Compliance is no longer optional: for most companies, it’s a critical requirement. Organizations across many different industries and countries must demonstrate adherence to regulatory frameworks, many of which demand robust cybersecurity measures. As an MSP, you’re the one responsible for guiding clients through these frameworks. Not only must you effectively implement their security programs, but you must also prepare them for audits.
Yet, meeting these standards is often easier said than done. Compliance frameworks require technical depth, continuous monitoring in real time, and the ability to map security controls to specific requirements. For MSPs, the complexity compounds given the fact that many clients fall under scope for more than one framework.
Thankfully, governance, risk, and compliance (GRC) solutions provide a way to streamline compliance management across multiple clients at scale. But, before exploring some real world examples, let's first detail several prominent frameworks, their requirements, and potential difficulties.
Compliance frameworks extend far beyond paperwork, placing real demands on how organizations structure their cybersecurity programs. Organizations must implement, test, and document controls in a way that can withstand external audit scrutiny. For MSPs, this means not only deploying security technologies but also proving they align with framework-specific requirements.
In addition, frameworks often require organizations to demonstrate security maturity over time. Auditors require ongoing evidence of patch management, incident response readiness, or user access reviews across multiple months or years. These requirements move compliance out of the realm of “one-time projects” and into the continuous discipline of GRC. Without clear processes and tooling, maintaining this level of readiness is difficult for organizations of any size.
Many experts recognize CIS Controls as one of the most practical sets of cybersecurity best practices available today. Unlike regulatory requirements, CIS is a prescriptive framework that any organization can follow adopt to strengthen their defenses. Version 8.1 reflects the latest evolution of these controls, designed to combat the most pervasive, real-world cyber threats.
What makes CIS particularly important is its tiered, priority-driven model. The framework organizes 18 control families into “Implementation Groups.” These allow organizations to scale their adoption based on their resources and risk profile.
From asset management to incident response, CIS provides a roadmap that directly ties security activities to threat reduction. For MSPs, CIS provides a starting point for clients with limited budgets while remaining relevant for more mature organizations. It also gives a platform from which MSPs can build consistency into their cybersecurity operations across every tenant.
Initially developed for U.S. critical infrastructure, the NIST Cybersecurity Framework (CSF) is one of the most widely adopted cybersecurity models worldwide. It organizes cybersecurity practices into five core functions: Identify, Protect, Detect, Respond, and Recover.
Rather a requirement checklist, NIST CSF provides a structure for organizations to iterate on their cybersecurity maturity over time. As such, many organizations use NIST CSF as a baseline to align with other frameworks. It also create a method to communicate the evolution of cybersecurity posture to executives and stakeholders. For MSPs, CSF provides a common language for discussing risk and resilience with clients and government agencies.
NIST SP 800-171 is a standard that sets specific requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems. For federal contractor organizations, where safeguarding CUI is a prerequisite for doing business, NIST SP 800-171 is imperative.
The framework contains 110 security requirements organized into 14 control families, covering everything from access control to system integrity. What makes NIST SP 800-171 important is its direct linkage to federal contracts, serving as a baseline for CMMC requirements.
The U.S. Department of Defense developed the Cybersecurity Maturity Model Certification (CMMC) to protect sensitive information within the defense supply chain. Unlike voluntary frameworks like CIS v8.1, CMMC is mandatory for contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Many CMMC requirements map directly to NIST SP 800-171, demanding contractors to implement specific technical and procedural safeguards.
In practice, CMMC doesn’t just require organizations to “check the box” on security. It establishes tiered maturity levels, ranging from foundational practices to advanced protections. Organizations must meet each level based on the sensitivity of the work they perform and its associated data. For MSPs serving government contractors, CMMC is non-negotiable: failing to achieve certification can disqualify clients from winning contracts.
Cyber Essentials is a UK government-backed certification designed to help organizations reduce risks and protect themselves against threats. Unlike broader frameworks, Cyber Essentials focuses scope on five core security controls: firewalls, secure configuration, access control, malware protection, and patch management.
When implemented, Cyber Essentials establishes a cybersecurity best practice baseline. Many UK government contracts require Cyber Essentials, but it also serves as a confidence signal for private-sector clients. Certification demonstrates that an organization has taken practical steps to secure its IT environment. For MSPs, guiding UK clients through Cyber Essentials easily establishes credibility and reducing exposure to common cyberattacks.
The National Cyber Security Centre (NCSC) developed the UK's CAF to provide a structured approach to assessing cybersecurity in critical national infrastructure. Unlike prescriptive lists of controls, CAF focuses on achieving specific security outcomes. These outcomes span governance, risk management, resilience, and incident response—areas critical to national security.
More stringent than Cyber Essentials, CAF shifts the focus away from achieving compliance for its own sake. Instead, it emphasizes whether organizations are capable of managing risks to maintains essential functions even under attack. For MSPs supporting clients in regulated UK industries, CAF assessments are a requirement. Therefore, they must align these clients' cybersecurity practices with its outcome-driven expectations.
The Gramm-Leach-Bliley Act (GLBA) applies to U.S. financial institutions and their service providers. It requires these entities to safeguard sensitive customer financial information through comprehensive administrative, technical, and physical protections. Federal regulators such as the Federal Trade Commission (FTC) require GLBA for any organization dealing with finances.
Given that it pertains to individuals' financial information, GLBA matters because the stakes are high. Financial data is a prime target for cyber criminals. Naturally, regulators expect institutions to take measurable steps to protect it.
So, GLBA compliance is both a legal obligation and a key part of customer trust. The GLBA Safeguards Rule compels organizations to conduct regular risk assessments, design security programs, and oversee service providers. As an MSP with clients in banking, insurance, or financial services, this responsibility falls directly on you.
HIPAA is one of the most widely recognized compliance frameworks in the United States. It sets strict requirements for safeguarding protected health information (PHI) on healthcare providers, health plans, and their business associates. HIPAA’s Security Rule outlines administrative, technical, and physical safeguards that organizations must put in place.
What makes HIPAA particularly challenging is the scope of enforcement. The U.S. Department of Health and Human Services regularly audits and investigates reported breaches. Noncompliance results in substantial fines, making it critical that organizations remain up to date on all their controls. For MSPs supporting healthcare clients, HIPAA compliance requires not only strong cybersecurity controls but also rigorous documentation and training programs.
The U.S. Department of Health and Human Services, in collaboration with industry stakeholders, developed the Healthcare Industry Cybersecurity Practices (HICP) guidelines. Unlike HIPAA, HICP is not a regulatory mandate but rather a set of voluntary practices designed to help healthcare organizations improve cybersecurity resilience.
HICP's design recognizes the unique challenges faced by healthcare providers. From small-practice resource constraints to complex hospital IT systems, the guidance tailors approaches based on organizational size. HICP gives MSPs a blueprint to align cybersecurity services with industry-driven best practices, even for HIPAA-focused clients.
When viewed together, these frameworks share common cybersecurity undertones: access control, monitoring, incident response, and continuous improvement. However, mapping security controls across multiple frameworks creates significant challenges for MSPs:
These challenges often result in resource strain, difficulty demonstrating compliance to clients, and gaps in audit readiness.
An example of these struggles from a client's perspective is the story of Traxyl, a U.S. government contractor. Traxyl needed their business operations to comply with CMMC as well as International Traffic in Arms Regulations (ITAR).
Yet, the nature of Traxyl's business made it difficult to manage their own compliance program and security risks. They needed a partner to implement a program that met the industry data security standards of their government customers.
Another such organization is the Fritz Clinic, a rural healthcare provider. During the COVID-19 pandemic, they had to weigh the risks of endangering their patients and staff against their compliance risks. They needed a way to maintain operations by implementing a more remote treatment model. This, of course, drew questions regarding HIPAA and the management of patient health records and other personal data.
At the time, Fritz Clinic didn't have any digital infrastructure or information security management systems in place. But, they also couldn't safely keep their usual in-office visits. They needed a partner to innovate their approach while also maintaining corporate governance to keep them HIPAA compliant.
One example of these struggles from the MSP side is the experiences of the Iron Dome, a UK-based IT service provider. As they expanded their operations to support clients with compliance needs like Cyber Essentials, they found that their tool stack sprawl held them back. Iron Dome needed a way to consolidate their efforts while still ensuring effective security outcomes for their clients. They needed to save time to remain ahead of a shifting compliance landscape.
Iron Dome found their path to streamlined security and Cyber Essentials compliance through Todyl. Using the comprehensive security platform, Iron Dome cut out stack bloat while delivering better security to their clients. Implementing Todyl GRC also helped Iron Dome to demonstrate technical controls, perform security assessments, and document policies. This gave their clients additional reassurance and confidence in Iron Dome's value.
You can read their full story here.
As for Traxyl, they turned to their local compliance experts and Todyl partner, Queen Consulting. Queen Consulting used the breadth of the Todyl platform to:
In fact, by partnering with Todyl, Queen Consulting covered nearly 50% of CMMC requirements in just one solution. Learn more about their proactive approach here.
Fritz Clinic reached out to MSP, SIP Oasis, another Todyl partner to tackle their growing need for innovation. SIP Oasis used Todyl SASE to overhaul the entire operation. They created secure remote connections between doctors and patients without putting lives or sensitive data at risk. What's more, it only took 3 days to do it all, keeping Fritz Clinic HIPAA compliant the entire time.
Read about their secure, compliant telehealth implementation here.
For MSPs who need to support their clients' compliance requirements, Todyl GRC makes it easy to understand and implement the proper security controls. GRC provides a simplified Compliance Assistant for checking which frameworks and regulations clients may be in scope for. Todyl automatically maps security controls to the the frameworks covered above and many others to give you a straightforward view into what needs to be addressed to make clients audit ready. A native policy documentation repository helps you consolidate governance data and present procedures to auditors and other stakeholders.
And, since GRC is part of the Todyl platform, you can streamline your compliance efforts in the same pane of glass you use to manage client security programs and reduce risk. Check out GRC and the rest of the Todyl platform today in your own personalized demo. Contact us to get started.
