What a Compliance Platform Is
Written by MSP Outpost.
In Short
A compliance platform maps a client's controls to a framework, collects the evidence that each one is in place, and produces the report an auditor, a customer or an insurer asks for. It is often confused with a vulnerability scanner: a scanner finds weaknesses on machines, while a compliance platform tracks policies, evidence and sign-off, and many MSPs run both.
What It Does
- Framework mapping. Lines up a client's controls against one or more frameworks and shows which are met and which are not.
- Evidence collection. Pulls proof from the tools already in place, such as the RMM, identity and backup, instead of screenshots in a folder.
- Policies. Templates for written policies, with version history and a record of which staff have read them.
- Risk register. Records known risks, who owns each one and what is being done about it.
- Questionnaires. Helps answer the security questionnaires and insurance applications clients keep receiving.
- Reporting. A report per client showing where they stand and what has improved, ready for a review meeting.
When You Need One
Most small MSPs do not need a platform yet. A written set of policies and a spreadsheet of controls per client will carry you until a client or an insurer asks for formal evidence.
Clients start forwarding insurance questionnaires and customer audits, and answering them by hand takes days. A multi-tenant platform turns that into a service you can charge for, and it is a good moment to put your own MSP through it first.
Compliance becomes a product line with its own staff and pricing. Choose a platform that handles several frameworks per client and connects to the tools you already run, or the evidence work will not scale.
What to Look For
Must Have
- Multi-Tenant Management
- Framework Templates
- Automated Evidence Collection
- Policy Templates
- Client-Ready Reports
- Integrations With Your Stack
Worth Having
- Risk Register
- Questionnaire Answering
- Staff Policy Acknowledgement
- Auditor Access
- Vulnerability Scanning
How It Is Priced
Most compliance platforms are quote only. Those built for MSPs tend to charge per client or per tenant, sometimes with a minimum number of tenants, while those built for a single company charge per company and by framework. Check whether each extra framework costs more, and whether an assessment or audit is included or billed separately.
Switching
The policies, evidence history and risk records built up for each client are the hard part to move, and switching in the middle of an audit is a risk you do not need. Before you sign, check that you can export policies in an editable format and evidence with its dates. Time any move for after a client's audit or renewal, not just before it.
Questions to Ask a Vendor
- Is it priced per client or per framework, and what does adding a second framework to a client cost?
- Which of my existing tools collect evidence automatically, and which need manual uploads?
- Can I export policies in an editable format, and evidence with its dates, if I leave?
- Was the product built for an MSP managing many clients, or for one company at a time?
- What is the minimum number of tenants, and can it go down?
- Who updates the framework templates when a standard changes, and how quickly?
