How to sell security and compliance
As regulatory demands on UK organisations continue to ramp up, Managed Service Providers (MSPs) have a major opportunity to diversify their offerings and gain competitive advantages.
While addressing the legislative load on businesses has long been on the government's priority list, little progress has been made. Figures from the UK Regulatory Policy Committee show that regulatory costs rose by £7.8 billion during the 2017-2019 parliament, and a further £14.3 billion in the first three years of the 2019-2024 parliament.
Firms continue to feel the squeeze. According to PwC's Global Compliance Survey 2025, 85% of companies agree that compliance requirements have become more complex in the last three years. Further, 82% said that this rising complexity has negatively affected senior leadership focus, while 81% feel it has impacted their transformation and change activities.
Faced with substantial and growing compliance challenges, many businesses are turning to external experts and partners for support. So much so, that Gartner forecasts investment in governance, risk and compliance tools to increase by as much as 50% between 2023 and 2026.
Here lies the opportunity for MSPs. According to PwC's survey, cybersecurity, data protection and privacy are among the leading priorities for companies when it comes to compliance – specialisms that MSPs already have substantial knowledge and expertise in.
By adapting to capitalise on this and developing specific Compliance-as-a-Service (CaaS) solutions to complement their existing offerings, MSPs will be able to obtain a slice of this highly lucrative, fast-growing pie.
That will, however, require some careful consideration. Specifically, how can MSPs market and sell both security and compliance services in the most effective manner? Here, we outline four key considerations to address in order to make the most of CaaS opportunities.
#1 – Make logical, strategic refinements
First, MSPs should recognise that they may need to make refinements to their offerings to align more closely with their clients' evolving CaaS needs.
While many MSPs focus on delivering technologies and digital solutions, CaaS demands a greater emphasis on people and process. As regulations continue to evolve and expand, the right combination of continuous management, specialist support and reliable technology is vital in delivering results.
At the same time, any CaaS platform should be capable of integrating effectively with clients' existing technologies and systems. If major infrastructure or operational changes are required for a CaaS solution to work, MSPS won't be solving their clients' issues – they will simply be turning one problem into another.
Those platforms must also deliver transparent compliance insights, ideally via dashboards and reporting features. Prioritising the client user experience will satisfy client demands to monitor their compliance status and assess key changes in real-time.
#2 – Highlight the risks and costs associated with non-compliance
With the right strategy and solutions in place, companies can begin to take their CaaS offerings to market – a process which should focus on highlighting both the potential challenges associated with non-compliance, as well as the merits of achieving compliance.
Regarding the former, MSPs can highlight how non-compliance can lead to a range of issues spanning business disruption, declines in productivity, fees, penalties and other settlement costs.
Indeed, according to ISMS.online research, more UK companies are now being fined between £250,000 and £500,000 (26% today versus 21% in 2023), while many more are being fined between £100,000 and £250,000 (35% versus 18%).
#3 – Demonstrate the extensive advantages of achieving compliance
In terms of the merits of compliance, meanwhile, the focus can extend far beyond mitigating potential fines.
Interestingly, ISMS.online's research shows that only 19% of companies say their main motivation for compliance is to avoid penalties. Far more talk about remaining competitive (34%), increasing customer demand (34%) and protecting business (30%) and customer (29%) information. A sizeable share (27%) are also motivated by the prospect of entering new markets and supply chains.
In the same survey, some of the biggest ROI gains in investing in compliance programmes included enhancing business reputation (34%), direct cost savings from a reduced number of cybersecurity incidents (30%), time savings from more efficient security processes (29%) and greater appeal to investors looking for low risk companies (28%). A significant share also said they've streamlined security infrastructure to be easier and less costly to manage (28%), and that they've achieved ROI by improving the quality of business decisions (26%).
#4 – Emphasise that compliance requires continuous management
In addition to these potential risks and benefits, MSPs must emphasise that CaaS is not a 'set and forget' service. They must make it clear that compliance requires ongoing and continuous management.
Indeed, regulations will continue to be frequently updated to address new threats and challenges, requiring businesses to keep a pulse on key changes and adapt their compliance strategies accordingly. In addition, companies must conduct ongoing risk assessments to identify and address new vulnerabilities, demanding both CaaS and security strategies and/or solutions.
Clients must also be made aware of the importance of maintaining proper audit trails and documentation to demonstrate their compliance efforts. These will not only help to verify that requirements are being met but also provide necessary records in case of regulatory inspections or legal disputes.
For all these reasons and more, continuous management is imperative. Therefore, MSPs should focus on helping their clients understand that compliance requires proactive, ongoing efforts.
Achieve all this, and MSPs will be well placed to seize the rapidly growing CaaS opportunity, standing themselves in good stead to excel for years to come.
