own staff accessing customer tenants?
• Do they use scoped, time-limited admin access (GDAP) rather than requesting broad, permanent access?
• Can they describe their internal process for granting/revoking employee access to customer systems?
• Do they have a documented incident response process if something goes wrong on their end?

A partner that answers these clearly and specifically — rather than vaguely — is generally a stronger signal than any single certification.