In a world where there are increasing numbers of regulatory and legislative actions driving compliance, we should not forget the influential role of insurance as a force of change. This is especially true with the managed services profession.
While many MSPs today are focused on CMMC (in the United States) and ISO (in Europe) as upcoming standards of interest, we should pay close attention to what is happening within the insurance sector. Insurance companies, particularly those involved in cyber liability insurance, are undergoing a significant re-evaluation of how they approach, assess risk, and underwrite MSPs.
Insurance companies tired of claims made by "self-described" MSPs have realized that a better system is needed for underwriting cyber liability insurance products. Cyber policies are issued to MSPs and their customers, but the MSP is an indispensable element of the cybersecurity defense ecosystem, and the insurance industry knows this!
What makes their job difficult is that insurance carriers have difficulty determining who is an MSP and who isn't. More specifically, when an MSP applicant wants cyber insurance, the insurance company needs to determine whether the applicant is an MSP and whether they follow best practices designed to lower their overall risk profile.
Insurance is Forcing Compliance
It has been challenging to drive security (and other) best practices across some of the mess mature sectors of the IT services industry (note, these are not often MSPs). A common theme amongst less mature break/fix providers is offering compelling IT services to customers but frequently falling short on internal IT security practices. This is somewhat understandable since break/fix providers come from a place where they have not typically had persistent ongoing access to customer systems. Since the beginning, MSPs have been accustomed to this persistent ongoing remote access and have taken this responsibility seriously.
The insurance sector has a unique ability to force positive change across the IT services and managed services professions. As cyber insurance policies are being sought after and renewed at increasing rates, the insurance providers realize that they must have more information about the MSP applicants than they have previously received. Part of this is because insurance carriers are gaining more experience in their dealings with MSPs. This experience is not just due to receiving cyber claims. I believe it is because these insurance companies are being exposed to more MSP relationships, and as such, they are becoming more comfortable with them as a profession. Anytime you have more dealings with a particular group, you will inevitably gain more experience, knowledge, and wisdom about that group.
