Partner Diagnostic

The MSP Compliance Maturity Model

Five stages from reactive to industry leader. Know where you are. Know where your clients are.

The Five Stages

Most MSPs are between Stage 1 and Stage 2 when they join Blacksmith. That’s not a weakness — it’s an opportunity. Understanding the model helps you diagnose your own practice, set realistic milestones, and have a credible conversation with prospects about where they sit.

  1. Stage 1

    Ad Hoc

    No formal security program. Reactive to incidents. Compliance only comes up when a client asks.

    What it looks like

    “We handle things as they come up.” No written policies. No risk register.

    Your move

    Start with the free risk assessment. Surface the gaps. Use the findings to make the case for Stage 2.

  2. Stage 2

    Aware

    The MSP knows compliance is a gap but hasn’t formalized anything. May have one or two policies.

    What it looks like

    “We’ve been meaning to document our processes.” Sporadic security reviews. No repeatable delivery.

    Your move

    Build your first service package around one framework (HIPAA or NIST CSF). Deliver it to your NFR first.

  3. Stage 3

    Developing

    A formal security program exists. One or two frameworks supported. Compliance is a line item on the service agreement but not a dedicated practice.

    What it looks like

    “We include a security review in our QBR.” Not billed separately. Not growing.

    Your move

    Unbundle compliance from your managed services contract. Price it separately. Use the Packaging & Pricing Playbook.

  4. Stage 4

    Managed

    Compliance is a defined, recurring service line. Multiple frameworks supported. Dedicated tooling (Blacksmith). Clients receive regular reports.

    What it looks like

    “We have 8 clients on our compliance program. It’s $X/month each.” Recurring revenue. Some churn risk.

    Your move

    Focus on QBR quality and retention. Standardize your client communication. Start building the Advisory practice.

  5. Stage 5

    Optimized / Industry Leader

    Compliance is a competitive differentiator. The MSP is known in their market for compliance expertise. May offer fractional vCISO or advisory services.

    What it looks like

    “We turned down three projects this quarter because they weren’t compliance clients.” Speaking at industry events. Generating referrals from clients.

    Your move

    Publish content. Build the brand. Start training your team on the 9-Step Program.

Self-assessment

Not sure where you land? Ask yourself: do you have a written security program for your own MSP? If the answer is no, you’re Stage 1 — and that’s exactly where we start.

Next up Next: Client Conversations