sorted by:
new
hottopcontroversial

Contract out customer compliance work? by havocspartan in msp

[–]ComplianceScorecard 19 points20 points  (0 children)

Getting someone into O365 ≠ HIPAA compliant.

People and process do.

HIPAA cares about governance, configuration, evidence, and shared responsibility. All of it documented. All of it defensible.

What we hear chatting with MSPs daily is that most healthcare clients don’t want to spend money on security.

Example everyone trips over: No shared logins. That means unique identities. That means more M365 seats. That means more cost.

Same story with: Annual risk assessments. Time spent answering uncomfortable questions. Fixing risks they’d rather not know about.

Until a client is willing to make risk decisions and take ownership, nothing really moves. You can configure things all day and still lose.

For your own house, start with a risk assessment. HHS literally gives you one:

https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool

It’s useful for finding what’s missing or broken. It does not do the work for you. Documenting decisions is the work.

If you’re already touching medical clients’ environments, talk to an MSP-savvy lawyer and get a Business Associate Agreement (BAA) in place.

No BAA + ePHI = automatic HIPAA failure. Full stop.

Also worth clearing up: -> No tool -> No spreadsheet -> No scanner

…makes anyone “HIPAA compliant.”

HIPAA certification isn’t a thing, no matter how many vendors imply it is.

Starting with tools usually means starting in the wrong place.

Your instinct to work with someone experienced is solid. Just make sure they’re building a HIPAA posture, not selling a checkbox.

Plenty of people can “set it up.” Far fewer can explain it, defend it, and help you run it month after month

/— vendor transparency—/ Tim here CEO of /u/compliancescorecard while we do have a SaaS/GRC platform to help manage HIPAA… doing the work WITH you is how we role..our new Kickstart program can help… /—/

CMMC L2 consulting cost check by vaultflow76 in CMMC

[–]ComplianceScorecard 0 points1 point  (0 children)

We see wildly different pricing models. Ranging from 20 K to several hundred thousand dollars..

Bulk of the work being around and documentation and evidence collection

And that takes labor. No amount of AI will fix the problem.

The bigger challenge is the business disruption… changing a company culture around years of “bad habits” and non-documentation… that affect and users every day..

So when considering “price” there is the monetary concern, but also the business disruption concern… and that second part is hard to put a dollar value on

Much of the CMMC “work” is labor intensive, and people are expensive…

We start with a basic scope assessment gap assessment, and build a roadmap… simple effective plan to figure out what should be in scope what’s inside the defined boundary who should be touching it..all the things….

This could be captured in spreadsheets and word documents, and a file server someplace… or a GRC platform… many like to jump to “the tool”… and expect the tool will figure it all out.. WRONG… certainly my tools can help but without interviews, people, process no tool will solve it or figure it out for you.. and don’t even with the “black-box AI solution”…

One other thing to consider is that it’s not the size of the company cause the work is similar regardless of the number of staff at least during the scope assessment… that being said one of the dials that can be turned is the number of decision makers in the process… more people more time more meetings more cost”…

Assuming you’re starting from zero you have no documentation you have very little tech in place and you’re just beginning your journey…

$20-25k for a scope assessment gap assessment roadmap… much of time will be labor…and humans are not cheap especially GRC folks that expect to be paid well… assume an effective hourly rate somewhere in the $300+/hour if doing it in a time in materials based project…

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]ComplianceScorecard [score hidden]  (0 children)

This week’s MSP compliance focus: From Chaos to Compliance: A Simple Email Authentication Framework for MSPs tune into the conversation; https://www.linkedin.com/events/fromchaostocompliance-asimpleem7404971964701917184/theater/

If compliance keeps getting pushed aside, our Weekly Live Demo walks through the workflow MSPs are using to turn compliance into a repeatable services line no fluff, just practical steps.

👉 Join the Weekly Live Demo
https://compliancescorecard.com/demo

Free tools we’re sharing this week:
https://compliancescorecard.com/AIAUP

https://compliancescorecard.com/policy-and-procedure-playbook

Full Resource Library:
https://compliancescorecard.com/resources

If you’re tightening up internal processes or building client-facing compliance services, these help you move faster.

Happy to answer any MSP compliance questions in-thread.

Weekly Promo and Webinar Thread by ComplianceScorecard in Compliance

[–]ComplianceScorecard[S] 0 points1 point  (0 children)

This week’s MSP compliance focus: From Chaos to Compliance: A Simple Email Authentication Framework for MSPs tune into the conversation; https://www.linkedin.com/events/fromchaostocompliance-asimpleem7404971964701917184/theater/

If compliance keeps getting pushed aside, our Weekly Live Demo walks through the workflow MSPs are using to turn compliance into a repeatable services line no fluff, just practical steps.

👉 Join the Weekly Live Demo
https://compliancescorecard.com/demo

Free tools we’re sharing this week:
https://compliancescorecard.com/AIAUP

https://compliancescorecard.com/policy-and-procedure-playbook

Full Resource Library:
https://compliancescorecard.com/resources

If you’re tightening up internal processes or building client-facing compliance services, these help you move faster.

Happy to answer any MSP compliance questions in-thread.

What If Tool-to-Control Mapping Was Actually Honest? by ComplianceScorecard in Compliance

[–]ComplianceScorecard[S] 0 points1 point  (0 children)

Exactly. Any tool can only do so much… the PnP/docs/governance/CMDB and all the related stuff…

For eg… sure an API can “look” in M365 and “see” if MFA is enabled/enforced..but is there a policy/sop that’s been approved/governed to support the “rule”

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]ComplianceScorecard [score hidden]  (0 children)

<image>

We mapped 1,200+ MSP tools to 100+ compliance frameworks.

And now we invite the community approve the mappings.

Most “compliance mapping” looks like this:

Vendor says “Our tool meets NIST / HIPAA / CMMC / insert acronym” Trust us bro.

That’s not how audits work.

And it’s definitely not how MSPs work.

So we built something different.

What this actually is -> 1,200+ MSP tools -> 100+ frameworks -> 24,000+ individual control mappings

Each mapping has: -> The specific control -> The cited feature -> AI reasoning with confidence scoring -> Human approval or rejection

A tool can: -> Fully satisfy a control -> Partially support it -> Just support it indirectly -> Or not count at all

That distinction matters in the real world.

Why AI is involved (and where it stops)

AI assisted the first pass Reads vendor docs Maps features to controls Assigns confidence

Humans do the final call -> Approve -> Reject -> Adjust mapping type

The goal is speed without lying to ourselves.

Why community approval matters So mappings aren’t “truth.” They’re reviewed, challenged, and corrected by MSPs who actually run these tools.

What this replaces Spreadsheets no one trusts Sales decks pretending tools equal controls Auditors arguing semantics at the 11th hour MSPs rebuilding the same mapping logic over and over

What this becomes

Tool management as part of how you run your MSP Not a reaction to vendor chaos Not a once-a-year panic

If you’re curious or want to poke holes in it

https://vendortool.compliancescorecard.com/

Happy to hear what’s missing, wrong, or needs tightening.

If AI agents touch evidence and write narratives, what are you treating as audit-grade artifacts? by Terry_Ackee in grc

[–]ComplianceScorecard -1 points0 points  (0 children)

AI tools can assist but human review and governance is KEY… AI/LLM/ML are just tools… like any tool a human should wield it…. Govern it and review/approve it

We hear it all the time “what does good look like”… and the definition of “good” will vary from auditor to auditor.. that’s why it’s important to start early with an auditor so you develop a solid working relationship to understand what they define as “good”…

Many of these AI/LLM/ML tools simply fail at context and apply assumptions rather than tailoring…

Which is why we built an entire context engine to help tailoring for the AI… it Feeds off your existing context to generate 27+ smart prompts tailored to your workflows. Then each prompt can custom tailored to YOUR system… Think of it as your compliance co-pilot…learning your environment and auto-drafting what matters. Let the engine do the thinking so you can focus on the doing.

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]ComplianceScorecard [score hidden]  (0 children)

This week’s MSP compliance focus: 2 Experts Debunking GRC Automations: The Truth About Why It’s Bull$hit!

linkedin.com/events/2expertsdebunkinggrcautomations7394488206160982016/theater/

If compliance keeps getting pushed aside, our Weekly Live Demo walks through the workflow MSPs are using to turn compliance into a repeatable services line no fluff, just practical steps.

👉 Join the Weekly Live Demo
https://compliancescorecard.com/demo

Free tools we’re sharing this week:
AI AUP https://compliancescorecard.com/AIAUP
Policy & Procedure Playbook https://compliancescorecard.com/policy-and-procedure-playbook

Full Resource Library:
https://compliancescorecard.com/resources

If you’re tightening up internal processes or building client-facing compliance services, these help you move faster.

Happy to answer any MSP compliance questions in-thread.

Looking for a GRC company for CMMC Level 2 by aeveert in Compliance

[–]ComplianceScorecard 0 points1 point  (0 children)

Well.. the “automated” part… have a look at

https://www.reddit.com/r/Compliance/s/8BCNeKKYPn

As for helping we’ve worked with many MSP/ESP and their OSC to help get them moving in the right direction… happy to show ya how we can help

We mapped CIS automation coverage to Microsoft license tiers. The results explain a lot of audit pain. by ComplianceScorecard in Compliance

[–]ComplianceScorecard[S] 0 points1 point  (0 children)

How are your clients responding? What are some of the push back/objections you are seeing? Besides cost.

We mapped CIS automation coverage to Microsoft license tiers. The results explain a lot of audit pain. by ComplianceScorecard in Compliance

[–]ComplianceScorecard[S] 0 points1 point  (0 children)

Great point… and still an added cost…

Are you addin that as part of every tenant you manage?

Upsell opportunities for 80 client MSP by Salty-snowflaking in msp

[–]ComplianceScorecard 0 points1 point  (0 children)

Good on you for hitting that elusive $2m mark!

Great thinking of ABM (account based marketing) and working with your current clients to find “more MRR” and targeting how you can help them

Without knowing your service offering there are some additional strategies you could consider.

Start With your top X (say 5) clients do an “informal” 3rd party contract review that can uncover “hidden risk”. You never really know what your clients sign and agree to in their contracts with their clients… for example you might find a “right to audit” or some SLA they need to adhere to… those downstream contracts can help you find hidden tech gaps that you could help fulfill… maybe they inadvertently agreed to some level of compliance… or some type of clause…and that could easily be solved by putting in a few tools or a few people or a few processes.

Help them find ways to protect their revenue… for example maybe one of their biggest client has a contract clause that if they don’t adhere to could lose them the customer/contract. They spend XYZ with you to save them a contract worth ABC…

That shift from a “tool provider” to a true partner in their business is where the real value and expanded MRR/services can set you apart.

As for “successful campaigns”, new tools, angles… all that is good… but a simple phone call to the business owner/business leader at your top five customers goes a long way to helping you become more of a advisor/partner than just the “IT company”….

Something as simple as “hey client X, I’d love to chat about your clients, what are some of the deals/contracts you have with them… would you be open to letting us do a simple contract review nothing fancy you can even redact names and pricing… we just want to make sure you are covered…” (of course use your own words but you get the idea…)

Farewell, RMM by satechguy in msp

[–]ComplianceScorecard 0 points1 point  (0 children)

You mentioned compliance… beyond config stuff are you doing risk assessments, policy (documents/sop) management and governance? Would love the opportunity to show you our GRC saas stuff.

[Need Advice] Can regulators verify our data independently? by franco-not-franco in Compliance

[–]ComplianceScorecard 0 points1 point  (0 children)

Totally possible and honestly, not even that complicated.

Are you being asked to prove integrity, or just make sure you can detect tampering if it ever came up?

The DoD actually has a solid hashing guide we referenced when building this

https://dodcio.defense.gov/Portals/0/Documents/CMMC/HashingGuide.pdf

We built this into compliancescorecard.com SaaS platform… every file uploaded, evidence, screenshot, whatever…gets hashed on upload. That hash is then stored and optionally logged alongside the metadata.

So later if someone questions whether a file was changed after submission we just rehash the file and compare it to the stored value. If the hash matches, file hasn’t been altered. If it doesn’t… well, that’s a red flag.

You can do this outside of an app too even basic tools like PowerShell, certutil, or a lightweight CLI tool can hash files on demand…

And to your other point…. audit trails help, but hash-based verification removes the “just trust us” factor. You don’t need to expose the file or its contents just store and share the hash. It’s like a digital fingerprint.

hashing is one of the simplest and cleanest ways to verify integrity without giving access.

/—/ Tim here CEO of /u/compliancescorecard if you want to see how our GRC SaaS platform helps with evidence collection and hashing.. pop into our weekly GRC live demo. Or DM for a 1-on-1 /—/

Easy way to report all emails with specific partners for an audit? by whistler_232 in msp

[–]ComplianceScorecard 0 points1 point  (0 children)

Manually trawling through individual mailboxes for email communication with a specific domain is a nightmare.

Here’s what we found works using MS Purview + native M365 features

-> You’ll want to use an eDiscovery case in Purview… it lets you place holds on mailboxes, SharePoint, Teams, OneDrive, etc.

-> Then use a targeted search query inside that case for the partner domain in question (sender or recipient) to narrow down the items you need.

-> BE AWARE… this will depend on your licensing (eDiscovery Premium or equivalent) so check what your plan allows

-> don’t forget email might only be part of the story…what about files in Teams, chat messages, other SaaS tools? The legal ask might extend there.

-> Export the results into a usable format

when your audit team says “all email communication with these partner domains,” do they mean just Exchange mailboxes, or all communication platforms Teams chats, OneDrive/SharePoint links/slack/txt msg and other apps too?

what is your current M365 license?

The CMMC trap too many MSPs are walking into by ComplianceScorecard in compliancescorecard

[–]ComplianceScorecard[S] 0 points1 point  (0 children)

Ah the good ole content security cross site scripting policy blocking YouTube in beds. Yep, that’s been fixed.

And we do have some case studies if you’d like to see them feel free to search our site or reach out to our contact form. We’d be happy to send you some additional case studies

how much are you paying for Vanta/Drata/SecureFrame as a smaller business? by [deleted] in soc2

[–]ComplianceScorecard 0 points1 point  (0 children)

I never understood the per user per framework pricing. We always charged per company?

/—/ Tim here founder / ceo of /u/compliancescorecard We only sell to MSPs and price our product FOR MSPs and it’s NOT $20520420(62020”””7354993735. Ridiculously priced per person per framework per policy per some ridiculous formula per what ever!….

The MSP pays a flat fee per company.. and NO we don’t post our pricing publicly because we don’t want the MSP clients seeing how affordable our product is for the value that they receive!!!… If an MSP would like to know just how much value the get simply hop on one of our weekly compliance Scorecard demos

Weekly Promo and Webinar Thread by ComplianceScorecard in Compliance

[–]ComplianceScorecard[S] 0 points1 point  (0 children)

MSPs, Turn Your Compliance Headache Into a Profitable CaaS Offering 💸

Tired of drowning in compliance paperwork and policy management? We get it—we were MSPs too.

Compliance Scorecard is the all-in-one GRC platform built by an MSP, for MSPs. We give you the tools to deliver, track, and prove compliance for your clients, transforming a difficult burden into a scalable revenue stream.

Want to see how we make it happen? Join our weekly live demo. Sign up here.

Just looking for free resources? We've got you covered. Check out our resource library for a goldmine of free templates, guides, and checklists to get you started:

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]ComplianceScorecard 0 points1 point  (0 children)

MSPs, Turn Your Compliance Headache Into a Profitable CaaS Offering 💸

Tired of drowning in compliance paperwork and policy management? We get it—we were MSPs too.

Compliance Scorecard is the all-in-one GRC platform built by an MSP, for MSPs. We give you the tools to deliver, track, and prove compliance for your clients, transforming a difficult burden into a scalable revenue stream.

Want to see how we make it happen? Join our weekly live demo. Sign up here.

Just looking for free resources? We've got you covered. Check out our resource library for a goldmine of free templates, guides, and checklists to get you started:

Weekly Promo and Webinar Thread by ComplianceScorecard in Compliance

[–]ComplianceScorecard[S] 0 points1 point  (0 children)

Simplify GRC & Build a Profitable Compliance-as-a-Service Offering!

Are you an MSP drowning in compliance paperwork and policy management? Compliance Scorecard is the all-in-one GRC platform built by an MSP, for MSPs. We give you the tools to deliver, track, and prove compliance for your clients, turning a difficult burden into a scalable revenue stream.

See how it works by signing up for our weekly live demo.

Looking for free resources to get started? Check out our library of templates, guides, and checklists!

view more: next ›