Don’t assume compliance is only for regulated industries. In the absence of a federal standard, cyber liability insurance carriers are driving compliance obligations. Through coverage requirements, carriers are effectively forcing every business to comply or go uninsured.
As an MSP, we often receive requests from our clients to review and complete insurance renewal forms. In the last few years, these forms have changed from simple five-minute favors into multi-tab Excel documents that take hours to complete. Clients assume that completing these audits is included in their standard monthly service and believe that the answer to every question is “Yes.”
Operating without a comprehensive compliance practice isn’t just a missed opportunity; it’s a serious risk. You’re leaving your clients exposed to denied insurance claims while ignoring a major potential revenue stream.
Building a compliance practice
The primary hurdle isn’t technology; it’s leadership apathy. You cannot build a compliance program for a client who views security as a commodity. To shift this mindset, choose a framework standard, such as NIST CSF, as your common language.
Don’t overwhelm them with technical controls. Focus on the operational pillars of your chosen framework (for NIST CSF: Govern, Identify, Protect, Detect, Respond, and Recover). Once they accept that compliance is a business function, you can ease them into execution. Start with a single, high-impact document, such as an Acceptable Use Policy. This forces them to practice making governance decisions without drowning in a sea of paperwork.
Selling projects to implement controls
A signed policy isn’t just a document; it’s a playbook for revenue. When a client approves a policy, it is effectively requesting the tools to enforce it. You are no longer ‘selling’ a project; you’re executing their command.
Use the Acceptable Use Policy as an example. If a customer implements a rule prohibiting access to malicious websites, they haven’t just agreed to a concept – they’ve requested the deployment of the DNS filtering solution required to enforce it. If they balk at the cost, pivot back to the framework: ‘You identified this risk in your policy. We need to implement the Protect and Detect controls to manage it.’ This reframes the entire dynamic: you aren’t selling a widget; you’re operationalizing their own decision.
Moving to full compliance-as-a-service
With governance established, the real work begins. A robust Compliance-as-a-Service (CaaS) offering isn’t a sprint; it is a multi-year roadmap of maturation.
Give your client a roadmap of improvement, but do not attempt to implement more than two policies per month. Any faster, and you risk overwhelming them, turning the process into a ‘check-the-box’ exercise that leadership ignores. Build a rolling roadmap to forecast the technical budget.
For example, if you schedule the Data Classification Policy for Q2, immediately present the Data Loss Prevention implementation plan for Q3. This links the administrative requirement directly to the technical solution budget.
In a recent annual planning session, I mapped every project on the budget back to a policy that the client’s leadership already approved. This removed the friction of explaining the technical requirements. The conversation quickly moved from “why do we need this?” to “How do we fit this in the budget?”
Implementation is just the starting line. The core value of your CaaS retainer is the ongoing Lifecycle of Evidence: monitoring enforcement, gathering proof for the insurance carrier, and conducting the mandatory annual policy review. Simply having the policies in place is not sufficient to protect your client. Failure to comply with those policies – or just lacking evidence of compliance – can be just as disastrous as not having them at all.
You aren’t being paid just to write the policy; you’re being paid to keep it alive.
In the last 5 years, we have had several companies come to us asking for help after a security breach. Their insurance carriers require detailed forensic evidence of their security posture. Bottom line: if you checked “yes” on the insurance application, then you will need to provide proof of compliance. Post-breach chaos is the worst time to attempt to collect evidence.
A well-executed compliance program elevates you from a commoditized IT vendor to a strategic business partner. By shifting the decision-making power to the client through policy, you stop ‘selling’ security and start executing their business mandates. You become the partner who doesn’t just fix computers but actively protects their revenue.
