Erick Simpson’s MSP Newsletter | January 2024 | 3 Changes to Cybersecurity Compliance That MSPs Must Understand

Recent key changes in cybersecurity compliance laws and enforcement practices can and should unlock new business opportunities for MSPs in 2024.

MSPs struggle to avoid seeing their services commoditized by customers looking for the best-bargain (but minimally effective) options they can find. Offering compliance expertise and an effective suite of services to check those boxes—and explaining that businesses who skimp on compliance are at significant risk—is an increasingly powerful competitive differentiator for MSPs.

In 2024, MSPs should capitalize on compliance opportunities aligned with these unfolding compliance developments:

1. The FTC Safeguards Rule is now in effect.

Written in 2021, the FTC Safeguards Rule finally went into effect in June 2023. It requires millions of businesses to comply with strict financial data cybersecurity regulations. The FTC Safeguards Rule applies to any business under FTC jurisdiction (and not that of another regulator) that “acts as a financial institution.” In practice, this actually means any business that regularly transfers money to and from customers. Businesses like car dealerships, mortgage lenders, and countless others must now implement comprehensive information security programs to comply.

For MSPs, this means millions of potential new customers who now find themselves requiring more robust cybersecurity tools—along with visibility into (and evidence of) how their security tools directly map to FTC Safeguards mandates. MSPs pursuing these customers will find regulators actively driving them into their waiting arms, with threats of $100,000 fines per violation, additional fines targeting individual business leaders, and risks to business licensing. And, regulators have signaled more active enforcement in 2024.

2. HIPAA is evolving.

HIPAA’s mounting complexity makes it increasingly perilous for small or medium-sized healthcare businesses to ensure compliance on their own. In a departure from previous “do it yourself”-focused guidance, the government’s 405(d) Health Industry Cybersecurity Practices (HICP) guidelines now offer advice for businesses on how to choose an effective cybersecurity MSP partner. MSPs eager for more business would be wise to match that criteria.

Another change—brought on by recent bill H.R.7898—maps HIPAA-compliant practices to modernized cybersecurity standards, such as the NIST Cybersecurity Framework and ISO 27001. With this shift, MSPs have extra latitude in their strategic approaches to protecting clients and ensuring HIPAA compliance, as well as a clearer picture for aligning specific controls with compliant safeguards.

2024 is also bringing changes to HIPAA enforcement. Regulators have reduced fines to fit what businesses can actually afford to pay, while ramping up the frequency of enforcement actions. Businesses now face fines of $35,000-$50,000 per violation that they absolutely must pay if caught out of compliance. MSPs equipped to protect clients from those fines will thrive in 2024.

3. CMMC is becoming CMMC 2.0.

Many businesses are lured to pursue CMMC compliance in order to become eligible for lucrative contracts with Department of Defense contractors and subcontractors. CMMC includes an assessment and certification that a business meets DFARS 7012 compliance, meaning that its cybersecurity can protect controlled data in alignment with NIST 800-171 controls and some additional requirements.

What’s new is that CMMC 2.0 will arrive in 2025, and the details are currently being hammered out. MSPs capable of guiding clients through to CMMC certification—and aligning protections to changes as they emerge—will make the most of the opportunity created by those changes.

2024 is a year of business opportunity for MSPs

Cybersecurity and data safety are such serious concerns that, very soon, there won’t be any type of business allowed to operate without stringent regulations. Particularly as enforcement ramps up in 2024, MSPs that position themselves to support businesses in achieving solid compliance will reap substantial dividends.