A client needs a SOC 2 report to close an enterprise deal. Another has a cyber insurance renewal with a questionnaire twice as long as last year’s. A healthcare client assumes you can tell them whether they’re “HIPAA compliant,” because you run their IT. So you add compliance to the contract for a flat monthly fee and figure your team will absorb it.
Almost every MSP has made that call. Sophos surveyed 800 of them this year:
MSPs in the same survey said compliance influences half of their customers’ security buying decisions, and that nearly half of their customers (46%) now rely on them to act as their CISO. The demand is real. The problem is the way most MSPs price and deliver it, and you can see it in about ten minutes of arithmetic.
Do the math on one client
Here is one SOC 2 client for one year, delivered the way most MSPs start: screenshots, a shared drive and whoever on the team can talk to an auditor. The hours and rates below are an example, not survey data. Replace them with your own; the shape of the result rarely changes.
Assumptions: compliance is priced as a flat add-on of $750 a month ($9,000 a year). The work is done by a senior engineer with a loaded cost of $95 an hour (about $140,000 in salary plus benefits, taxes and tools, spread over 2,000 hours).
Done by hand, every compliance client costs you about $3,900 a year. You’re paying to provide the service, and you won’t see it on the P&L because the hours hide inside salaries you were already paying.
Why it breaks as you grow
The loss per client is the smaller problem. The bigger one is capacity. Assume your senior person has about 1,400 hours a year for client work once escalations, time off and internal work come out.
That’s why the trouble shows up at around ten clients. The one person who can run an audit is full, every questionnaire waits on their calendar, and the next compliance client you sign makes the problem worse instead of better. At 25 clients by hand you’re losing about $98,000 a year on the service, before counting the escalations those senior people aren’t handling.
The fix has four parts, and none of them is “hire faster.”
1. Price it in three lines, with limits in writing
A flat add-on has no ceiling, so the client decides how much work it buys. Split compliance into three lines instead:
- Readiness, a fixed-fee project. Gap assessment, policies, the first round of evidence and remediation planning, up to the start of the audit period. Priced per framework, per client.
- Maintain, a monthly fee with stated inclusions. Monthly evidence collection, an annual policy review, a set number of security questionnaires a year (four is a common starting point), and a capped number of auditor-support hours. Anything beyond the caps is billed per questionnaire or per hour.
- Advisory, a quarterly fee. The leadership briefing covered in part 4.
Write the exclusions down too. The audit firm’s fee is the client’s. Fixing what the audit finds is project work, not maintenance. A second framework or a new legal entity is a price change, not a favor.
2. Cut the hours before you sell more of it
The right-hand column of the first table isn’t a software pitch. It’s four habits, and each one is something you can start this month.
- Map each control to a report you already have. For every control, write down the system of record and the export that proves it: the Microsoft 365 MFA report, the EDR coverage report, the backup job history, the RMM patch report. Most of your clients run on the same stack, so you build the map once and reuse it. Then collect on a schedule and spend your time on the exceptions.
- Keep an answer library for each client. Every approved questionnaire answer goes into it, tied to the control it describes, and gets reviewed once a year. The next questionnaire starts as a draft from the library instead of a blank spreadsheet.
- Run one master policy set. Write the policies once, with variables for the client’s name, systems and owners. Update the master and regenerate for every client, instead of editing twenty copies that drift apart.
- Stagger the audit calendar. SOC 2 audit periods are chosen, not assigned. Spread your clients’ windows across the year so no more than a few land in the same quarter. Six weeks of audit prep for one client is manageable. Six weeks for eight clients at once is how your best people leave.
A common shortcut is to run each client on whichever compliance platform they already bought. Your team then works in a different tool for each client, with its own evidence model and export format, and none of the habits above carry over. Sophos found that 53% of MSPs use multiple tools or platforms for this work. That context switching is a cost your margin pays for.
3. Write down whose job each piece is
When a client fails an audit or has an incident, the first question is who was responsible. If the contract doesn’t answer it, the answer defaults to you. A one-page responsibility matrix, signed with the contract, settles it in advance. A starting point:
That last row matters more than it used to. In October, an attacker took over the Microsoft 365 access of ConnectWise Cloud Backup, a backup tool many MSPs run for their clients, and backups were down for about two weeks. Clients deserve to hear about incidents in their provider’s tools from the provider, on a clock you agreed to in advance.
4. Turn the free deck into a paid briefing
Look at the last line of the first table. Most MSPs already spend hours each quarter on leadership reporting, and almost none of them charge for it. That deck is the most valuable thing you produce, and it’s the hardest piece of the work to replace with software or a cheaper provider.
Boards are also under new pressure to understand cyber risk. NIS2, DORA and New York’s financial regulator all expect directors to understand it well enough to oversee it, and very few people are teaching them. (We wrote about that gap last week.) An MSP that teaches its client’s leadership stops being a line item in the IT budget.
How to start:
- Pick three clients that have a board, investors or an owner who asks about security.
- Offer the first briefing free: 30 minutes with their leadership, not their IT contact.
- Bring three numbers in their own terms. What their biggest risk would cost in dollars. Their recovery target next to the result of the last real test. And what changed since the last briefing, with the one decision you need from them.
- Price it from the second one. In the example above, a $1,500 quarterly briefing adds $6,000 a year on top of maintenance, for roughly the 8 hours of reporting you were already doing plus preparation time.
If your largest client’s board met tomorrow and a director asked how exposed the company is to ransomware, would anyone in that room think to ask you? If not, you’re being paid for the work underneath the answer, not for the answer.
Before you buy a platform to do this
Software can take over most of the right-hand column, but only if it was built for a firm serving many clients rather than one company. Four questions sort that out quickly:
- Does evidence come from the systems you already manage, or does someone still upload screenshots?
- What does the client’s leadership see, and can you present it as your own work?
- When a client leaves you, what happens to their evidence and history?
- Run the first table with the vendor’s price in it. What’s your margin at 10, 25 and 50 clients?
Where vCISO Lite fits
vCISO Lite runs a security program from a company’s own data: scans, vendor risk, control evidence and the risk register in one place. As of last week it includes Briefing Room, which turns a company’s own risks and numbers into short classes for its directors and executives, with a knowledge check and a signed record of every completion. It’s built for the conversation in part 4. Book a Briefing Room demo to see it with a client’s numbers.