The compliance work your MSP cannot do for you
No regime lets your compliance duty move to your provider. The FTC Safeguards Rule lets a service provider supply your qualified individual, then says you retain responsibility for compliance and must appoint someone to oversee that individual. Hiring a provider adds a duty. Five acts stay yours whatever you pay for.
- Your provider can perform the compliance work. No regime moves the obligation, so the business named in the rule stays answerable for it.
- The FTC Safeguards Rule lets a service provider supply your qualified individual, then makes you retain responsibility and name a senior person to oversee that individual.
- Five acts stay with you: scoping the data you hold, designating the responsible person, affirming compliance, assessing the risk before you outsource, and notifying the people affected.
- Hiring a provider creates a new duty rather than removing one, because four separate regimes require you to select, contract with and reassess whoever performs the work.
- Below 5,000 consumers the Safeguards Rule drops four written requirements and keeps both the designation and the oversight duties.
Can an MSP make you compliant?
No. Your provider can perform most of the technical work a rule asks for, and no published regime moves the compliance obligation to the firm performing it. The rules address the regulated business directly, usually in the second person, and they leave it there.
Read the opening line of the rule that applies to you. The FTC Safeguards Rule states that you shall develop, implement, and maintain a comprehensive information security program, written in one or more readily accessible parts and appropriate to your size and complexity. The HIPAA Security Rule opens the same way, requiring that covered entities and business associates each ensure the confidentiality, integrity, and availability of all electronic protected health information they create, receive, maintain or transmit. Canada's federal privacy law states that an organization is responsible for personal information under its control.
Nobody in those sentences is your provider. The practical consequence is a three-part division rather than a two-part one. There is work a provider can do, there are acts only your business can perform, and there is oversight you acquire the moment you hire anybody. The third part is the one nobody sells you.
None of this is an argument against outsourcing. Your provider is also your largest third party, and Verizon reported breaches involving a third party now accounting for 48% of all breaches after third-party supply chain breaches jumped 60% in a single year. IBM puts the global average cost of a data breach at USD 4.99 million. Buying the work is usually the right call. Assuming the duty went with it is what costs money.
Where the rules name you and not your provider
Six regimes are set out below with the party each one binds and what it says about using a provider. Read the row that reaches your business and skip the rest, because most firms are bound by one of these and none of them is universal.
| Regime | Who it binds | What it says about using a provider |
|---|---|---|
| FTC Safeguards Rule, 16 CFR 314 | Businesses the rule calls financial institutions, including tax preparers, mortgage brokers, appraisers, check cashers and dealerships that lease | A provider may supply your qualified individual, and you retain responsibility for compliance |
| HIPAA Security Rule, 45 CFR 164 | Covered entities and business associates in healthcare | Both parties are named in the rule, each for its own duties |
| CMMC, 32 CFR 170 | Department of Defense contractors, prime or subcontractor | A senior official of the contractor affirms continuing compliance every year |
| New York GBL 899-aa and 899-bb | Any business holding the private information of a New York resident | A provider that holds the data notifies you, and you notify the residents |
| PIPEDA, Schedule 1 | Organisations handling personal information in commercial activity in Canada | You stay responsible for data transferred to a third party for processing |
| NIST SP 800-53, control SA-9 | Federal systems, and a free published model for everyone else | Define and document your oversight of external service providers |
The FTC Safeguards Rule reaches further than its name suggests. It binds what the rule calls a financial institution, meaning an institution significantly engaged in financial activities, and its own examples include an accountant or other tax preparation service, a mortgage broker, a personal property or real estate appraiser, a check cashing business and an automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days. In the same rule a service provider is anyone permitted access to customer information through its provision of services to that institution.
The other five are scoped just as tightly. CMMC requires an affirmation from each OSA, prime or subcontractor, which means a Department of Defense contractor at any tier. New York's breach law reaches any business holding the private information of a New York resident, wherever that business sits. Canada's PIPEDA binds organisations handling personal information in commercial activity. Presenting any one of these as a general law of compliance is the mistake to avoid, and it is the mistake most vendor marketing makes.
The wording travels even when the rule does not. A regulator that has to divide work between a business and its vendor writes the division down in specific language, and those sentences are free to borrow in your own contract.
Five compliance acts only your business can perform
Five acts sit with the regulated business in the rules themselves. Each one appears below with the regime that keeps it there.
- Scope the data. Somebody has to decide what you hold and why you still hold it. The Safeguards Rule requires you to identify and manage the data, personnel, devices, systems, and facilities that enable your business purposes. CMMC makes it a precondition, stating that the CMMC Assessment Scope must be specified prior to assessment and that prior to performing a Level 1 self-assessment, the OSA must specify the CMMC Assessment Scope. A provider can build the data inventory. It cannot tell you why the records exist.
- Designate the person. The Safeguards Rule requires you to designate a qualified individual responsible for overseeing and implementing your information security program. PIPEDA requires an organisation to designate an individual or individuals who are accountable for the organization's compliance, and to make that identity known upon request.
- Affirm the compliance. CMMC requires an Affirming Official to affirm continuing compliance after every assessment, including POA&M closeout, and annually thereafter.
- Assess the risk before you outsource. The NIST control catalogue, as FedRAMP reproduces it, requires an organisation to conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services and to verify that the acquisition or outsourcing of dedicated information security services is approved by named personnel. Accepting whatever risk is left over is a separate signature, covered in the exception register.
- Notify the people. New York requires that any person or business which owns or licenses computerized data which includes private information shall disclose any breach to any resident of New York state whose private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization.
The signature question
Ask who at your business would sign the affirmation, then watch what happens in the room. CMMC defines the Affirming Official as the senior level representative from within each Organization Seeking Assessment who is responsible for ensuring the OSA's compliance with the CMMC Program requirements and has the authority to affirm continuing compliance. The submission carries that person's name, title, and contact information and a statement that the organisation has implemented and will maintain implementation of all applicable CMMC security requirements across all information systems within the relevant CMMC Assessment Scope.
No provider can be that person. The affirmation is annual, it is personal, and it is the moment compliance acquires a name. A business that cannot say who would sign, or what the sentence commits them to, has found something worse than a technical gap.
The notice only you can send
Your provider's legal duty often ends at telling you. New York splits breach notification in one sentence each way. A business that maintains computerized data which includes private information which such person or business does not own shall notify the owner or licensee of the information of any breach within thirty days following discovery. The owner then discloses to residents in the most expedient time possible and without unreasonable delay, within thirty days, except for the legitimate needs of law enforcement.
The penalty attaches to the second notice rather than the first. A court that finds a business violated the article knowingly or recklessly may impose a civil penalty of the greater of five thousand dollars or up to twenty dollars per instance of failed notification, and that latter amount shall not exceed two hundred fifty thousand dollars. Federal rules put the same act in your hands. Under the Safeguards Rule, if the notification event involves the information of at least 500 consumers, you notify the Federal Trade Commission no later than 30 days after discovery of the event. Healthcare runs its own clock, which who signs the business associate agreement sets out in full.
Hiring a provider adds a duty rather than removing one
Hiring a provider creates an oversight duty you did not have the day before. Four regimes say so, and the Safeguards Rule says it in three numbered steps.
- Select. Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue.
- Contract. Requiring your service providers by contract to implement and maintain such safeguards.
- Assess, repeatedly. Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.
Three other regimes add the same shape in their own words. PIPEDA makes an organisation responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing, and requires it to use contractual or other means to provide a comparable level of protection. New York's SHIELD Act lists among reasonable safeguards that a business selects service providers capable of maintaining appropriate safeguards, and requires those safeguards by contract. The NIST catalogue asks an organisation to define and document organizational oversight and user roles and responsibilities with regard to external system services, and to monitor control compliance by external service providers on an ongoing basis.
CISA names the whole thing as a goal belonging to the customer rather than the provider, calling it Manage Risks from Managed Service Providers. So count your duties before and after signing. Before, you owe the rule. After, you owe the rule and the oversight of whoever now performs it. An invoice satisfies none of those sentences.
A regulator that lets you outsource the person and keeps the responsibility has already settled the argument. The work is transferable. The accountability is not.
The duties that survive the small-business exemption
Four written requirements drop away for the smallest covered firms and the two personal duties do not. The Safeguards Rule exempts section 314.4(b)(1), (d)(2), (h), and (i) for financial institutions that maintain customer information concerning fewer than five thousand consumers.
Look at what that list contains. It drops the written risk assessment, the testing requirement, the incident response plan and the annual written report to the governing body. Every one of those is a document a competent provider could draft for you. The designation in paragraph (a) and the service provider oversight in paragraph (f) are not on the list, and they are the two a provider cannot complete on your behalf.
New York accommodates a small business the same way. A business that meets the statute's small-business test, which turns on headcount, revenue or assets, may run a programme with safeguards appropriate for the size and complexity of the small business, and the service provider clause stays exactly where it was. Read the two exemptions together and the pattern is hard to miss. Regulators relax the paperwork for small firms and keep the duties that have to carry a name.
What your provider genuinely can do, and should be contracted to do
Almost all of the operating work is buyable, and the Safeguards Rule happens to list it. Put each line in the contract with a frequency and a named deliverable beside it.
- Encryption. The rule says to protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest, and where you determine that is infeasible you may use effective alternative compensating controls reviewed and approved by your Qualified Individual. Your provider can encrypt. Only your named person can approve the alternative.
- Multi-factor authentication. Required for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls. Same split: the deployment is buyable, the written approval is not.
- Access controls. Technical and, as appropriate, physical controls limiting each user to the customer information that they need to perform their duties and functions.
- Monitoring and logging. Policies, procedures, and controls designed to monitor and log the activity of authorized users.
- Testing. Continuous monitoring or periodic penetration testing, with vulnerability assessments at least every six months where continuous monitoring is absent.
- Training. Security awareness training that is updated as necessary to reflect the risks the risk assessment found.
- Disposal. Procedures for the secure disposal of customer information in any format, generally no later than two years after the information was last used, subject to the exceptions the rule lists.
The named person can be outsourced too, which is the part most buyers never hear. The rule says the Qualified Individual may be employed by you, an affiliate, or a service provider. Do that and three conditions arrive with it. You retain responsibility for compliance with this part, you designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual, and you require the service provider or affiliate to maintain an information security program that protects you to the rule's own standard.
PIPEDA draws the same line in two consecutive clauses. Accountability for the organization's compliance with the principles rests with the designated individual(s), while other individuals within the organization may be delegated to act on behalf of the designated individual(s). Delegate the work. Keep the name.
Put the division in writing, then keep it true
Write the split down control by control, because an assumption is what fails in an audit. One document does that job and it needs five columns rather than two: the control, the named owner, the side it runs on, the evidence it produces and the review date. Control ownership: the five-column matrix that leaves no control unowned covers the rows and the places ownership quietly falls through.
Three companion steps sit around it. What a gap assessment should cost and produce tells you which controls are missing and what the deliverable is worth. Your MSP's SOC 2 does not cover you explains why an independent report about your provider says nothing about your own environment. Auditing your MSP's subcontractors matters because the firms behind your firm reach the same data.
Then date the document and review it every quarter against the invoice. The Safeguards Rule asks a firm to evaluate and adjust your information security program in light of the results of the testing and monitoring, a cadence worth borrowing whether or not that rule binds you.
What to ask your provider this week
Five questions settle most of this, and every answer should arrive in writing and dated.
- Name the person at your firm who would act as our qualified individual, and confirm that we retain responsibility for compliance.
- State which regime you believe reaches our business, and which paragraph of it you are performing for us.
- Send the written contract clause that commits you to maintain safeguards, plus the evidence each control produces.
- Specify how many hours you need to notify us of a suspected incident, and what you will hand over for a notice we have to issue.
- List what you cannot do for us, including every signature, affirmation and notification that has to carry our name.
The last question is the useful one. A provider that answers it quickly has read the rule you are bound by. A provider that cannot name a single act outside its own scope has not, and you are the one holding the obligation either way. We hold 24,491 provider records across 730 city datasets and the median market lists 16 ranked providers, so a firm that will not answer in writing is not your only option.
No provider makes a business compliant, and no honest provider claims otherwise. The work moves, most of the paperwork can be drafted by somebody else, and the non-delegable half stays where the rule put it. Write down which half is which, put a name beside every line, and the most expensive sentence in any audit has nowhere left to live.
FAQ
Can an MSP make my business compliant?
No. A provider can perform the work, and the obligation stays with the business the rule names. The FTC Safeguards Rule says you shall develop, implement, and maintain a comprehensive information security program, and when a service provider supplies your qualified individual you still retain responsibility for compliance with this part.
Who is responsible if my IT provider causes a compliance failure?
The regulated business answers for its own programme, and the provider answers under your contract. PIPEDA makes an organisation responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. A contract gives you a claim against the provider, not immunity from the regulator.
Can my IT provider be the qualified individual under the FTC Safeguards Rule?
Yes. The rule states that the Qualified Individual may be employed by you, an affiliate, or a service provider. Three conditions follow. You retain responsibility for compliance, you designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual, and you require that provider to maintain a programme meeting the rule.
Does hiring an MSP reduce my compliance obligations?
No, it adds one. The Safeguards Rule requires taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards, requiring your service providers by contract to implement and maintain such safeguards, and periodically assessing your service providers based on the risk they present. CISA calls the goal Manage Risks from Managed Service Providers.
Who notifies customers after a breach, my business or my IT provider?
You do, where you own the data. New York requires the business that owns or licenses computerized data which includes private information to disclose the breach to affected residents, while a business that only maintains that data must notify the owner or licensee within thirty days. The penalty for a missed notice follows the owner.
Best IT MSP is the independent directory of managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on verified rating and firmographic data, and paid placement is always labelled. Shortlist three firms in your city, then ask all three which compliance acts stay with you.