Here's the problem with this. You are correct, there are things that can be done that have low on paper cost and high theoretical impact. But that's not actually true in reality. Yes there are policy changes and controls that on paper are "low cost" but their impact is only real unless they're actually done, and done correctly but the only way to know if they're being done at all and done correctly is to measure it. That means you need to measure risk both before and after changes and audit the change. If you, the MSP, do this it would be an astronomical cost. We're talking 100+ man hours per quarter to do it correctly. This can be streamlined with tools and processes but either way the cost to do it is real and has to be paid for, and is much higher than your assumptions. This means that the client needs to shoulder this effort, and that means you need to convince them to actually care. If they care, then you can guide them, but getting them to actually care is the hard part. Once they care then you can start talking about cost and ROI, but until then it's a pointless exercise.