For MSPs, offering compliance begins at home

When you’re on an airplane, they tell you to put your own oxygen mask on first before helping someone else. Nobody argues with that advice because it makes perfect sense. You can’t help others if you’re struggling yourself. The same applies to compliance.

I’ve noticed that many MSPs want to add compliance services because their customers are asking for them, regulations are changing, or they see a new revenue opportunity. All perfectly valid reasons. But here’s the uncomfortable truth:

If you haven’t gone through the compliance journey yourself, you’re selling theory, not expertise.

And customers can tell the difference. Your clients aren’t looking for someone who has read the framework. They’re looking for someone who has lived through the challenges, navigated the gaps and understands what good looks like in practice.

Without that experience, you’re asking customers to trust you with something you’ve never done yourself. That’s a difficult conversation to win.

The automotive industry already learned this lesson

When established car manufacturers started responding to new competitors, many of them made a classic mistake.

They didn’t just modernize their products. They started abandoning the expertise that had made them successful in the first place. Volkswagen, for example, moved heavily toward touchscreen interfaces and removed controls customers had relied on for years. The result wasn’t innovation. It was frustration. Eventually, they corrected course.

The lesson for MSPs is simple:

Modernize your business. Don’t abandon your strengths.

Adding compliance services doesn’t mean becoming a compliance company. It means building on the trust you’ve already earned. Your customers don’t want a completely different MSP. They want the MSP they already trust to help them solve a new problem.

Compliance is becoming a buying criterion

For years, MSPs could compete primarily on service quality, responsiveness and technical expertise. That isn’t enough anymore.

Regulations like NIS2 in the EU or the Cyber Security and Resilience Bill (CSRB) in the UK are increasing compliance pressure across Europe, and similar requirements are emerging elsewhere. Many organizations are discovering that compliance doesn’t just affect them. It affects every supplier they depend on.

That changes the conversation.

Increasingly, customers aren’t asking: “Can you manage my IT?” They’re asking: “Can you help reduce risk in my business?”

Those are very different questions. The MSP that can demonstrate operational maturity, governance, security and compliance awareness will have a significant advantage over the MSP that only talks about tickets and SLAs.

In other words, compliance is no longer just a revenue opportunity. It’s becoming a competitive requirement. Ignore it long enough and somebody else will have that conversation with your customer.

Compliance is about confidence, not regulation

One mistake I made in the past and see frequently now is treating compliance as a legislation problem. It isn’t. Legislation is simply one source of pressure. Investors want predictability. Banks want resilience. Insurance providers want reduced risk. Customers want reassurance.

Everybody is asking the same underlying question: “Can I trust this business?”

That’s why compliance matters. What customers are really buying isn’t a framework, an audit or a policy document. They’re buying confidence.

And the fastest way to lose confidence is to provide advice you haven’t followed yourself.

Do the work before you sell the work

This is where many MSPs get it backwards. They build a service offering first and work out the operational details later. I would argue the opposite. Become compliant first. Then productize what you learned.

The gaps you uncover inside your own business are often the same gaps your customers are struggling to solve. The questions your auditors ask are the questions your customers will face. The documentation you need is the documentation your customers will need. The process becomes the product. And that’s where real value is created.

Not from theory but from experience.

Start with one question

If I were running an MSP today, I wouldn’t start by building a compliance service. I’d start by asking a much simpler question: What is the biggest risk in my own business right now?

Not five risks, not ten. Just one.

Find it. Measure it. Address it. Document what you learned. Then repeat.

Because here’s the reality:

If you can’t explain your own risk posture, your customers won’t trust you to improve theirs.

Call to action

Before the end of this month, identify your largest compliance or operational risks inside your own MSP. Don’t start with a customer assessment. Don’t start with a marketing plan. Start with your own business. Review your documentation, your processes and your controls, and identify the gaps. Then ask yourself a simple question:

Would I be comfortable explaining this weakness to my largest customer?

If the answer is no, you’ve just found your starting point. Because the best MSPs won’t be the ones talking about compliance. They’ll be the ones proving they’ve already done it.