Compliance: The Client’s Responsibility or Yours?

We have explored how to clarify responsibilities and accountabilities around compliance for MSPs and their clients, but disputes will still arise between providers and their clients when a crisis strikes. Today’s IT environments are becoming more complex, not less so. The cyber threat ecosystem continues to rapidly change. Organizations face an unending stream of criminal innovation from hackers and cybercriminals. Most cybersecurity professionals speak of “assuming breach,” meaning all organizations should presume they will at some point suffer a cybersecurity incident of some kind, regardless of their prudent investments in cybersecurity technologies and processes.

In this environment, even extremely well run and mature MSPs should presume that there will be cybersecurity incidents with clients, compliance violations of many kinds, and invariably legal disputes between parties. Therefore, MSPs should think proactively and take contractual and risk management measures to limit their liabilities. Let’s look at some of these steps.

First, an MSP’s managed services agreement is absolutely essential to limiting liability. MSPs should work with an outside legal counsel expert in the managed services space. The managed services agreement should clearly spell out the specific responsibilities of the MSP. The language should be crystal clear: with deliverables and contractually binding service level agreements (SLAs). As we have explored in this blog, in most cases MSPs cannot control client behavior or actions, nor the actions of external threat actors. If there are cybersecurity incidents, data loss events, or compliance violations, the client may ask for the MSP to step in to provide extra assistance, incident response, or remediation. These unanticipated and labour-intensive service needs should be covered by additional, fee-based services, not simply covered under the main agreement. Moreover, clear contractual language on scope and responsibilities will help the MSP greatly if a client files a breach of contract or breach of duty lawsuit when disaster strikes.

Next, MSPs should make sure they are adequately insured. Professional liability and Errors & Omissions (E&O) insurance is a must. MSPs should also carry their own Cyber Liability Insurance, which provides financial coverage and assistance if the MSP themself falls prey to a cyber-attack. Lastly, MSPs should encourage their clients to carry Cyber Liability Insurance as well; as it is the client’s responsibility to procure adequate coverage for their own organization. A huge benefit of Cyber Liability Insurance for clients is that it forces them to evaluate their cybersecurity posture and maturity and then make all the necessary improvements in technology, infrastructure, and processes needed to receive coverage. The interest of insurance carriers and MSPs are strongly aligned here; all parties benefit if clients are investing and raising the bar on cybersecurity.