Chapter 8: How to Talk to Your Clients About Risk Management

Chapter 8:

How to Deliver Your Service

[12 min read]

Chapter 8 dives into the details of how to actually deliver your compliance and risk management services. In this chapter, you will learn how to build out your tech stack, provide ongoing value, and create a culture of compliance with your employees and clients.

8.1

Compliance is a Team Sport

You can’t do it all alone! A successful risk management offering requires buy-in from your entire team, and everyone must contribute. That’s why it is so important to build a culture of compliance within your organization.

Beyond your team, a successful Compliance as a Service offering also requires buy-in from your client at a company level. Everyone within your client’s organization — including sales, human resources, managers, and leadership — must adhere to compliance best practices.

Essentially, you are the project manager for your clients. It is your responsibility to create the roadmap, set priorities and milestones, assign work, and monitor progress over the long term. You have to keep your clients accountable and on track.

8.2

Supporting Steps

Understand Your Clients’ Needs:

To effectively deliver your compliance services, you have to understand each client’s unique situation.
From there, you can build a plan and address top priority needs first. Here’s the fast-track approach:

Identify Client Industries and Regulations

Understand the specific industries your clients operate in (e.g., healthcare, finance, technology) and the regulations they must comply with (e.g., HIPAA, GDPR, PCI-DSS). This helps in selecting software that is tailored to specific compliance requirements.

Determine Client Pain Points

Identify whether clients need help with documentation, audit preparation, continuous monitoring, or risk assessment. Understanding these pain points helps tailor the software stack and offerings to meet their needs.

Highlight The Need For Operational Resilience

Compliance monitoring tools help you establish a baseline for security practices. The goal is to identify gaps and vulnerabilities and then adopt best practices to protect against likely threats.

This approach lets you focus on monitoring threats and vulnerabilities (and preventing them altogether!) rather than scrambling when incidents occur. By building out an incident response protocol, you can help clients proactively mitigate the impact of cyberattacks.

Define the Core Capabilities of Compliance Software:

Providing compliance services is infinitely easier when you have the right software in place! The goal is to have one software solution that addresses all of the aspects of compliance, including:

Risk Assessment and Management

Choose software that identifies, assesses, and prioritizes risks with customizable risk assessment frameworks and scoring models suited for different industries.

Policy and Procedure Management

Ensure the software offers robust tools to manage and distribute policies, such as templates, version control, approval workflows, and employee attestation capabilities.

Audit Management

Opt for software that helps plan, schedule, and execute audits, along with features for evidence collection, maintaining audit trails, and generating audit reports.

Continuous Monitoring and Reporting

The solution should continuously monitor compliance controls with real-time dashboards and automated alerts for compliance status changes and risk exposure.

Integration with Existing Systems

The software should seamlessly integrate with existing IT infrastructure, including security tools, SIEMs, ERP systems, and cloud services. Consider solutions that integrate with other MSP tools like RMM and PSA systems.

Automation

Leverage automation features to minimize manual effort in compliance tasks like data collection, reporting, and policy distribution, which saves time and reduces errors.

Build Out Your CaaS Stack:

Once you have your compliance software in place, you can expand on it to address your clients’ needs throughout their entire business. From company-wide learning management to incident response plans, this stack will support compliance initiatives throughout the entire organization. The ideal CaaS tech stack includes:

Core Compliance Management Software

Start with a central GRC platform that supports multiple frameworks (e.g., ISO 27001, SOC 2) and offers core functionalities like risk assessment, policy management, and audit management.

SIEM

Integrate an SIEM tool for real-time security monitoring, threat detection, and incident response, enhancing compliance by ensuring security controls are actively managed.

RMM

Use RMM tools to manage and monitor clients’ IT environments for proactive compliance management, including patch management, vulnerability scans, and compliance status checks.

DMS

Implement a DMS to store, organize, and manage compliance documentation. It should support document sharing, collaboration, and version control.

LMS

Use these systems to distribute compliance policies and conduct employee training and certification programs, ensuring the LMS tracks compliance status and generates reports.

Incident Response and Business Continuity

Include tools for incident management and business continuity planning to help prepare for and respond to potential breaches, aligning with regulatory requirements.

Audit and Evidence Collection Tools

Use tools designed for audit planning, evidence collection, and compliance checks. Automation assists in gathering necessary evidence without manual intervention.

Integration and API Management

Ensure all tools in the stack can integrate seamlessly through APIs or native integrations, providing a unified dashboard for monitoring and managing compliance efforts.

8.3

Ensuring Continuous Improvement

Continuous improvement is the gold standard of Compliance as a Service — the “north star” that should guide everything you do for your clients. While you may not be able to address every issue immediately, being able to present clients with a roadmap and show your progress at critical milestones will demonstrate the value of your services.

That’s why you must provide your clients and key stakeholders with regular updates on the projects and initiatives you roll out. Over the long term, these initiatives will compound, and every step will help make their business more secure and efficient. The goal is to present the “current state” compared to the “before state,” which will truly capture the value you provide your clients.

8.4

Client Reporting and Communication

As an MSP selling Compliance as a Service, effective communication and reporting are essential for maintaining client trust and confidence in your value. Here’s a breakdown of reporting and communication methods you can use to keep in touch with clients:

Communication Methods:

		
				Method
				Frequency
				Format
				Content
			

		
				Regular Meetings
				Monthly or quarterly (after initial setup)
				Face-to-face video conferencing or in-person meetings
				Ongoing compliance status, critical project progress, top priority issues and risks, upcoming audits or action items, and general updates on relevant regulations
			

				Email Updates
				Weekly or bi-weekly
				Clear, concise emails with bullet points summarizing critical updates, action items, and immediate concerns
				Status updates, compliance checks, new regulations, and reminders for upcoming deadlines
			

				Client Portal
				Clients can access as needed
				Real-time compliance data, reports, and documents on an easy-to-read dashboard
				Dashboards, compliance status, historical data, project process, and downloadable reports
			

				Phone Calls
				As needed, but particularly for urgent matters that require immediate attention
				Phone call or face-to-face video conferencing
				Immediate issues, urgent action items, complex problem review, and critical updates
			

				Reports
				Monthly, quarterly, or annually, depending on your client’s preferences and compliance requirements
				Detailed, formal document in PDF format that you can share with all key stakeholders
				Compliance status, audit results, risk assessments, remediation actions, and key roadmap milestones
			

	

Reporting Formats:

		
				Method
				Format
				Content
			
				Dashboards
				Interactive and visual, accessed through a secure client portal
				Real-time compliance metrics, risk levels, historical trends, and compliance project status
			
				Executive Summaries
				Concise, high-level document summarizing critical compliance statuses and high-priority issues
				Overall compliance health, significant risks, and strategic recommendations
			
				Detailed Reports
				Compliance documents with in-depth analysis and data in PDF format that you can share with key stakeholders
				Full compliance assessments, audit results, detailed risk analysis breakdowns, and action plans
			
				Compliance Scorecards
				Visual, easy-to-read scorecards demonstrating compliance performance compared to benchmarks or standards
				Scores or ratings for various areas of compliance highlighting strengths and vulnerabilities
			
				Incident Reports
				Detailed reports documenting specific incidents or breaches as necessary
				Incident description, impact analysis, response actions, lessons learned, and how to move forward

Best-Practices:

Use clear, simple language

Ensure all communications and reports are clear and easy to understand. Avoid using jargon or technical language for non-technical clients.

Customize reports and communication with each client

Tailor your reports, metrics, and areas of focus to the specific needs and preferences of each individual client (while still adhering to a repeatable, scalable reporting process)

Communicate with timeliness and consistency

Deliver reports on time as outlined in initial conversations; promptly respond to urgent client communications and manage expectations as necessary

Create feedback loops

Encourage clients to provide feedback on your communication and reporting process so it can be tailored and optimized to their needs

8.5

How to Create a Scalable CaaS Offering

What does a scalable CaaS offering look like?

Standardized Internal Processes

Each step in the compliance process — from pitching and onboarding clients to delivering your service — must be proceduralized in full detail. This will help ensure there are no gaps in your processes while also making it repeatable. By standardizing these processes, you can streamline the training process for your team and ensure each step is always done the same way, every time.

Automated Compliance Software Solutions

Automation can save you a ton of time, energy, and effort as you roll out your solution for clients. The goal is to leverage automation tools to minimize duplication of effort and keep things organized. These tools are invaluable in making your offering scalable, so you can serve your hundredth client just as well as you served your first.

Clear, Repeatable, and Standardized Service Offerings

It is very difficult to scale custom offerings. But every client is different. So how can you find that middle ground? By creating a clear, repeatable service offering, you can scale your offering while maintaining high standards. If custom elements are necessary, they can be designed as bolt-ons to your standard package.

Scalable Pricing Model

Pricing your offering correctly is a tricky process, and there is rarely a “one-price-fits-all” approach that will work indefinitely. Serving a client with 10 employees can be quite different than serving one with 100 — it’s critical that you plan for pricing as your clients increase in size.

Explore Chapter 9 to learn more about the most common mistakes made by Compliance as a Service providers (and how to avoid them!).

Chapter 7

How to Talk to Your Clients About Risk Management

Regulatory and compliance training starts the conversation — equip your MSP with the right talking points to communicate the value of your CaaS offering.

Chapter 9

Pitfalls to Avoid

Selling CaaS can be complex — explore the most common mistakes MSPs make when selling cyber compliance, so you can avoid the pitfalls.

Method	Frequency	Format	Content
Regular Meetings	Monthly or quarterly (after initial setup)	Face-to-face video conferencing or in-person meetings	Ongoing compliance status, critical project progress, top priority issues and risks, upcoming audits or action items, and general updates on relevant regulations
Email Updates	Weekly or bi-weekly	Clear, concise emails with bullet points summarizing critical updates, action items, and immediate concerns	Status updates, compliance checks, new regulations, and reminders for upcoming deadlines
Client Portal	Clients can access as needed	Real-time compliance data, reports, and documents on an easy-to-read dashboard	Dashboards, compliance status, historical data, project process, and downloadable reports
Phone Calls	As needed, but particularly for urgent matters that require immediate attention	Phone call or face-to-face video conferencing	Immediate issues, urgent action items, complex problem review, and critical updates
Reports	Monthly, quarterly, or annually, depending on your client’s preferences and compliance requirements	Detailed, formal document in PDF format that you can share with all key stakeholders	Compliance status, audit results, risk assessments, remediation actions, and key roadmap milestones

Method	Format	Content
Dashboards	Interactive and visual, accessed through a secure client portal	Real-time compliance metrics, risk levels, historical trends, and compliance project status
Executive Summaries	Concise, high-level document summarizing critical compliance statuses and high-priority issues	Overall compliance health, significant risks, and strategic recommendations
Detailed Reports	Compliance documents with in-depth analysis and data in PDF format that you can share with key stakeholders	Full compliance assessments, audit results, detailed risk analysis breakdowns, and action plans
Compliance Scorecards	Visual, easy-to-read scorecards demonstrating compliance performance compared to benchmarks or standards	Scores or ratings for various areas of compliance highlighting strengths and vulnerabilities
Incident Reports	Detailed reports documenting specific incidents or breaches as necessary	Incident description, impact analysis, response actions, lessons learned, and how to move forward