Questions MSP owners ask

Assurix is the live trustmark for MSPs (managed service providers). It independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. Prospects and clients see the result on a Trust Portal anyone can open, and the governance, risk and compliance (GRC) platform to do the work is built in.

Mit Patel founded Assurix and is its CEO. He built and ran Netstar, a UK MSP, for 20 years, grew it to 60 staff and £8 million in revenue, and sold it to private equity in 2021.

Assurix independently assesses 59 controls, each Pass or Fail, and all 59 have to pass. Live-measured controls are checked every six hours from the tools the MSP already runs. The rest are rechecked on a set cycle, from quarterly to yearly. An Assurix assessor signs off.

An Assurix Trusted MSP holds the Assurix Trustmark, which means it has passed all 59 controls and an Assurix assessor has signed it off. The security and operational controls must both pass, so there is no half Trustmark. If a control fails, the MSP has 30 days to fix it while the Trustmark stays live. If it isn’t fixed, the Trustmark is suspended publicly.

The Trustmark Directory shows four statuses: Assurix Trusted MSP, On the Journey, Committed and Not yet verified. An Assurix Trusted MSP holds the Trustmark and meets all 59 controls. On the Journey means on the journey to becoming an Assurix Trusted MSP, so the work has started but the Trustmark isn’t earned yet. It expires after six months. Committed means signed up with a future start date, without the Trustmark yet. Not yet verified means listed but not assessed by Assurix.

No. Assurix is independent, not a government or regulatory scheme. Its 40 security controls are aligned to NCSC CAF 4.0, and its 19 operational controls are built for MSPs.

The Trustmark badge for your own website, linked to your Trustmark Directory listing and your Trust Portal. Trustmark holders can get up to 25% off professional indemnity and cyber insurance, with partner insurers Hiscox, CFC and Beazley, subject to underwriting. The discount is on your own premiums.

No. You can open a live Trust Portal now, with no form, to see what a prospect sees.

Assurix is for growing MSPs that want to grow beyond referrals without being undercut by MSPs cutting corners.

MSPs looking for a logo without changing how they operate. The Trustmark only matters because the evidence behind it is checked continuously.

Yes. You only need to win or keep one client. When a prospect can’t tell MSPs apart, price decides. Your live results give them something to check, so you can be chosen without dropping your price. At renewal, the same evidence shows clients the work they pay for, so a cheaper quote has to match the standard. Trustmark holders can get up to 25% off professional indemnity and cyber insurance, with partner insurers Hiscox, CFC and Beazley, subject to underwriting.

Yes. A prospect can check your security and service instead of taking your word for it, so you can be chosen without dropping your price. Down to the last two for a 70-user deal, Sereno walked the prospect through its live results and won against a rival holding ISO 27001 and SOC 2. Not the cheapest quote.

You have 30 days to fix it. If it isn’t fixed, the Trustmark is suspended publicly.

We cover pricing on a demo call. It’s one plan, with everything included and unlimited users, on a 12-month agreement. Book a demo

There’s rarely a quiet quarter in an MSP. You can agree now and start later, with a booked start date. Billing starts in the month you start. It starts from 2 hours a week, and you set the pace.

Usually the owner, who signs, and whoever runs the technical side, who sizes the work. The owner and sales team will want to see the live results and the new-business case. The technical lead will want the time: from 2 hours a week, around 50 hours in total, the tools Assurix connects to and the evidence it reuses. Tell us who needs to agree, and we’ll put together what each person needs.

Yes. Ask to speak to an MSP of a similar size that uses Assurix, and we’ll arrange it. Book a demo and ask for a reference

It starts from 2 hours a week, and you set the pace. It’s around 50 hours to the Trustmark in total, and ISO 27001 holders typically need less. Evidence comes from the tools you already run, and Rosie, the built-in AI, drafts policies and documents. A named customer success person keeps you on track. Fit it around the day job

Your PSA, RMM, Microsoft 365 and security tools, read-only. If you use a tool we don’t connect to yet, we build the connector.

A kick-off, a platform access call and a getting-started session, where you pick your pace. We help connect your tools. Launchpad reads your existing policies and documents, and Rosie maps them to the controls. Then your named customer success person holds a weekly call, normally 30 minutes, until you reach the Trustmark.

Read-only, and the least data possible. Every integration is UK-hosted.

Yes. Run Assurix alongside it, so the new setup is evidenced as it is built. Or finish the migration first, and agree now to start later. Assurix connects to the PSA, RMM and Microsoft 365 you already run, and work done for ISO 27001 or Cyber Essentials is reused where it overlaps.

Put your Trust Portal link in the proposal and walk the prospect through it in the sales meeting. The Sales and Proof Gap workshops and the marketing packs are included. They show your team how to explain the Proof Gap to prospects, how to run the sales meeting, and how to differentiate your MSP in its marketing.

Your Trust Portal, a link anyone can open. Its “What is checked” page explains every control in plain English, with its current result. SLA and customer satisfaction cover your service to clients. The security controls cover your own systems. Patching covers both.

A Cyber Essentials or ISO 27001 certificate shows an MSP met the standard on the day it was assessed. The Assurix Trustmark is independently checked, every day. Live-measured controls are checked every six hours and the rest on a set cycle. A failure left unfixed for 30 days suspends the Trustmark publicly. Assurix also covers the service clients get, such as SLAs, client satisfaction and patching.

No. Your prospects don’t need the name before they see the proof. As Ian Groves, Managing Director of Start Tech, puts it: “But guess who’s gonna tell my prospects about Assurix? Me.” A link you share explains in plain English what is checked and shows whether each control passes. If a failure isn’t fixed within 30 days, the Trustmark is suspended publicly, which is why a prospect can believe it. Read the Start Tech story

You’re right, clients rarely ask an MSP to prove its own security. So bring your live results into the cost comparison yourself, at renewal, when a cheaper quote turns up. They show clients what they pay for.

Yes, once you start. Until you earn the Trustmark, it shows you as on the journey to becoming an Assurix Trusted MSP. Before your start date, the Trustmark Directory lists you as Committed.