Getting a client base ready, not one client at a time

Cyber Essentials for MSPs › Getting a client base ready

The usual pattern is reactive. A client is asked for Cyber Essentials, you scramble, you discover their estate has four problems, you fix them, you get the certificate, and eight weeks later a different client is asked for Cyber Essentials and you discover their estate has the same four problems.

After the third or fourth time it becomes obvious that the work is not client-specific. Roughly eighty per cent of what stops a small organisation passing is the same eighty per cent every time, and it is a function of how the estate was built rather than what the business does.

Which means it can be solved once, at the tenancy template level, and then rolled.

The failure points that repeat

Start from what actually causes trouble rather than from the five controls, because the controls are the framework and these are the findings.

Recurring blockers across a typical MSP client base

Blocker	Why it recurs	Standardise as
Standing local administrator rights	Granted during a migration and never withdrawn, or granted to stop a ticket recurring	Separate administrative accounts, no day-to-day account with local admin, a documented elevation route
Multi-factor authentication on some cloud services	Enabled on Microsoft 365 and forgotten everywhere else, or enforced with legacy exclusions still live	A conditional access baseline applied per tenant, with an exclusion register reviewed quarterly
Unmanaged and personally owned devices	Directors, contractors and sales staff who were never enrolled	A single enrolment position per client, written down, with a named exception process
Software updating within fourteen days	Operating system patching is managed, third-party applications and browsers are not	Update rings covering the operating system, browsers and the common third-party applications, with reporting
Unsupported operating systems or applications	One machine, usually attached to a specific piece of business software	An end-of-life register per client, reviewed against vendor roadmaps twice a year
Firewall and router configuration	Default credentials, remote administration left enabled, or no documented rule set	A standard build for supported hardware, documented, with a configuration record per site
No asset register	Nobody owned it, or it was accurate in 2021	Inventory pulled from device management rather than maintained by hand
Leaver accounts still enabled	The joiners and leavers process is an email to the helpdesk	A documented process with a named owner on the client side and a monthly reconciliation

Every one of those is a configuration position rather than a piece of bespoke work. That is the whole opportunity.

Build the baseline once

Before touching any client, write down what a compliant client looks like in your stack. Not a policy document for a shelf: the actual configuration, expressed in whatever you deploy with.

For most MSPs that means a device management baseline, a conditional access policy set, an update ring configuration, a standard administrative account model, a firewall build standard and a short set of written procedures the client owns rather than you. Give it a version number. You will change it, and you need to know which clients have which version.

Two things are worth deciding at this stage rather than per client. First, what your default position is on personally owned devices, because it is the single most expensive question to answer twice. Second, what you will do about clients who refuse part of the baseline, because you will have some, and an exception needs to be recorded rather than argued about annually.

Grade the book before you touch it

Run a short assessment across every managed client against the baseline, and sort them into three groups. This takes a couple of days for a book of thirty and it is the highest-value two days in the whole exercise.

• Close. Estates you built and control. One or two gaps, fixable in an afternoon. These certify now and fund the rest.
• Work required. Several gaps, none structural. A scoped remediation piece of a few days.
• Structural. Inherited estates, on-premises legacy, unmanaged devices, or a client who has declined the relevant work before. These need a commercial conversation before they need a technical one.

Sorting matters because the temptation is to start with the client who is shouting, and the client who is shouting is usually in the third group. Starting there means your first attempt is your hardest one, and the project loses momentum before it has produced anything.

Run it in waves

Take the close group first, five or six clients together rather than sequentially. Apply the baseline, fix what the assessment found, submit them in the same fortnight. You get certificates on the board quickly, your team learns the questionnaire properly on the easiest cases, and you find out where your baseline is wrong while the cost of being wrong is low.

Then the second group, in waves of whatever your capacity supports. By the third wave the remediation is a checklist rather than a project, and the time per client falls sharply.

Leave the structural group until last and treat each as its own piece of work. Some of them will not certify this year, and knowing that early is worth more than a heroic effort that fails.

The asset register is the bottleneck

More certifications stall on knowing what is in scope than on any technical control. The questionnaire asks for counts of devices by type and operating system version, and the honest answer for a lot of small organisations is that nobody knows.

Solve this structurally and you solve it for every client at once. Inventory should come out of your device management platform, not out of a spreadsheet somebody maintains. Anything accessing organisational data and not appearing in that inventory is either an enrolment job or a scoping decision, and it is far cheaper to find those in a quarterly reconciliation than in the week before a submission deadline.

A book where every client has a current, tool-generated inventory can answer the scoping questions in minutes. A book where they do not will lose a day per client, every year, forever.

Turning it into a product

Once the baseline exists and the waves are running, the work is repeatable enough to price as a product rather than quoting it fresh each time. Three components cover most of it.

A fixed-fee readiness assessment

Your baseline check against one client’s estate, producing a written list of gaps, an estimate to close them and a realistic date. Sold on its own, it is a low-commitment first step for clients who are nervous. A formal gap analysis through us runs at £300 plus VAT direct, which gives you a reference point for what to charge for your own version or when to place ours instead.

A remediation package

Fixed scope, fixed price, tiered by which of the three groups the client landed in. This is the piece that carries the margin, and it is defensible precisely because the assessment produced a list rather than an opinion.

An annual recertification retainer

Cyber Essentials is annual. Sell the renewal as a small recurring line covering the baseline review, the evidence refresh and the submission, and it stops being a scramble every twelve months. It also fixes the renewal date in your system rather than the client’s inbox.

Price the certificate itself alongside those rather than inside them, so the client can see what they are paying for. Our direct prices are published by size band, from £320 plus VAT for one to nine staff, £440 for ten to forty-nine, £500 for fifty to two hundred and forty-nine and £600 for two hundred and fifty and over, plus £100 for urgent turnaround. Partner terms are preferential against IASME’s fee bands and are agreed with you directly.

What does not standardise

Be realistic about the limits. Scope boundaries in an organisation with subsidiaries or shared premises are a judgement call every time. Clients with an operational technology estate, a specialist line-of-business application or a regulated data set will need individual thought. So will anyone whose staff work substantially from personal equipment, where the answer is a policy decision the client has to make rather than a control you can deploy.

Everything else is the same work repeated, and repeated work is either a cost you absorb or a product you sell. It is entirely your choice which.