So, earlier today we wrapped up a webinar on SOC audits for managed service providers, and we had some fascinating feedback and data. First, if you missed the webinar and would like to view it, you can do so here.
Few MSPs Have a Current SOC Audit
As I suspected, a relatively low percentage of MSPs responding in the survey had a current SOC report; 22% to be exact. The rest of the MSPs did not. Even 22% is a large number as the actual percentage is probably less than 10% of MSPs who have a current SOC audit.
While this bodes quite well for those audited MSPs, it does present a significant opportunity for MSPs who haven't been audited yet. I have long viewed the certified MSP community as being mostly involved in servicing regulated customers. There are exceptions to this, but for the most part, certified MSPs have to be verified because their customers expect it of them.
As regulations become more widespread and involve data privacy and security, the demand for MSPs who are certified and audited will also rise. This means that the existing audited MSPs will not be enough to meet the rising demand for managed services. More MSPs who are verified and certified will need to enter the market to keep pace with the increased demand.
Top Responses You Should NEVER Use for Audit Report Requests
If you happen to be in the majority of those MSPs who are not audited, here are some helpful tips for when you respond to compliance or audit report requests from customers. These are things you should never tell your customers:
I don't have a data center
This demonstrates a fundamental lack of understanding about cyber risk and should never be used in polite conversation. It doesn't matter if you don't have a data center, you still can access customer data and therefore, you should have an audit report.
I don't host customer data
Similar to the excuse above, the claim that you don't host any customer data does not let you off the hook. To be clear, most MSPs do not "host" data or even own or control a data center. The unique role of MSPs as providers of remote managed services means that regardless of where the data center is (yes, that includes cloud for those millennials reading this) the logical or remote access to that data is still an unanswered issue which must be addressed for the customer. If you do host data, you'd better have a report, but if you don't an audit may still be a requirement depending on your customer and the nature of what you do for them.
