Show prospects the proof behind your proposal.

Let them describe it in their own words. Then confirm you’ve heard it. Don’t answer the question for them.

1. “What made you start looking at other providers?”
2. “How would you know if your IT provider had stopped patching?”
3. “What could you check today, without having to ask them?”
4. “When was your provider’s certificate issued, and what did it cover?”
5. “If your insurer or a client asked how you vetted your IT supplier, what would you show them?”
6. “Who could reach your email, files and backups right now, and how would you know?”

1. There are no trust signals“Your solicitor has to meet a standard to use the title. Your IT provider doesn’t, and it has far more access to your business.”
2. Certificates are snapshots“An MOT tells you the car was roadworthy on the day it was tested. It tells you nothing about this morning.”Don’t run down ISO 27001 or Cyber Essentials. They are a good foundation.
3. Service is visible. Security is invisible.“You’d know straight away if nobody answered the phone. You wouldn’t know if patching had stopped four months ago.”Don’t suggest their provider is failing. You don’t know that, and nobody can tell.
4. The MSP is the most privileged user“Nobody in your business has more access than your MSP. Not even you.”
5. Include yourself“We hold the keys to our clients’ systems too, which is why we’re independently checked.”

Agree, then bridge with “and”, never “but”: “And the only evidence you have is what they give you.”

The live measures include response and resolution SLAs, client satisfaction, critical patching and supported operating systems. They depend on the integrations you have connected, so check your own portal before the meeting.

1. The status. It shows where you stand today. A certificate shows a date.
2. “They cannot change a single result on it.” Read it aloud. It answers “well, you would say that”.
3. 40/40 and 19/19 met. Every control has to be met. There is no pass mark.

If yours isn’t the lowest quote, say so before they notice. Then ask them to request the same evidence from the others.

1. “How quickly do you respond to urgent problems, and can you show me last month’s figures?”
2. “Which problems keep coming back, and what do you do about them?”
3. “When something goes wrong, who owns it, and how will we hear?”
4. “What did you fix last quarter before a client noticed?”
5. “How often will you review our IT with us, and will we get a written plan?”
6. “How many critical security updates do you apply on time, and when did you last test a restore?”
7. “Who at your company can get into our systems, and how is that removed when someone leaves?”

Describe the Trustmark as a live status, independently checked every day, and never as a certificate.

Our security and our service are independently assessed by Assurix on 59 controls, and we have to keep meeting all of them. [x]% of tickets were answered inside our response SLA, measured from our PSA over [the period shown on our portal]. Critical patch compliance across all clients is [x]%. Repeat issues are tracked to a root cause, and we’ll walk you through the log at your first review. You’ll get a monthly service report, with client satisfaction shared at every review, and no invoice line you haven’t agreed. You can check all of this yourself at [your Trust Portal link].

For an Assurix Trusted MSP. Fill in the figures from your own portal, and keep only the measures you have connected.

Assurix Trusted MSP

“We’re an Assurix Trusted MSP. Assurix independently assesses 59 controls across our security and our service, and we pass all of them.”Only Trustmark holders show the Trustmark badge, linked to their Directory listing and Trust Portal.

On the Journey

“We’re on the journey to becoming an Assurix Trusted MSP.”Use these words exactly. Work has started, and you don’t hold the Trustmark yet.

Committed

“We’ve signed up to work towards the Assurix Trustmark, with a start date booked.”You don’t hold the Trustmark yet.