In this article 7 sections
You watch every client’s systems, but nobody checks yours. Then a financial services client’s regulator or insurer wants evidence, and a 40-tab security questionnaire lands on your desk. Half the questions weren’t there last year. The pressure isn’t the client’s idea. Their regulator and insurer are reaching through them, into you. The MSPs that win the account are the ones who can answer on the spot, with evidence.
Why are so many security questions reaching MSPs?
Because their own rulebooks changed. An FCA-regulated firm, an insurer, an NHS trust, a law firm holding client money: each one carries a duty to manage the risk sitting in its suppliers. You are a supplier. When their auditor asks how they control third-party risk, your MSP contract is one of the answers they have to give.
So the questionnaire lands on you. Access controls, backup testing, incident response times, joiner-mover-leaver process, evidence of the last time you actually restored from backup. The questions got sharper because the people asking them are now personally accountable for the answers.
What’s actually driving the acceleration?
Two regulations from across the Channel are doing a lot of the work, even for UK firms.
DORA (the Digital Operational Resilience Act) has been in force since January 2025. It’s an EU regulation covering financial entities and the critical ICT third-party providers they depend on. NIS2 is the EU directive that widens the old NIS scope to pull supply chains into the frame.
Neither one automatically binds every UK MSP. But plenty of your clients are caught, or they serve someone who is, or their group has an EU entity. In the UK, the Cyber Security and Resilience Bill brings managed service providers into scope. Your clients’ regulators and insurers want third-party risk managed, and a questionnaire is how that reaches you.
This trend rewards MSPs who can prove it
Here’s why the harder questions are good news for a good MSP. They work as a filter.
For years, every MSP in the room could say “yes, we take security seriously.” The words were free. Now the questionnaire asks for evidence. Show me the policy. Show me the last restore test. Show me who has admin and when you last reviewed it.
An MSP that runs a tight shop loves that question, because it separates them from the MSP down the road cutting corners.
What do regulated clients actually want to see?
They want evidence, dated and independent. A confident answer in a sales meeting doesn’t survive contact with a procurement team that’s been burned before.
Three things move the needle:
- Evidence that’s current, so it beats a policy PDF written in 2022 and never opened since.
- Evidence that’s independent, checked by someone other than you.
- Evidence that’s ongoing, so it still means something 6 months after the audit.
That last point is where most certificates fall down. A certificate proves a date. Assurix proves today.
How does an MSP answer with proof instead of promises?
This is why we built the Assurix Trustmark.
It’s an independently assessed, evidence-based trustmark for UK MSPs. It independently assesses 59 controls: 40 security controls aligned to the NCSC Cyber Assessment Framework (CAF 4.0) and 19 operational controls built for MSPs. Both pillars have to pass. Live measures such as SLA response, patching and supported operating systems are refreshed every six hours, other controls on a set cycle. If something slips, you get 30 days to fix it, and if it’s still failing after that, the Trustmark is publicly suspended. Anyone can check the result.
The scope is the MSP itself, the systems you run that nobody else checks. So when a questionnaire asks “can we trust the firm running our IT,” the Trustmark answers about your own business, front to back.
Proof, not promises.
When a questionnaire asks whether your security is independently assessed, “yes, here’s the Trustmark, and here’s the link to check it” is a very short conversation. That’s the point.
What happens to the MSPs who can’t answer?
They stall. The questionnaire asks for evidence, the MSP can’t produce it fast enough, and silence reads as risk.
Down to the last two for a 70-user deal, Sereno walked the prospect through its live results and won against a rival holding ISO 27001 and SOC 2. Not the cheapest quote.
Start by finding your gaps
Score your MSP against the Premium MSP Differentiation Checklist to find your gaps before a questionnaire does.
If you want the full breakdown of how to win work in financial services, healthcare, and legal, see the full playbook: how to win MSP deals in regulated sectors.
