I recently read an article (in a CIO magazine of all places) posing the question whether MSPs should be offering CIO services to their managed customers. At first glance, you may ask 'why wouldn't a MSP offer CIO services to their customers'? CIO (or sometimes called virtual CIO) offerings deliver valuable consulting and advisory services to customers who need that high level IT strategy advice, chiefly because they do not have anyone on staff to fulfill that role. MSPs are frequently in good positions to offer these services to their customers.
But, are there any scenarios where the MSP should not deliver a CIO type of service to the customer? Let's examine two common situations where a virtual CIO service being offered by a MSP might be problematic.
Segregation of Duties
What is segregation of duties? According to Wikipedia, segregation of duties "is the concept of having more than one person required to complete a task." For those of you not familiar with this concept within the context of managed services, segregation of duties is the concept of separating the responsibilities of a particular control or process, and having more than one person participate in the delivery of that control or process. The reason for this is to prevent fraud or error by having a single person being responsible for the control or process.
The principle of segregation of duties is important for MSPs and is even embedded within the MSP/Cloud Verify program, to prevent intentional or unintentional actions by MSPs which could damage networks and systems, both internal and customer. Having a MSP perform managed and cloud services as well as serve as the CIO could be problematic if the appropriate controls are not in place.
MSP Expertise
If the customer is in a specialized field, it goes without saying that any MSP not possessing that domain level business expertise may not be capable of delivering true CIO services. However, this is different from a MSP operating in a specialized field and providing IT guidance, even without knowledge of the customer's field.
For example, there are quite a few medical providers who are experts at delivering medical services but completely ignorant about IT. In this scenario, the MSP acting as CIO would be appropriate, provided they a) understood enough about the medical field and b) had the appropriate controls in place to deliver both consulting and managed services.
