Episode 15: How MSPs turn compliance into a revenue line

Adam Okay, think back maybe five years ago. If you ran an MSP, a managed service provider, where was compliance on your list? Probably uh somewhere near the bottom.

Christina Yeah, exactly. Maybe next to finally figure out those Excel macros.

Adam Right. It was something you’d deal with if a client absolutely insisted. Yeah. An afterthought.

Christina Totally an afterthought.

Adam But fast forward to today, 2025, and wow, that whole world has been completely flipped on its head.

Christina It really has.

Adam Welcome to the deep dive. Today we’re tackling this huge shift, how compliance for MSPs went from, you know, a side note to basically a baseline trust factor.

Christina And even more, a business essential.

Adam Exactly. So our mission here is to unpack why this change is so critical, what it means for you if you rely on an MSP, and maybe surprisingly, how this uh, let’s be honest, seemingly dry topic can actually be a competitive advantage.

Christina You really hit on something crucial there. MSPs, they’re now right at the heart of their clients’ data security, their IT operations. And with that central role comes this growing, just undeniable expectation. It’s not enough anymore to just provide the tech. Now, you’re expected to ensure solid compliance with some pretty strict regulations. Often for your clients, yes, but also for yourselves. It’s table stakes now.

Adam That’s such a dramatic change, though, side note, to business essential. What really pushed it over the edge? Was it like a few massive breaches or just this slow buildup of pressure? Did regulators finally just say enough?

Christina Well, it’s definitely a mix of things, but the main driver, it’s simple, really. Regulated industries are now explicitly demanding it.

Adam Which industries are we talking about?

Christina Oh, the big ones. Healthcare, government contracting, anyone dealing with global data services. They need their MSPs to meet these strict compliance frameworks.

Adam So it’s not just a suggestion anymore.

Christina No, not at all. They won’t even consider working with an MSP that can’t show they understand and follow these rules. It’s a prerequisite.

Adam And I assume these aren’t just vague guidelines.

Christina Definitely not. We’re talking specific, mandated frameworks. Like in the US, you’ve got NIST CSF for cyber risk, uh CMMC, which is huge for defense work.

Adam Right. Defense contractors need that one.

Christina Absolutely. Then HYPA for healthcare data, obviously, and DFARS for other federal suppliers. Okay. And if you look over in the UK and EU, you’re dealing with GDPR, of course, Cyber Essentials, plus that’s a UK government thing, and NIS2, which tightens cybersecurity for essential services.

Adam N-A-N Z.

Christina Down in Australia and New Zealand, it’s the Essential Eight. It’s a set of strategies to block cyber attacks. And these aren’t just, you know, best practices, they’re requirements, real requirements.

Adam When you say requirements, the flip side, ignoring them, it’s not just some abstract risk anymore, is it? We’re talking serious, like business ending penalties.

Christina Oh, completely. The source material is clear on this. Losing contracts is just the start.

Adam You mentioned some figures earlier.

Christina Yeah. The U.S. Department of Defense, they flat out said CMMC is mandatory for defense contracts, no exceptions. Wow. And HHS, they enforce high pay penalties up to one and a half million dollars per year.

Adam Ouch.

Christina And GDPR, those fines can hit 20 euro or even 4% of global turnover, whichever is higher. It can absolutely be a business ending punch.

Adam So it’s not just being unable to compete, it could actually mean shutting down.

Christina For a smaller or even mid-size MSP, absolutely. But even for larger ones, it means you just can’t bid on work in these regulated sectors. You’re cutting off huge potential revenue streams.

Adam Okay, so why the intense focus on MSPs specifically? Why are regulators zooming in on them?

Christina Well, it really boils down to this. MSPs often act as uh, let’s call them gateways.

Adam Gateways, how so?

Christina Think about it. They have access to the sensitive data of multiple businesses. So a single security slip-up, a breach at the MST level. It’s not just one company’s disaster.

Adam Ah, I see. It could instantly make dozens of their clients noncompliant too.

Christina Exactly. Simultaneously, MSPs have sort of become this new potential single point of failure in that whole digital supply chain. And regulators, they’ve noticed.

Adam So the direct consequences of that pressure, what are we seeing? Stricter audits.

Christina Definitely stricter auditing of MSP security practices, for one, but also mandatory proof of framework alignment before you can even sign a contract.

Adam Before you even get the business.

Christina Right. And it even impacts things like cyber insurance. Getting that coverage, which is critical today, right? It now often hinges directly on your compliance status.

Adam No compliance, no insurance, or maybe just crazy expensive insurance.

Christina Both are possible. Significantly more expensive, certainly, which eats right into your margins. So when you zoom out, MSP compliance isn’t just about protecting clients anymore. It’s fundamentally about protecting your own business model. Survival, really.

Adam Okay, self-preservation. Got it. So we know why it’s crucial. The stakes are sky high. But let’s pull back the curtain a bit. What does compliance actually mean day-to-day for an MSP? It sounds really technical and maybe overwhelming.

Christina It can sound that way, but let’s break it down. At its core, it means putting in place and crucially, maintaining specific security controls, policies, and really good documentation all aligned with those regulations we talked about.

Adam And these controls, they’re tangible things.

Christina Oh, yeah, very tangible. We’re talking about enforcing multi-factor authentication, MFA, everywhere it matters. Implementing strict access controls, who gets to see what data, you know.

Adam Okay. Basic but essential.

Christina Essential, exactly. Plus encryption data needs to be encrypted when it’s stored, that’s at rest, and when it’s moving across networks in transit. Critical for sensitive info. Right. And comprehensive audit logging. You need a clear trail of who did what when. It’s vital for investigations, but also just for proving you’re doing things right.

Adam And handling breaches.

Christina Absolutely. Having solid breach notification procedures ready to go. It’s about being prepared, being transparent, and reacting fast if the worst happens. That’s non-negotiable.

Adam It sounds like a lot to manage. We’ve talked about fines, but let’s focus on the risks of not doing this. You mentioned potential insolvency earlier. What else happens when MSPs let compliance slide? What’s the real world damage?

Christina Well, beyond the fines, which can be huge, the impact goes way deeper. Contracts getting terminated literally overnight. We’ve seen that happen.

Adam Just like that.

Christina Just like that. And the reputational hit. That can be permanent. Sometimes that hurts even more than the money.

Adam I can imagine.

Christina Yeah. Think about it from an MSP owner’s perspective. You lose one key client because you messed up on compliance. That might mean you lose that whole sector.

Adam Like if you specialize in healthcare.

Christina Exactly. You build up years of expertise in healthcare or finance, maybe, one compliance failure, and suddenly you’re effectively blacklisted. Doors slam shit.

Adam Can you give a specific example?

Christina Sure. Take an MSP that supports doctors’ offices but doesn’t have proper high pay K controls nailed down if there’s a data breach at one of those practices. Uh-oh. The MSP could be found liable right alongside the client. They share the responsibility and the penalties. That’s a massive risk.

Adam Yeah, no kidding.

Christina It’s a level of exposure that, frankly, no MSP focused on growth can afford to take. The cost of not doing it right, it just massively outweighs the investment needed to get compliant.

Adam Okay, so summing up those risks, loss business, because you can’t even bid on RFPs, huge fines from regulators, and maybe worst of all, lasting damage to your reputation. That’s a nasty triple threat.

Christina It really is.

Adam Is it possible, though, that some smaller MSPs might just try to avoid regulated clients altogether, just stick to less complex niches? Or is this compliance wave really hitting everyone?

Christina Well, some might try that, sure. But the reality is almost every industry is getting more regulated about data and cybersecurity.

Adam