Elevating and Differentiating Your MSP Through Compliance Frameworks

Hey everyone, thank you for joining us today. This is our first MSPs in Conversation for the year, so we're excited to be back. We had a bit of a late start of the year. Today we are joined by Jason, Daniel and Anthony to talk about elevating and differentiating your MSP through compliance frameworks. We had a little bit of this conversation earlier last year, I think, so this is kind of a continued conversation of where things have changed and whatnot as well. Really excited to have everyone here.

As a little bit of housekeeping, this is always recorded. We will send out the recording after this. Please feel free to share it. We cut this up into a podcast, it goes onto Vimeo, YouTube, etc. Share it around with your team, use it as a resource. If you've got team members that are learning about compliance, or if you've delegated that out to someone in your team, this will be a great resource for them. Any resources that we mention — books or anything like that during today's session — we will also include in the wrap-up email that we send around afterwards.

So, a little bit of an introduction to Hosted Network for those of you that don't know us already. Hosted Network is a wholesale cloud and TCO provider for MSPs. We were an MSP, right, so we understand the challenges. We are 100% wholesale. We will never compete with you. We work hand in hand with you to grow your business and we will never be your competition. As an organization we are 100% feedback-driven. Everything that we have built has been built off partner feedback, and today we support over 200-plus MSPs across Australia. Basically we built a business around that feedback. Our fundamental value is that we like to get done right, where we don't just listen to feedback, we actually get things done and we take responsibility for it. So let us know, feel free to reach out if you've got any questions. But we're not here to talk about us today. We are here to listen to our wonderful panelists.

So Jason, Daniel and Anthony, thank you for joining us today. It's a pleasure to have you guys here. Can I get you to do a quick introduction and where you guys maybe are at with your compliance journey? Jason, obviously that's going to be a funny one for you given your business, but go for it.

Yeah, well thanks for having us on. I'm Jason Maricchiolo. It's a long Italian surname, so some people just refer to me as the ISO guy, it's a little bit easier. But yeah, obviously managing director of this company ISO365, and our whole mantra is about helping MSPs and tech companies alike get certified to compliance frameworks, and in this case ISO 27001. So yeah, just a bit about me.

Awesome, thank you. Daniel?

My name is Daniel Church, I'm the managing director at DJC. DJC is a managed services provider that I started initially as a hobby back in '99, 25 years ago, and I went full-time in 2005. So we're headquartered in Melbourne, but like potentially many people on the call today, do have other offices and staff scattered all throughout Australia. We sort of recently went through the ISO journey with Jason, so yeah, here to talk about that today.

Fantastic, thanks for joining us. And Anthony?

Yeah, my name is Anthony Quaresima, another Italian name. I've been in the industry a long time, but we started up TechEnvy about two and a half years ago. We focus on clients that are more boutiquey, that care about compliance and care about, obviously, in specific industries that might be regulated. So that's where we focus our time on, working with more of a boutique experience sort of customer. We put in our ISO, so we're ISO 27001 and 9001 certified, and that's been about over a year now. It was one of the first things that I had on my checklist when we incorporated. So yeah, it doesn't matter how big or small you are, it's always a good focus to sort of start off with.

Fantastic. Well, thank you guys. I guess from a topic today, if anyone has any questions around the topic, feel free to drop them in the chat. We'll try and answer them as we go, and if we don't get to them, we'll try and follow you up — we'll get those answers to you after the session. But with that, I'll stop my sharing and let DJC — would you mind kicking us off with giving us a bit of an introduction to set the tone for us and run us through what compliance frameworks are and why they're important for MSPs?

What Compliance Frameworks Are and Why They Matter

Yeah, so look, compliance frameworks — there's a lot of them out there and everyone's following something different. A lot of the common ones that we hear about — the NIST framework, the CIS, the Essential Eight, ISO 27001 itself — so there's a whole bunch of them. I suppose there's always an underlying similarity between them all, and it's just about where your company or your MSP in this case wants to go and wants to align to. It helps you govern the technology that you're using, the information that you're protecting. In some cases these frameworks can be certified, and that would be, you know, ISO 27001 for instance, whereas some of the other ones are more of an alignment. They're very good at what they do, they keep the framework aligned, but it's when you need to go that extra step and kind of get that validation that certification can be on the cards as well.

Okay. So Anthony and Daniel, thinking about when you started the compliance journey, why was it important to your businesses? So Daniel, I'll start with you. How did it pop up onto your priority list, and why?

It's something that popped up — we were just having, as a leadership group, a conversation about not just the overall maturity of the business, but also looking at the direction that we wanted to go into. We sort of sat there and went, you know, if we looked at our client mix, we sort of had this — and today still have this — lopsided mix of a small number of larger clients and then a larger number of smaller clients. And we sort of said, look, if we want to target — it's hard to be all things to all people, right — so if we wanted to niche down a little bit, say how we want to play in that bigger end of town, we felt that certainly being certified in quality and security would position ourselves as one of the more mature players. So we sort of felt that it was definitely something that we needed to do, we needed to have on board in order to be able to go out and apply for tenders or to be able to go out and speak to those more enterprise-level customers.

Now, whether it's a real accolade to have on board, or for some of them it's a "don't even apply if you don't have this" — but either way, we sort of looked at it and went, I think we need to get this done, so let's just pull the trigger, so that we can go out there and head in that direction that we felt was right for our business.

And Anthony, you said a second ago that it sounds like you did it from the word go. What was the thinking around that?

So, not for many years, but back in my very early working career, I had a lot of exposure to compliance frameworks in a health setting. I was in IT in a health setting, and so I had a lot of exposure with document management systems, making sure that certain compliances are met and frameworks are followed. It's something that always semi-interested me. I know it sounds a bit boring, but when we incorporated, when you go to market, it's okay, well, we're going to be an MSP, we're going to target a certain client base and those sort of things. Your net's a lot wider if you're ISO certified, because you can gain business from tenders, from small MSP contracts, from large MSP contracts — you don't really hit a roadblock. So long as you've got a team that's qualified and you've got all your insurances and everything like that covered, and you're ISO certified, you can go for big government contracts, you can go for whatever you want, if you want to focus putting the time into doing those projects.

So for us initially it was to cast the net really wide, so we've got the choice of what opportunities we want to take on board, so that way they would just fall and we would decide if we want to get them or not. And second was that change among engineers is super, super hard. The bigger your company grows, the more friction you have for change. You have an engineer that's been there 10, 15 years and it's the guy that you can't tell anything to, or you can't control him, because he's one of those silos, leaning to the side. Influencing change and making change in a large-scale setting is very difficult, especially with compliance frameworks, saying okay, now you have to do things a certain way, you can't just be full admin access across everything on your day-to-day account — maybe those little things that happen. So it was something that I didn't want to have a conversation with people and fight that change on my journey. It was something that when you put it in, it would be something that was ingrained in the company culture and we'll just grow with it.

Okay, so interesting approach, and you're right about change. I think we've all had techs out there, or other roles, that you struggle with — techs are particularly hard to change. I know I've had, "well no, we don't change this." But from an operational maturity view — and Daniel, I'll throw this to you — did you find that, if Anthony's business started there at the ground up, did you find that it helped your organization mature? Did it help those more troubling team members that were more rigid?

Yeah, look, I think it's probably fair to say, because you have a story. So it's not just, "hey, we've decided that you can't have this, we're taking this away, you're a cowboy." It takes all of that away to sit there and say, we've been around a while and this is the area that we need to play in, and we really need to get our house in order, and if we get our house in order then we can go and do these things. That way you've got something for your team to buy into, to say, all right, I've got it, I know why we're doing it, and I'm going to go along for the journey.

And it does create an opportunity for that good cop, bad cop — it's not my fault that we can't do this anymore, it's Jason's fault, or it's ISO's fault, or someone else's fault. They're the bad cop, I'm the good one, I'm sorry about that. But yeah, I think it's really important, because if there's a reason, it's part of the journey, it's going to help us get to a destination, and it's part of a framework. We can't just cherry-pick which bits of this we do or don't want. We're adopting 100% of this, we have to do it a particular way, and your involvement and acceptance of this is not optional. And this is not "hey, let's just get the certificate and then all of a sudden it doesn't matter anymore." No, no, no — this is how we do things, and you will be checked on it, and we have to constantly recertify, and it's going to be ingrained into the business.

So I think that genuinely helps, because then people have something to buy into. There's a story, fair enough, it makes sense, it's not just some weird thing that Daniel came up with over the weekend or whatever else. And I think you'll find that most people will genuinely buy into that. But for my team members on the call, this is why we don't have "Ben specials" anymore, or as they like to call it, a bit of "BS." But anyway.

So Jason, from your perspective, you've obviously come from MSP land as well, and from what I know of your business, you've actually started by doing compliance within those MSPs, right? For the MSPs you deal with, is the story the same for everyone that you know of?

Yeah, it is very similar. What we do see is that even some MSPs that are, by their own admission, quite advanced — by the time we get in there and we do a gap analysis for instance, we always still, at a minimum, find 10 to 13 things that can continue to mature that business, right, even the best ones. So it definitely helps to increase everyone's posture. There's always gaps that you're not thinking about, because sometimes they're thinking about the tech side, and the tech side is good, but the people side or the organizational side hasn't been thought about to the extent that it needs to. And so you do have the opportunity, by putting in a framework, to actually assess the whole business and look at it holistically. And then, like I said, we always find something, and those 10 or so things that we generally find, they go a long way to securing those MSPs as well.

The ISO 27001 Certification Process

So I guess, two questions. What does the process look like from a high-level perspective, and where do most people start in your opinion?

Look, so I'll talk specifically about an ISO 27001 certification process, because this seems to be something that a lot of MSPs are scared to kind of dive too far into. From the ones that I speak to, they want to start really small, and one day, in a couple of years' time for instance, they'll look at ISO 27001. But to look at it from a high-level perspective, you need to do your implementation. The implementation is about actually meeting the requirements of the standard, and you can do that yourself or you can do that with a consultant. Regardless of what you do, you need to implement an information security management system, or an ISMS as it's called.

A lot of the time, once you've built your system and you think, yep, I'm ready to go, I want to have this looked at, you need to go through a stage one audit. That stage one audit is done by an external certification body that you choose, and they'll come in and have a look at all of your documentation. So they're not looking at your systems, and they're not going to want you to screen share or send evidence of anything at that point. They just want to make sure that you have a fundamental understanding of the framework.

Then once you pass that, you go to what they call a stage two audit, and that is your evidence-based audit. So if you say you're doing something over here in your mobile device policy or your acceptable use policy, they'll want to see that you're actually doing that in that audit, and they'll write you up an audit report and all of that. Then once you finish that, if you're successful, you'll be recommended for certification, and that's where you get your certificate. That's usually where everybody jumps around and celebrates, and then kind of goes off and does something else for the next six to eight months.

Unfortunately what does happen — and this is to keep the integrity of the framework — every 12 months auditors will come back and they'll do a surveillance audit. So you will go through that stage two audit, if you like it's just a cut-down version, and they make sure that you are continuing to do what you say that you're doing. And that's where a lot of people tend to come unstuck, if they put it in for the wrong reasons, right. So that's a very high-level overview of what an implementation and certification process would look like.

Okay, cool. And I guess, we've touched on Anthony's and Daniel's changes — well, I guess Daniel's changes — but what is the common change that you see amongst MSPs that you've engaged with? Is there a trigger point that most of them should be aware of?

Yeah, so if you're talking about those gaps that we tend to find, I'll talk about the two biggest ones. They tend to be not so much a sticking point, but it's more work versus less work. MSPs that don't have any form of application control — that's actually quite a big thing. So whether they're doing that by software, or by a platform, or any other way, application control is a pretty big one. And the next one, funnily enough — I think Daniel said it earlier on — is around the local admin access, or privileged privileges, that our techs are used to having. So if you're running an MSP where it's kind of, as I like to call it, the old way, that can be something that you need to talk to your team about, to actually be able to rein that back in, because that is a gap or a risk that we generally find is quite a hard one to overcome. Sometimes change is always good with techs in general, right, as we've said.

Cool, okay. So we touched a little bit on the high-level process — and if anyone's got any questions in the chat, feel free to drop it through and we can try and answer them as we go. But I wanted to jump into — we've covered a little bit of the beginning stages of it, the what and the why — what are some of the improvements? We've talked about operational maturity. What are some of the other improvements that you, Daniel and Anthony, saw across your business? And Jason, feel free to chime in from what you've seen in other organizations as well. But Anthony, I know that you've run or worked a senior role in a previous MSP before starting your own. What did you see in that sense as well?

So, the framework of ISO is good because it's basically also focused around risk management and continuous improvement — the two main areas. Continuous improvement is one that in my whole working career I always sometimes see a little bit hard to manage. A lot of people come up with really good ideas in the business, and they always have good ideas, and then what do you do with those ideas, where do you put them, and how do you action them? So sometimes, if a junior person comes up with an idea, you might remember it at the next meeting and might put it on a list to do at some point, or you might say, oh, you just email, and then you forget that kind of stuff.

If we have a continuous improvement register where people can submit ideas, where they can submit why it's important, those kind of things — we have a fixed meeting that we attend where we talk about continuous improvement ideas, and they get rated high, medium, low, and they get prioritized, and the whole stack then gets put into different deadlines and timelines. And some things might not be a good idea, so they don't have to live there forever — you say, okay, well that idea cannot proceed. It doesn't mean you have to do everything, but it means it's a central spot to capture all those items and process those, which is great.

And being a small business as well, especially initially, you do have a lot of risks. Things like, you're starting off a business and you think, okay, well I forgot to do this and I forgot to do that — a risk register is great to throw all these things on there, because you've only got a limited amount of horsepower, especially when you're starting off. We don't have that problem now, but we did initially. So having a central spot to put all our risks in and say, let's target these top three in the next couple of weeks, and then you start chipping away those things — your company's improving and being de-risked. So that fits any business model from five staff to 500 staff. Everyone wants to get better and at a lower risk rate.

Daniel, anything to add?

Yeah, I think there's probably a couple of aspects. Some of it was just about — I think I mentioned it earlier — getting our house in order. And it's just little things, you sit there and go, yeah, well, like tracking people who come in and out of your physical office. It's like, we should have had that but we didn't. Because at some point in time you go from — before you know it it's just you and a couple of techs that you're working closely with, but before you know it it's become much bigger and there's multiple offices. It should have been a point in time where you actually went, that's a fair point, we've got customer systems in here, we've got customer laptops, it's got customer data on it. So physical control of your premises, surveillance, stock room — just getting your house in order. And it's probably, as I said, in hindsight you go, we should have done that, but to be forced to look back and go, yep, let's get our house in order, I think is a really nice thing.

I also like that everyone knows where to go. I remember when it was part of the team being trained — not everyone would always know 100% of everything they needed to know, but they knew where to go to find the information. This SharePoint hub was built, and it's like, well, I know I could just go there, and if I go there and start looking I'm going to find what I'm looking for. So at least everyone knew that, and no one was tripped up on needing to know 100% of everything. It's like, as long as I know where to go to find the information, or where to submit those risks that Anthony was talking about before, then at least no one's going to feel like they're completely left out of the loop.

The other thing I've seen, and I like this, it came up in a conversation just last week. It was a tech conversation about changing the structured way that we were going to be deploying conditional access, it was something along those lines. And interestingly enough, part of that conversation, straight away someone went, well actually, if we do it that way, that interferes with ISO, because ISO talks — I think it was something to do with break-glass accounts and those sorts of things — and talks about, well hang on, we need to be looking at dormant admin accounts. And what I like is that it wasn't, we went off and did something, and then like Jason said, later on someone comes back and does an audit and goes, oh hang on, you guys have gone and done these things here, you've undone the good work. It's now ingrained in, and people are thinking about, if we change the way we do something to try and make it better, what impact does that have on ISO, how can we do so in a way where we remain compliant, so that we don't do what DJC — what Jason mentioned just before — head off on a tangent that's only going to be twice as much work to rectify down the track. So it's nice to hear that people at all levels are really thinking about it in day-to-day business decisions.

Yeah, my CEO Luke, he calls it the guardrails, like when you're going bowling, to make sure that — people think bumpers, that's it — kind of getting them, if they are going to think that, they know how far they can go before they need to sort of get steered back. Yeah, it's a challenge, but I like that about the thinking part as well, right, because it does encourage that, especially when your business is growing. You want your team members to start being a bit more self-sufficient, it gives them a little bit more autonomy.

Compliance as a Driver of New Business Growth

Cool, okay. So let's move a little bit on to new business growth, right. You've both mentioned verticals, niche, government, those sort of works. Did you find that it helped you attract new business, and was the client that you were attracting — if it did — was it the same, was it different?

Yeah, so yes, we've done quite a few, taken over some clients on an MSP engagement and also project engagement that has used it. So one big one that's always talked about — it's not super highly regulated just yet, but there's like private finance. People are holding a lot of usable, identifiable information. So there are a lot of stuff on record, there are a lot of access controls in place that aren't fully regulated in certain industries, but they want their IT company to be regulated. So for example, in those clients we get involved — we understand what the insurance companies are going to ask on their questionnaire to charge them a premium, because those insurance policies that they usually ask a big questionnaire about are directly mapped back to controls and things like ISO and frameworks.

So when you are filling out insurance paperwork and you're saying, yeah, we've got these controls in place, we don't have these controls in place, we know what's going to affect the premium and what's going to affect coverage. Is there security awareness training in place? Do people have certain documentation about changing bank account numbers? When someone sends an email through and says, "my bank account's updated," has it had a second verification? We know that insurance policies won't cover you for social engineering — it's excluded if you don't have those sort of things. So these are the things that you get to learn as part of that framework: how it maps back to insurance, how it maps back to actual physical companies and how they use it within their companies, not just for ourselves. And then obviously the clients feel at ease that we're obviously certified — that's an important one.

We have another company that's been mandated that they must become certified. So we have a client that we won because they have to be certified by a certain date, otherwise they lose their funding — that's it, say their normal funding. And so for them it was a scramble to the market, and their current IT company isn't certified, so they don't have the skills to lead them through the journey of becoming certified and aligning all the systems and engaging with all these extra additional controls that are required outside ISO. But if you already have a lot of experience in one framework, you're certified in the one framework, you know how the frameworks work, so you can pick up another framework, grab some items, dou — you know how to navigate those things. But you have to have gone through that journey yourself, otherwise you really don't know, you really don't know until you get into the nuts and bolts of it anyway.

I was actually talking to a customer the other day — they had an electrical contracting client, it's an MSP, and they were being forced because they dealt with particular government installations. And they were like, cool, you're dealing with government even though you're doing our Sparky work, yep, you now have to comply.

We have one that requires four certifications, like four frameworks, and obviously to support them we have to know exactly what's going on. So it's the same sort of thing — these things are being pushed out across the industry. It's not just like, oh, I want to be certified because I want to do a good quality job or be more secure. It's like, there's people looking at their supply chains and mandating this in a lot of places. People are losing business because of this.

We're certainly seeing — think back over the last few years — it might have been something where, for new business, it might have been something that was an extreme at one point in time, where you sat there and went, oh gee, they're asking for that, do they need that? Over time we've seen it creep in more and more and more. And I'm also seeing it come down the chain a little bit. So where it might have been something very much in the enterprise space they were asking it, you'd say, well that makes a lot of sense, but I'm seeing it come down where smaller businesses are now making it an expectation. Whether they have a compliance reason, like Anthony was talking about before, where they're required to have it, or whether someone's just decided to make it an inclusion to maybe weed out some of the less mature businesses, I don't know. But certainly the frequency of it being a requirement in order to be able to speak to someone about being one of the respondents for a request for price, or to be able to submit a tender — we're seeing it more and more and more these days, and I would expect that to continue certainly over the next few years.

Yeah, I think that's a given with everything that we see in the news and everything else. Jason, from the industries, is there any specific industries that you're seeing more heavily regulated, or heavy regulation around?

Yeah, like I mean, like Daniel kind of said before, 10 years ago, maybe eight years ago, you could say that this was a very, very high bar to reach, and it was only the top end of town for instance that were really getting it. You could get by by saying, no, we're not certified, or we're aligned, and everyone kind of not so much turned a blind eye, but it wasn't as regulated as it is right now. And so from what we're seeing, besides MSPs themselves being asked by insurance providers, even their existing clients are asking — the pressure is pushing up into the MSP, saying, hey, we absolutely love you, but we can't continue to work with you unless you guys do something about this. This is a real story.

And so our primary focus obviously is on MSPs. It's what we call the defensive ROI. So we just spoke about growth and new opportunities — that will come, right, there's no doubt that that will come. But we talk about the defensive ROI, which is keeping your existing client base happy, saving that MRR, making sure that that doesn't disappear because they've gone from you to someone else, even though they love you, but they just actually can't continue to work with you.

Outside of the industry, the managed services space, I see a lot of financial or wealth management — they tend to be the next ones that are coming through the ranks. And a lot of the MSPs have clients that are in finance and wealth management, and so it's almost a chicken-before-the-egg situation, where some of their clients are getting themselves prepared, but then the MSP is behind the eight-ball, because they don't know what to expect because they haven't gone through this themselves. Whereas the ones that have gone through it, they're having awesome conversations with their client base around, hey, yep, we've been through this, we know exactly what it's going to look like, rest assured we're going to help you on the way through.

So yeah, look, any industry that is dealing with a lot of PII, personally identifiable information — any one of those, if you're holding on to that kind of info, I would say to expect that you're going to need to get certified, or at least look at it, in the next 12 months, because I can just see it's going to become the ticket to play in some of these spaces.

Yeah, interesting. I wonder if, as IT guys and girls on the line, looking at that risk profile of their existing customers and actually starting to ask that question. Anthony, you touched on the whole having better business conversations — all of a sudden we're talking about it, but now we're starting to talk about insurance premiums, and everything that we're doing is reflecting that. So understanding where your client is going sort of helps build that business case internally as well for you, to really think about what Jason's talking about, which is retention, right — looking at how you can retain that existing revenue so you don't necessarily have to go and replace it with something new.

Using Compliance to Retain Clients and Show Value

With that in mind, that retention piece of it, Daniel, I'll start with you. How have you guys used your compliance piece to show more value to your clients, to help with that retention?

Definitely a very proud moment when we received that certification. And as you know, really a lot of effort — it's not just, you pay a bill, you tick the box, and you copy some data from somewhere and you set up a form and you're all good. There was a lot of effort put in by the team, so it was certainly very proud and felt like a real achievement to have that. So quite quickly the signature template was updated — "ISO certified," I think it was the first thing we did.

And I kid you not, whether it was that that spurred this on or not, I don't know, but literally one of our largest customers — there had been a change of management, so there was a different CEO, there was a different IT contact working directly with that CEO — and we had an email from them, it was the same day, that was like, please provide us with copies of your ISO certification certificate. Now, as I said, whether they saw it and thought, let's make sure they've genuinely got it, or whether they just expected that we had it and we just snuck that through — doesn't matter, because the upside was that we were able to respond straight away and go, there you go, here it is. So that felt really good, it felt really good for someone to say, I'd like you to confirm that your house is in order, and for us to go, here's a certificate that says just that.

The other thing that we've noticed is some of our customers are thinking about going on that journey as well. So therefore they'll sit there, they see it in the signature, and they go, oh, so you guys have done that, talk to us, what was that like, what's the investment like, which route did you go? Because some people hire in part-time bodies to help them do it all, some people engage businesses like ISO365. So they're asking that, and of course the upside to that is that you are having a stakeholder-to-stakeholder, mature, strategic business discussion, and they're asking your input on that. And that's a nice dynamic — it demonstrates that your businesses are in similar places, and maybe in this particular instance you just happened to be one step ahead of them.

And I would imagine that that would lead to — that one time where, I don't know, a tech dropped the ball, or didn't get the ticket fast enough, or they closed it too quickly, or whatever, and there was that little niggle there — it becomes irrelevant in the big scheme of things, where they go, yeah, but I feel like these guys are on top of their game, they're doing similar things that we think we need to be doing, we're having these mature strategic conversations, we're not talking about just how we can keep the lights on. And I think that that solidifies in their mind that they're dealing with ultimately a good operator. And I think that's important. But I like that it has sparked the customers saying, we were thinking about this, or we're about to do it, can you talk to us about what that journey is like. I think that's a really nice position to be in, being that thought leader as well, providing that extra value.

Anthony, what about you guys — is there anything that you do that's part of your secret sauce that you're okay sharing, around how you do it?

Yeah, we try and run everything highly standardized — or we do run everything highly standardized as much as we can. So our product — we go to market with an MSP product like all the other MSPs, okay — our MSP product is turnkey 27001. So as an example, if you're a customer and you come on board, the only thing you're missing is documentation and the user training, like users doing the thing that they're saying to do. You don't need any more technology, you don't need any more projects. Your standard project to come on board will get you the framework, the technical controls and everything around the technical side that's required, plus all the things like security awareness training and all those other fundamental items that are needed.

So for us it's pretty awesome, because when clients get requests such as, they're going for a tender and they'll say, oh, we don't really know, we don't have to be certified but we need to submit an information security policy as part of our tender, what is that? Okay, bang, straight away — we've got experience in it, but we've got our own on file, so we can say, okay, well it needs to have, what's your data retention, how do you back stuff up, how is it handled within your business, how is it controlled, those sort of items. So having a framework that you've worked to create in your business and use, and then second, you've got all your documents on file, where you can say, okay, I can write one for you fairly quickly in the next couple of hours, so you can submit it for your tender.

And we also know, because they're already aligned — their technology piece is aligned to 27001 — they're not going to have things like, oh, you don't have these eight things. When they do get asked a question about certain controls, they might not need to be certified, but they might need to have certain pieces, and we know they're not going to get caught up with, oh, we don't do all this stuff for you guys, and then suddenly it's a stress that they can't go for a tender, they have to spend money into a project. So it helps accelerate those sort of things, which clients then sometimes get really impressed by, because they don't realize that they've got a lot of these things in place. You have conversations with people, but compliance isn't exactly always front of mind or an exciting topic, so when the client goes, I'm going for this tender, I don't know if we have the stuff, then bang, you've got everything for them, you've got all the questions answered, and they're like, you guys are amazing, now we can go for this tender that we didn't think we could go for, or it's going to be a lot easier than we thought. So they're the things that we've experienced that have been a good moment, where you feel like we've got our stuff sorted.

You get to make them look like the hero, right?

Yeah, exactly, and that's what it's all about.

So, Ben, there's one more thing I want to add to that as well, because we talk about the clients asking and satisfying client requirements and all of that, the one piece that no one really thinks about is our staff as well.

Everyone's beaten me to the next question — Anthony's beaten me to it.

Okay, I'll let you ask it, if you let me answer it.

All I was going to say was, we've all got talent, and we've all got techs and people that we can't afford to lose, and we know how hard it is to recruit. Keeping your team satisfied and keeping your team interested and keeping them aligned with where the business is going — we see a lot of the engineering and a lot of the tech side really excited when leadership goes all in and says, hey guys, we're actually going to do this right, we're committed, we're going to throw some resourcing at it, and we're going to get this done. It really helps on the tech side as well, and it keeps your people happy, because they want to work for the best, they don't want to just be getting by. So for me it's really important not only to retain clients but also to retain staff as well.

So, adding to that — one of our most popular MSPs in Conversation sessions that we've done is actually on how to build a great team, right. We've actually done two different sessions on it, and one of the big things with hiring staff is their onboarding experience, just like onboarding a new client. When you bring a staff member on board — and that's something that we've found has helped improve that piece of it — so that they're coming into our organization and we're looking like we know what we're talking about, kind of thing, right. We're able to provide that structure and whatnot, and I find that that's really helped us and our business as well, and that leads to that retention of staff. So if anyone wants to check that section out, check out our event section on our website, it's a recording on there as well.

How Small MSPs Can Start and Manage the Cost

We've got a question from Lyndon. Are the clients that we're talking about typically larger organizations, or are you finding that smaller service providers need to have this for supply to government or even any business? Anthony, want to take that one?

Yeah, mine. So we've had — it's a very small amount of ones that sort of have these conversations — they might be at that, say, 15-seat mark, and that's, again, around financial services, legal maybe, and those law firms, small law firms, people that do wealth management, those kind of things. You might be looking at the 15 seats, but on average you might have other companies all fall between the 25, 30 and up. So we don't look after humongous 5,000-seat enterprises, those sort of things, but yeah, like 30 and up, because at that stage they've got a team.

And depending on who they go for — like, I think, Ben, you mentioned it before, electrical, specifically electrical — we work with actually a handful of them, and the deals that they work on do require them to be certified. And those electrical places aren't going to be huge, they might be 30 seats or something else like that, but they need to have all this in order to be able to deliver these projects. So it's not really just that — the company could be five users if they handle valuable data and they're going for government stuff, they'll need this. So it depends on how mature the client is and what services they're providing, or saying they provide.

Al, add to that supply there, sorry — I think I saw Al respond, go Al, "get relevant"? I say absolutely 100%, because it's not just the hundreds and hundreds and hundreds of seat enterprises, it's — now we're seeing a lot of those questions coming in sort of, could be the 35 to 60 sort of range. I haven't seen it, but you can understand what Anthony is saying — it might be a smaller organization, but there's a requirement there. So it is 100% coming down in the size of the organizations, and I suspect it would continue to do so. So therefore absolutely relevant for an MSP to remain relevant moving forward.

Yeah, I think I'd back it all up as well with just one sentence that I've been saying: size doesn't matter anymore when it comes to this. And we're talking about Sparkies a lot, and electrical contractors on this call. I mean, for the longest time, or forever, they've needed to comply with the AS3000, right, the wiring rules. None of us would hire an electrician, even if they were a solo operator, one-A-grade electrician, if they weren't doing their installations to the AS3000. And I know it's a safety thing with that, and also you want to make sure that everything's going to work. But in our industry, in the MSP space, this is going to come, because when we're talking about PII and information — okay, it might not be life and death, but it's definitely financial ruin. So size definitely doesn't matter anymore. I think we've gone through the last 10 years of it being a size discussion, but for me now it's definitely the path forward.

Okay, so I think one of the things that we're talking about here is that supply chain piece of it, right. MSPs are part of the supply chain, and if we think of that electrical contractor — the way that we've often thought about it, or the government's telling this organization or that particular piece of it, that flows down, right. So we just had a comment here from Aaron — if you're dealing with not-for-profits, they're going to have compliance regulations, and those compliance rules are going to say that the people that you deal with also have to be — that supply chain also has to be compliant. So have a think about those clients from a risk perspective as well. That might also build a bit more of a business case internally that you can not only retain, but potentially use that as a launch point to actually drive greater revenue from some of those accounts as well. It's a really good conversation to be having with those accounts if you're running things like QBRs and things like that as well.

In terms of the smaller guys though, what are some of the things that we can do to manage the cost and the resourcing of compliance? Daniel, you touched on that it's a big project. But Jason, what does that look like — are there things that we can do to lessen the burden?

Yeah, so it kind of goes back to what Anthony was saying earlier on about doing it when you're smaller. In some cases that can have a lot of benefits, right. One being that your environment might not be super complex, or as complex as it would be if you had 30 or 40 or 50 staff. Now obviously we can't go back in time and do these things when we've only incorporated the company, which is fine, right, but it's just important to start somewhere.

You don't need to go and jump into certification straight away. You can speak to people in the industry that have been through it, find out what their biggest gaps were, and see if you also have those same gaps. I speak to vastly different sized companies, MSPs specifically, and a lot of the smaller ones actually have more stringent controls — maybe because they spun up sooner, maybe because they've had more time because they're smaller. But some of the smaller ones are actually ready to go through their certification process, and then you've got others that have been around for a lot longer but just have not had the time, or spent the time, focusing on increasing their security in some of those aspects, and so they're actually further away. So all I would say is, if you want to have a look, you've got to do a gap analysis, you've got to figure out where you are realistically in the scheme of things, because there's a lot of smaller companies that are there or thereabouts, and they just don't know it. They're scared of the process, it gets pushed to the back of the mind, right.

But I like that comment that I actually wrote this down — that small is often less complex, right. So not only that, but if you don't have that process in place, well, your team aren't having to change, you're not having to fight that change process like we touched on earlier. So that's definitely something to think about.

Alignment vs. Certification and Choosing a Certification Body

I've got a question here, and I've heard of this before as well — that you can be ISO aligned, to the ISO standards, but not compliant. Is that a thing?

Yeah, it is, it's definitely a thing. The boys might have some different things to add to this, but from my perspective, anyone that says they're aligned, I always do question whether or not it's a self-assessed alignment, because at the end of the day, no one is actually coming in and assessing this thing to provide you a certificate. The difference between an alignment and a certification is to actually just pay the external auditors to come in for a couple of days, verify your alignment, and actually certify this thing. So for me, alignment is okay, well, if you're telling the truth, go that next 5% and just get the bloody thing done, so you've got your certificate and you can have all of these benefits afterwards. Otherwise, is your alignment just you trying to dodge a question, potentially? And I've seen that in the past — probably a discussion for another time.

But what I'll also quickly say is that there are different certification bodies out there. You need to appear on the JAS-ANZ register — for anyone that thought I said "jazz hands," I didn't, it's JAS-ANZ, J-A-N-Z, it's the Joint Accreditation System of Australia and New Zealand. That is the register that your clients can actually Google your company name and see you on a register for your certification. If you have gone overseas and potentially paid someone a really small amount of money for your certification, you will not appear on that register. So just a bit of a — be careful when you're going through this process.

Daniel, you mentioned that client of yours that wanted that information — was that part of that?

Look, I think that was just sheer luck, you know. And I just think that that's probably been a great thing from a retention perspective.

Just coming back to the resourcing — Jason mentioned it before, one thing I thought I would share — there was a point in time where we said, yes, we're going to do this, but we can't start it till September. I remember it was something that we were discussing with Jason. We wanted to commit to him, we wanted to be on the list and we wanted to be in the queue, but we looked at the workload of the commitments that we had — I think it was a range of some internal stuff we had going on, some professional services engagements that we had. So it is important, I think Jason mentioned, you need to resource it appropriately. There is work to do. You've got three businesses on the line here — oh, Jason, probably you is certified as well — so clearly it's not impossible to do, but it's not just tick a box and it's done. There certainly is some work to do there. So the buy-in from the business, making sure it's resourced appropriately, whether that is leaning on contractors where appropriate, or alternatively looking for quieter times of the year, or not queuing up so many projects or whatever else to be able to have the resources available — I think that's really, really important.

And just coming back to what you were saying before about the self — I don't know that, that feels like "part pregnant." That's like me saying, you know, I only eat salads and I don't drink alcohol — like, yeah, that was yesterday, but that doesn't mean today or tomorrow we're going to be anything like that. So I sort of feel like, if you've genuinely done the work, surely you would want the proof that you've done that. So I think it's noble to say, hey, you've done the work, then great, you're going to pass with flying colors, but given that it is likely to be a requirement, it's probably going to get to the point where at some point in time everyone's going to expect you to have this in order for you to be relevant. I think I'd be going the whole hog, getting it done properly.

I definitely think that if you've already gone through all that time and commitment, then to get certified, you'll get benefits out of it. You only have to win a couple of customers to cover all the costs, so it might look like a big investment, but when you work out how much monthly recurring revenue or a project you need to actually pay for it, it's very, very low. So it's an easy way to pay it back.

But there are fundamental things where you might not be ready to take on your journey straight away, and it might be something you want to park for six months. Definitely adopting some things out of the ISO in regards to — like I was saying earlier, continuous improvement, risk registers or whatever — starting somewhere and adopting a few things and getting in a habit of doing those things can still be beneficial without having to implement the entire framework on day one. And then you might think, well, I don't have time now, I'll do it in six months, like Daniel was saying, we're really flat out, we can't start till the end of the year. But you know what, let's ensure that everyone's getting at least user awareness training, security awareness training is deployed in our network, let's make sure that our devices are encrypted — just maybe some high-level things that your tech team can chip away at, so that way you don't have to go through the whole thing at the start. It just makes your life easier, because these tasks are going to come up. So maybe pick the top five, 10% of things that will benefit your business, carry those out now, and then obviously then look towards getting traction on getting formalized. So I definitely think that getting certified once you've gone that far is 100% the way to go, but if you're not ready to start your journey, start somewhere, don't just park the entire thing.

I think you can definitely chip away at it, right. I know that when we went through ours, we did put it off for a long time, and it just so happened that we had chipped away at that. But I was talking to someone earlier today — I actually mentioned that I was running this webinar on a phone call, and they were going through it, and it's sometimes little things. It's like, they turn around and say, oh yeah, we actually don't lock the front door of our office when it's staffed, but then someone can walk in. So it's like those little things, they're not huge — they just lock the front door, it's a little kind of improvement, all of a sudden you're ticking one of the pieces of it, right. So it is a journey, it doesn't have to be done overnight. But I definitely think that everyone should consider that retention piece of it as well. Winning clients is one thing, but losing clients, that can often hurt even more.

Closing Thoughts: Document Management and Final Takeaways

Guys, we've got four minutes left. Any closing comments that you'd like to — wisdom that you'd like to impart, light bulb moments that you want to share with the audience?

Just a quick one that I had. So Jason talked about it before, he used a reference, ISMS, or IMS — it's basically a central document management system where everything's categorized to find your information. ISO forces you to have a compliant, really good ISMS that has your version controls and document management. That's huge in a company, because it doesn't just store your ISO documents, but it will store everything else in your business that you need for anti-bribery documents, or you might have a notifiable data breach document, or even you can have a separate section for techs, for all their standards about deployments and things like that. So it's a central spot where everyone knows where to find documents, they're laid out perfectly. And I think for me personally, over my journey of my working career, finding information internally has always been a challenge, and having a central spot where everything's searchable, categorized, neat — and it might not just be directly ISO, but about the running of your business — is super quick for anyone to get on board and look up the information themselves and say, I didn't know it was there. They did, because they've gone in there and searched, search terms popped up. So that's probably been my biggest one that I've seen as a change, obviously moving into that.

Yeah, fantastic. Daniel, any final comments?

I probably just want to reiterate what Anthony said before, because in fact we actually did — when I said, oh, we weren't quite ready yet, I think Jake, my GM, who spearheaded all of this, had spoken to Jason — it was just that we had documentation, there was some over here, and there was some over here, and there was some over here, and it was like, we can't have that. So it was literally one of the things that the prep work was to go to a central document management solution. So jumping ahead and getting ahead of that was definitely a good thing to do.

And I guess I just want to take the opportunity to say that, as a business owner and as a managing director, I'm fortunate enough that I wasn't heavily involved in the process, and I just want to say that that's actually testament to Jason and his team that have turned it into this quite systematic process to be able to do that. No one from my team was coming and saying, you know, these guys don't know what they're talking about, it feels like the first time that they've done it. They just went, you know, they set us up for success. So yeah, we have to do all the work, in conjunction with these guys, but it's certainly been refined down into a pretty well-oiled machine. So I know there's a number of different ways that people, if it is the ISO route that you want to go, there's a number of different ways that you can do it, but I'd just like to throw it out there that the route that we went felt — well, I'll say relatively painless.

Yeah, I'll second that. And I should have put a disclaimer at the beginning of this, that we're all actually ISO customers. But that's what we've all learned along the journey, right. All three of our businesses — it was very streamlined due to what Jason and his team actually did. So shout out to you Jason, and the boys at ISO, and thank you everyone for sharing today your journey and whatnot. Hopefully for the guys and girls on the line, there's been a few light bulb moments along the way.

We are at time, but we do have — just pop my screen up here. So our next — if everyone can see that — no, I don't think you can, probably the wrong thing. You could — oh okay, you've got multiple monitors, everyone knows it's like, oh sugar, what am I actually sharing — there we go. So we've got our next one coming up on the 18th of June: Winning Strategies, Navigating Vertical Markets for MSP Success. So really excited about that one. There'll be repeat topics of what we've actually talked about today, and how ISO can actually leverage some of those verticals as well.

But guys, a big thank you for joining us today. I've certainly taken three pages of notes, so I appreciate you joining us today, and I'm sure everyone does on the line as well. So thank you very, very much. And to our audience, thank you again for joining us as well, and enjoy the rest of your day.

Thanks Ben. Thanks guys.