Wes SpencerCo-Founder, Empath · Co-Founder of Empath | Recovering Cybersecurity Guy| Keynote Speaker | 2020 Cyber Educator of the Year | Building the MSP Workforce Operating System

Navigating Regulatory Challenges: #msp and Risk Management

23 Sept 2025 · 1 min

Watch on YouTube

0:59

In this segment, the speaker explains how regulatory requirements are becoming increasingly complex and directly impact Managed Service Providers (MSPs). The newly released NIST Cybersecurity Framework version 2 expands the definition of supply‑chain risk to include third‑ and fourth‑party relationships, effectively placing MSPs within every client’s risk profile. The speaker frames this as an inevitable reality: MSPs can either view the added obligations as a burden or embrace them as a strategic advantage, recognizing that they are a significant risk vector for both their clients and the clients’ downstream partners. He then references other regulatory regimes—CMMC, HIPAA, FTC Safeguards, among others—that now require comprehensive asset inventories, noting a broader industry trend where almost all compliance frameworks mandate inventory as a foundational control.

Chapters

it's going to continue to get both more onerous, more complex, and also is going to get grips on the MSP. Because what all regulations are starting to understand is risk profile. You know, when you look at NIST CSF 2 that came out, one of the things that had major changes to is understanding third and fourth party supply chain risk, which is another way for saying, hey, as an MSP, you're involved in this. You are part of the supply chain risk of every client. Ta-da! Welcome to being an MSP. And so you can choose to say, ah, It's so terrible that all these things are being added to me. Or you can choose to say, we embrace that and we're glad for that. And because that's correct and we are a significant risk to our clients and they to us and we and them to their fourth parties. That's just the nature of the game. So we should probably seize upon that, understand it. And so you look at this and you look at CMMC and HIPAA, FTC safeguards, and plenty of others that do require some kind of asset inventory. It's not just a CIS says it, but we're starting to understand that almost all frameworks and regulatory requirements have inventory.