Mary Coxon, Partner Marketing Manager, ThinkOn
Compliance gaps cost MSPs deals, not just fines. When a healthcare or financial services client sends a vendor security questionnaire and the evidence isn’t ready, the deal slows down or dies. This post sets out what to have ready, and how to word it so every claim holds up.
Why the questionnaire decides deals
Regulated clients ask the same questions in different words, and they ask them in writing, often before they will talk price. Healthcare clients need infrastructure aligned to HIPAA safeguards for electronic protected health information. Financial clients need help with PCI DSS scope and with safeguarding customer financial data. If your platform partner can’t give a straight answer on who is responsible for what, the questionnaire stalls.
What counts as evidence
A claim is only as strong as the person who checked it. These are the kinds of evidence ThinkOn provides:
- Independent audits. ISO and SOC audits are performed by outside accredited assessors, not self-graded.
- Monthly vulnerability scans across the entire service delivery infrastructure.
- Annual penetration testing by a certified outside firm that actively tries to break in.
- A formal, logged risk register reviewed by leadership at least quarterly.
Word it exactly
The status of each framework is different, and the wording should be too. Here is how ThinkOn’s stack reads:
| Framework | What it covers | Say this |
| ISO/IEC 27001 | Information security management system | Certified |
| ISO/IEC 27017 | Cloud-specific security controls | Certified |
| ISO/IEC 27018 | Protection of personal data in the cloud | Certified |
| SOC 2 Type II | Security, availability and confidentiality controls over time | Attested |
| SOC 1 Type II | Controls relevant to clients’ financial reporting | Attested |
| HIPAA | Safeguards for electronic protected health information | Aligned, self-attested |
| PCI DSS (SAQ D) | Cardholder data environments | Self-attested |
| GLBA (16 CFR Part 314) | Safeguarding customer financial information | Aligned, self-attested |
HIPAA, PCI DSS SAQ D and GLBA are self-attested rather than independently audited. Say so up front. Your clients’ auditors will ask, and an accurate answer gets you further than a confident one that falls apart.
What to send each client
Healthcare. 256-bit AES encryption at rest and encrypted sessions in flight, controls aligned to HIPAA safeguards for ePHI, ISO/IEC 27018 controls for personal data in the cloud, and ongoing review of whether the safeguards actually work, not just whether they are documented.
Financial services. PCI DSS (SAQ D) for cardholder data environments, GLBA safeguards for customer financial information, and SOC 1 Type II for controls that matter to financial reporting.
Let’s talk
We’re heading to IT Nation Connect Global, November 4–6 in Orlando. Stop by Booth 545 and we’ll walk you through our compliance evidence. If you can’t make it, contact us and we’ll set up a call.
