Defend, Govern & Prove:
Managed compliance and governance

Hello guys, welcome back to the next episode five. This is the manage compliance governance. It's all part of that Defend, Govern & Prove piece that we've been talking about over the last x number of weeks or since the beginning of the year around 2026. This really is talking about the compliance and governance. And this is focusing really on what's on offer in the Microsoft stack. We've spent the entire last four episodes really focused on our MSP tool stack.

The problems that we have faced with the number of tools that we're using, underutilizing them, overutilizing them, not utilizing them enough in terms of the product delivery, conflicts within tools we have and really focusing and giving ourselves the opportunity more like a vision to see that we can utilize and leverage the majority of these products that we've got elsewhere into a single source i.e. Microsoft Defender or the Defender suite, the Microsoft 365 environment as a whole.

And this one is no different. You know, we want to take the stresses of compliance, the stresses of governance, how do we manage and maintain that to a continuous proof model, a model where we always need to be and we always can provide continuous evidence when we're being asked, whether that's by auditors, regulations, insurance providers, perhaps just our customers generally. Managed compliance and governance is the topic that I think really sits in that model.

So, let's do a bit more of a deep dive into this specifically. Compliance is breaking that MSP model. And I think this is a term I'll use quite heavily as we talk about these sort of elements.

And everyone's going to sit there and go, "What do you mean compliance is breaking the MSP model?" The old operating model eliminated this kind of concept of we have to govern and we have to be compliant with specific areas. And that comes down to regulators, auditors, frameworks and bodies that we have to uphold to now just didn't have enough information as to what's available or how models are created. Some, you know, because of that drive almost prevented some companies from advancing to public cloud because they couldn't catch up with the frameworks and the opportunities and delivery.

This is changing the way we think about modern work, modern MSP model. This is this for me really defines most MSPs going from a standard reactive kind of based solution to a modernized MSP operating model. And this really is driven based on compliance and governance. It reactive security doesn't make you a modern MSP because they're just the reactive and security proactive steps in there. You're missing those two other elements which is that governance and that proof of value.

So let's start with seeing where this goes wrong. So frameworks for starters and auditing pressures and the same tooling. All of these elements are different now. They are frameworks we have to adhere to for some of our customers and the list grows more and more. Auditing customers are now demanding more proof more frequency of this evidence i.e. The continuous proof that we now need to deliver. And there's pressures on us from regulatory requirements intensifying our security needs, our data protection needs across multiple sectors, not just individual sectors we can think of off the top of our head, but there are other sectors that also need this change.

And for us, it's the same toing. It's legacy approaches we've been having and as a result, it can't handle the modern demands. And this is a topic that I think rings true for almost every MSP that watches this today. We need to start looking at a different model, a different approach to how we handle things moving forward.

So what does it look like as reality today? It's word documents scattered across shared drives, Excel trackers uploaded manually each month. It's absolutely a nightmare. And it's all done and delivered or exports of this evidence is all done from senior engineers producing maybe a one-off script that we don't want to handle or we won't change. Manual evidence we're having to collect. So, when we're sending these quotes to customers, we're doing like a one-off professional services quote for an audit.

Wouldn't it be great if that was a monthly recurring service? Changing our approach from this oneoff project to monthly evidence. We're not having to then fork out on additional engineering costs, have additional labor requirements when actually it's an ongoing monthly service we're offering. Whether there reports we can produce from for example reinforce or other vendors that there to offer that element. It doesn't work at the moment with most operating models. But just imagine that change we can approach.

How can we make these changes? Where does that approach take us? What are then as a result the differences between governance and compliance? Because the reality and I'm going to emphasize this now. It's not the same. It never has been. It never will be. There is very much a real difference between governance and compliance. We merge the two. We always have done collectively. We've thought about that.

We've always assumed compliance is governance. Governance is compliance. They're not. They're two completely different models. And this here is the breakdown of the two. We've got governance. It's how things should be implemented in the environment. The governant element, how we can make sure and we can implement what should be in place. That's policies. That's standardization. Yes, we're constantly talking about standardization because that's the strongest method for good standards and good security practices. Controlled frameworks is part of governance.

It's a governance model. We have to make sure we are controlling our environments with the right frameworks for the businesses we work. And this I think rings real true. It's an intended state. So we want to intentionally implement this as a state across the customers we support. It's really important to know that because when we move to compliance, it moves from intended to actual. And then the last point is strategic direction. So for strategic direction, it's knowing the goal in the area.

Maybe that's we're following a framework and their direction is dictating where we're moving. It's companies in their industry changing the method and their approach they're moving to. And then compliance is proving what governance has been put in place. So it's proving the value and the information and the evidence that we've implemented with governance. So that's the evidence collection. It's the audit readiness. So for Copilot, we have a Copilot readiness assessment. That's not relevant to regulations, but the principle is very much the same.

It's a readiness report proving we are ready for audits. And then this is what rings true. It goes from intended state to an actual state. It's that continuous monitoring of an of a governance environment. That's where compliance governance sits. It sits across Defend, Govern & Prove completely does across the entire suite. When we talk about governance and compliance, this is the layer that sits above the most important elements of defense, governance and proof. And then it's the operational reality.

And you'll talk to any compliance and risk manager. We have to be able to prove the intended state is an actual state. It's ongoing. It's continuous. And that's that operational reality. Operationally, we are continuingly updating and managing that environment. And most organizations confuse the two. You can't prove compliance without governance and governance without enforcement. It's just documentation gathering dust. We have to be able to demonstrate what we implement. And that's where we talk about and the episodes we've done in the past.

We've got configured versus enforced versus effective. We've got defense, governance, and proof. These models that we dictate and we demonstrate for you guys in our series and webinars that we're doing is to try and drive home that these elements are so critical. There are layers to the full defend, govern scenario. So what is our problem? The MSP scaling issue. Where are we scaling as a business? Where are we failing to scale as a business? For us as MSPs, the reality is every tenants's different.

We support thousands and thousands of tenants across thousands of MSPs. Every tenants somewhat unique. The environments are unique and though they're unique maybe because identity is different.

Their SharePoint permission management, their layouts, their controls, their methodology, the frameworks they work for, they're different and there's different risk appetites for different industries. And sometimes particularly products and vendors like ourselves can quite often be mis misled or unaware that different industries have different appetites. Sometimes a target with an MSP is a vertical target. We're focused on the area we're dealing with. We also have frameworks that overlap. So control maps across standards creating redundant work and a confusion.

As a result, frameworks do overlap and sometimes we need a centralized tool that can identify where those overlaps are so we can control those measurements appropriately. Here's something we don't have in the mod the op the old operating model for an MSP. We have our tooling sprawl. Each client brings on their stack, multiplying complexity and exponentially driving more complexity for ourselves. As we bring in customers, they've got previous legacy information. When we talk about MSP's standardization, it's not standardizing just because it's simple for ourselves.

It's standardizing because the more that we control the methods and the products we have, the easier we become a specialist in those fields. And the last area that we really struggle on is human-driven tracks. When we talk about compliance governance, most areas that fail like nonconformities in ISO as an example, it's down to human error. We haven't finished something. We haven't followed the process. We haven't taken the framework and implemented it as accurately as we can be.

That's driven by human errors. If we're doing manual processes, we don't scale beyond a handful of the customers. So for an MSP when we're talking about compliance and governance which is so true to this date and it will be for the next three or four years as AI is forcing us down this route as it is we need to be true to what we can implement and we need to be able to automate some of those processes.

So what managed actually means? Really good comment. Managed means repeatable, provable and defensible outcomes. Standardized controls, central enforcement, continuous validation and evidence always being ready is what management is. Managed environments, managed compliance and governance gives us those four elements and four pillars to work towards.

If we can standardize controls, we can define once apply everywhere consistently without c customization chaos. We know there's going to be customs policies, but the standards are the same. That allows us to centrally enforce these products, essentially enforce policies, automatically apply them, remain that enforcement across multiple tenants. Off the back of that, we have continuous validation. So real-time monitoring, drift detection, the moment it happens for us, we need to know what's going on in the environment.

That's continuous validation. That's that element moving transitioning from governance to compliance. And then that evidence that's always ready, the reports, the alignment reports and inforcer assessment reports, not just for prospecting, but ongoing measurements. Hopefully you can see the big opportunity here. We've got four pillars of control. Good news is inforcer offers all four and we've got that capability to start measuring those things looking at repeatability, provable and defensible information. It will help fig help you figure it all out.

We can help to define those elements for you and we can also help to define this for us as a business and also for our customers as we move forward.

So the control plane shift I don't think it gets used enough but Microsoft of the two kind of main planes our control plane and our data plane the area we focus on when we look at compliance and governance it sits above data plane it's that control element that we need to put in place so the configuration to the control plane is most important part those four pillars we've just been talking about we need to define the standard once create our controls our baseline our security best practices the frameworks that we're working towards boards for our industry verticals that we're managing and we need to apply everywhere push to standards across all of our tenants with consistent enforcement.

Then we monitor with drift that helps with the enforcement but it also helps to make sure we're being proactive with our customers. Catch those deviations immediately allows us to make sure we're continuously being compliant and we're managing our governance. And then the last point is proving that alignment. So we can utilize alignment reports in inforcer to prove that customers are on the same journey they were 6 months ago to where they are now. This is where MSPs can start to evolve from fighting the fires to operating true control planes.

Taking it from what Microsoft has been giving us for the last x number of years as an opportunity for it to be the central control plane for a cloud-based managed business, particularly a Microsoft-based managed business. So let's talk about the frameworks. The things that cause us probably the most grief when we talk about compliance, governance and the whole kind of central piece. Frameworks give us a definition, an opportunity to shape how we build out and language.

It's almost a language and a structure that allows us to control the methods and the frameworks around the industry decisions that we make.

The critical mistakes we can do and do make is treating each framework as a separate compliance project instead of mapping the shared requirements across all of these frameworks. It's a big misconception is that every framework needs a completely separate approach. It's not strictly true. Every framework has overlaps. They always will do. Like CIS controls are practical security standards. Believe it or not, most of those actual resilient frameworks, the regulatory frameworks we have here like cyber essentials, NIST 2, DORA, ISO 27,0001, they work towards a central control and most of them will probably poach some level of policy management through CIS controls.

They overlap. Hopefully, it's easy enough to understand that we can be mapping these utilizing policy tags in inforcer. We can map what policies are associated to these frameworks. Sometimes, not only does it allow us to show that we're meeting those alignment requirements, but think about it outside the box. If 80% if you're 100% aligned to Cyber Essentials and you go through the alignment page and actually they're 90% aligned to NIST 2, maybe that's a framework we could be moving towards.

Maybe it's just a few more control methods we could be implementing. So, if a company comes to us and says, "Actually, we want to be this two as well." Great. Here's a small piece of project work, but you're already 92% there. Happy days. We're rolling in this compliance model and maybe it's an ongoing managed service offering where we're already driving those positive changes. We're implementing the right controls and the right frameworks with very little pain.

So, what does continuous compliance look like? Compliance is a state. It's not an event, which means it's ongoing. It's a continuous measurement of controls, measures that we implement for a business.

Is something we have to make sure is being monitored and managed daily, not just once and then leave it for 180 days or leave it just until the week before the next audit. If compliance only exists during audit week, it doesn't exist at all. It's comp it's compliance theater, not operational security. And that really rings true. When we implement all of this the week before an audit and during the audit week and then we get rid of it thereafter, we're removing that operational security element.

Compliance is there to drive a security model, a model where we don't need ITDR platforms because we're stopping that gap before it even appears. Compliance will drive a positive operational security outcome. As much as it sounds boring and tedious, it does have a process in mind. When I say it's a state, it's like a mindfulness statement. It's a state of mind. It's exactly the same when we talk about an operating model. It is a state in which we're continually act continually monitoring it.

It's an actual intent of what we're doing. So let's wrap up slightly. The MSP value shift from reactive support to a governance partner. One of the pe one of the companies I spoke to more recently spoke about being a trusted partner.

We have loads if not thousands of MSPs out there that provide a reactive support and they want to be that trusted partner. How can we demonstrate that as a business? I think that starts with you guys as MSPs, as customers as well, acknowledging that your IT, if it's external, it's a partnership. So why don't we have these operating models, these modern authentication or managed service models where we talk about security partnership, governance partnership? We have these MSA agreements and these partnership agreements in place.

We should be looking to bundle these services where we can, but also operate offer these kind of elevated support models. So I want to encourage us to be a re from go from reactive support to a governance partner, compliance partner. You can call it governance as a service for all I care but looking at this as a partnership rather than a reactive support model. Taking your relationship with your customers that one step further and looking through the lens of being a better partner.

It delivers higher trust, stickier relationships which when we want to retain our customers is so important. Compliance governance creates that deep integration and that's really difficult to replace. So when we talk about outstanding partnerships, we want to take it that one step further and become a stickier relationship and this generates better margins. Premium services command premium pricing. If we are providing a deep integration with their business and creating that really builtin relationship, that trust, companies quite often have no problem in providing money for a premium service.

Escape the commoditized support trap and focus on that premium service offering that you are already giving and this delivers a clear differentiation. It stands you guys out from the crowded market with provable repeatable governance capabilities. So yeah, you can start to lower margins because of repeatability, but your trust in your partnership proves the value that you're offering to customers. So this really brings to the last point really. It shows you hopefully from this whole little YouTube video that Defend, Govern & Prove model is actually very much the lay of the land.

Now this is our modern operating model defense security controls active protection that implementation of configurations and standards of best practice. That is your defense. It models in and it oversits with governance your standards, policies and more importantly the enforcement of those the ongrown drift detection. And then we sit at the very end of this with proving the value. We have to be able to demonstrate the evidence, the assurance and the compliance that we sit in with the customer.

So when I spend my life talking about these three tier models, it fits with a modern Microsoft or modern MSP operating model. Compliance sits for us across all three of these. You can't defend what you don't govern and you can't prove either without continuous evidence. So when we talk about that merged solution of compliance and governance and I do still see it as that to be fair, it's important to understand they're two different models but very much so sit across those three tiers, those three pillars that we've been talking about today.

And I want to finish on the last thing, I promise. Stop chasing compliance. Let's start controlling it. If you're still relying on documents, screenshots, manual evidence, collections, you're already behind the curve. You need to start getting ahead of the game. The future of managed compliance isn't about working harder. It's about working systematically. The question isn't whether to evolve in this instance. It's whether you'll lead the change or be less scrambling to catch it up. And this statement right here is going to apply to every single MSP out there.

We need to be ahead of the game. There are companies that specialize in it. Great. They're well ahead of the game. But could you imagine an automated repeatable service you can offer around data governance, compliance, governance as an entire piece that you can offer to your customers. Not only are you providing a new operating service model, but you're building value. You're driving customer positive exchanges and proactive measures that becomes a high trust relationship with your customers.

Think about that when we talk about the next model on moderate modding modernizing operating models. The next episode that's coming up is manage detection talking about how we can bake in defender XDR the defender suite whole bunch of more wonderful documentation and information around that. Any questions please reach out. If you feel that this resonates with you guys and you're on this now and you want to talk about kind of governance moving forward enforcing best practice.

Yes, I'm using inforcer as the name there. Reach out. Let's have a conversation. Let's start building your new modern MSP operating model. Let's take you from where you are now to where you want to be. It's a journey and for us it's a partnership with you guys as well. Thank you.