Managed Services Immunity: A New Policy Approach to Comprehensive Cyber Legislation

These frameworks do have differences, but they have many commonalities. One of those commonalities is that complying with these frameworks is nearly impossible without some form of proactive IT management and governance approach within the organization. It is surely impossible to comply with these frameworks while purely relying on reactive IT models. Proactive IT management is a necessity to achieve compliance.

Since most small and mid-sized organizations do not have sufficient internal IT resources to accomplish fundamental proactive IT management, these organizations are left defenseless and incapable of mounting any significant cyber defense against competent, well financed, and evolving cyber bad actors. Enter the MSP.

Managed Services = Proactive IT Management

Managed IT services, delivered by managed service providers, is proactive IT management. For at least three decades, MSPs have been helping their clients achieve proactive IT management, security, and data protection, while simultaneously doing so within a “pay as you go” billing model. While there are many organizations who claim to be MSPs, a true MSP will only apply a proactive IT management model to their clients. Any organization delivering a reactive IT management model a) should not be considered an MSP, and b) should not be considered a credible deterrent to modern day cyber threats1.

Cyber Immunity

One of the challenges faced when shaping public policy concerning cybersecurity is how to differentiate between organizations adopting proactive IT management and those who do not. Understanding proactive vs reactive IT management is challenging enough within the IT profession, so comprehending these complex issues outside professional IT circles is not to be taken likely.

The goal for all organizations ought to be proper cyber hygiene. Proper cyber hygiene is not really in debate amongst industry experts. Where it gets tricky is enforcing cyber hygiene among less mature organizations who do not fully understand or appreciate cyber risk. It should also be noted that even smaller organizations who fully appreciate proactive IT management and cyber hygienic practices, may not be capable of meeting those objectives without external assistance. The failure to properly respect and understand cyber risk is something which must be addressed and rectified and is a goal we must all undertake.

At the end of the evolutionary journey towards cyber hygiene is the crown jewel of IT management, data management, and cyber security preparedness we can characterize as cyber immunity.

What is cyber immunity? As cybercrime continues to run rampant globally, the number and scope of cyber legislation is also increasing. Cyber immunity addresses the issue of practicing proper cyber hygiene and offering some measure of protection for the organization against cyber legislation which may otherwise be adverse to the organization.

Cyber immunity, in its most basic form, treats cyber hygienic organizations who have been attacked by cybercriminals as victims, and not as entities deserving of additional persecution and shame. Already, several US states have been passing “cyber immunity” legislation to incentivize positive cyber practices.

Managed Services Immunity

Having introduced the concept of cyber immunity, we now must address the question of how cyber immunity will be realistically implemented. Organizations, even those aware of cyber security issues and desirous of achieving cyber hygiene, must deal with the reality of how to achieve effective cybersecurity and IT management goals.

We have already examined the distinctions between reactive and proactive IT management and the need for a proactive approach to IT management and cybersecurity to achieve cyber hygiene. The path towards cyber immunity must follow the path already well paved called managed services.

Managed IT services is the only way to achieve cyber hygiene, and therefore, cyber immunity. Which brings us to the issue of managed services immunity. Providers of managed services are quite capable of delivering scalable and proactive IT and cybersecurity solutions to their clients, thereby equipping those organizations with the cloak of managed services immunity against future cyber-criminal activity and potential legislative repercussions resulting from any cyber activity.

Footnote

Updated August 20, 2025 The State Senate of Texas passed SB 2610, which was signed by the governor on June 10, 2025 and becomes law September 1, 2025. The law creates a cybersecurity "safe harbor" for small and medium sized businesses in the state of Texas. It limits their civil liability for exemplary (punitive) damages in the event of a data breach if the entity can demonstrate that they had implemented and maintained a qualifying cybersecurity program at the time of breach.