The demand is real. UK SMBs are being asked for ISO 27001 certificates by enterprise clients, Cyber Essentials renewals by cyber insurers, and GDPR documentation by their own customers. Most don't have the internal expertise to manage it. They're already outsourcing their IT to you. Compliance is the natural next conversation.
This guide covers how to build a Compliance as a Service (CaaS) offering from scratch — what to include, how to price it, and how to make the economics work.
What Is Compliance as a Service?
Compliance as a Service is a recurring managed service where you take ongoing responsibility for a client's compliance programme — maintaining their risk register, managing their policies, collecting audit evidence, and keeping them prepared for certifications and audits — in exchange for a monthly retainer.
The key word is recurring. Most MSPs touch compliance reactively — helping a client scramble before an audit or answering a one-off security questionnaire. CaaS replaces that with a structured, ongoing service that clients pay for every month, whether or not an audit is imminent.
For the client, it means compliance is handled rather than constantly deferred. For you, it means predictable monthly revenue with relatively low marginal cost per client once your processes are set up.
Why Now Is the Right Time for UK MSPs
Several things have converged to make CaaS genuinely viable for UK MSPs right now:
ISO 27001 demand is rising fast. Enterprise procurement teams are adding ISO 27001 as a standard supplier requirement. SMBs that couldn't justify the investment two years ago are now being told they need it to keep or win contracts. They need help getting there and staying there.
Cyber Essentials is becoming baseline. The UK government now requires Cyber Essentials for all suppliers handling government contracts. Cyber insurers are increasingly requiring it or using it as a pricing factor. Annual renewal means it's a recurring need, not a one-off project.
NIS2 is creating new obligations. UK businesses operating in the EU or supplying EU-regulated sectors now face NIS2 requirements. Most have no idea where to start. MSPs who can guide them through it become trusted advisors overnight.
Cyber insurance requirements are tightening. Insurers are asking more detailed security questions at renewal. Clients who can't demonstrate documented controls are facing higher premiums or coverage refusals. Having a compliance programme in place directly affects their insurance costs.
The spreadsheet problem is universal. Every SMB managing compliance manually on spreadsheets is a potential client. The moment you can show them a cleaner alternative, the conversation changes.
What to Include in a CaaS Offering
You don't need to offer everything on day one. Start with the core deliverables that satisfy the most common UK compliance requirements and expand from there.
Core CaaS package (suitable for ISO 27001 and Cyber Essentials clients):
- Initial gap analysis against the client's target framework
- Risk register setup and ongoing maintenance
- Policy library — information security policy, acceptable use, access control, incident response, business continuity, and others
- Policy distribution and staff attestation tracking
- Supplier/vendor risk assessments
- Evidence collection and storage for audit readiness
- Quarterly compliance reviews
- Annual internal audit support
- Certification body liaison (for ISO 27001 clients)
Add-on services:
- Security awareness training (monthly or quarterly)
- Penetration test coordination
- Incident response support
- GDPR Article 30 register maintenance
- Security questionnaire responses (for clients receiving supplier questionnaires from their own customers)
- NIS2 compliance assessment
The core package covers what most clients need day-to-day. Add-ons give you upsell opportunities as the relationship matures.
How to Price CaaS
Pricing compliance services feels unfamiliar if you've been selling break-fix or per-device managed services. The reference point isn't your cost — it's the value the client gets and the alternative cost of doing it themselves or hiring a consultant.
A compliance consultant charges £800–£1,500 per day. Getting a small business to ISO 27001 certification typically requires 15–30 consultant days. That's £12,000–£45,000 as a one-off project cost, plus ongoing maintenance.
Your CaaS offering delivers the same outcome on a monthly retainer — lower upfront cost for the client, recurring revenue for you.
Suggested UK pricing tiers:
| Tier | What's included | Monthly price |
|---|---|---|
| Essentials | Cyber Essentials management, basic risk register, policy library, quarterly review | £250–£400/month |
| Standard | ISO 27001 programme management, full risk register, policy management with attestation, evidence library, supplier assessments | £500–£800/month |
| Premium | ISO 27001 + GDPR + NIS2, monthly reviews, internal audit support, security questionnaire responses, training | £900–£1,500/month |
At ten Standard clients, that's £5,000–£8,000 in additional monthly recurring revenue. At twenty clients, £10,000–£16,000. The marginal cost of adding a client once your processes and tooling are in place is low — mostly the time to run quarterly reviews and keep their documentation current.
The Economics: Why This Works at MSP Scale
The reason CaaS works economically for MSPs is the same reason managed services works — you do the setup work once and maintain it efficiently across multiple clients.
Without proper tooling, compliance doesn't scale. Managing ten clients' risk registers, policy libraries, and attestation records on spreadsheets consumes more time than the retainer justifies. With a multi-tenant GRC platform, you manage all clients from a single dashboard, generate compliance reports at the click of a button, and spend your time on the high-value conversations rather than administrative maintenance.
The target economics for a well-run CaaS practice:
- Setup time per new client: 8–16 hours (gap analysis, initial documentation, platform configuration)
- Ongoing time per client per month: 2–4 hours (reviews, updates, evidence maintenance)
- At £600/month retainer: that's £150–£300 per hour of effective billing rate
That's strong economics for a recurring service, especially compared to project-based work where you're constantly selling the next engagement.
Getting Your First CaaS Clients
You almost certainly already have them — they just don't know it's a service you offer yet.
Start with your existing client base. Look at which clients are in sectors where compliance is becoming a requirement — professional services, finance, healthcare, legal, recruitment, software development. Any client who processes personal data or handles sensitive client information is a potential CaaS prospect.
Use trigger events. The best time to have the compliance conversation is when something creates urgency — a new enterprise client asking for ISO 27001, a cyber insurance renewal, a GDPR query, or a near-miss security incident. These moments open the door.
Lead with the gap analysis. Offer a free or low-cost compliance gap analysis as the entry point. It creates immediate value, surfaces real problems the client didn't know they had, and naturally leads into a proposal for ongoing management. The gap analysis is your sales tool.
Position it as risk reduction, not compliance. SMBs don't get excited about compliance. They do get excited about not losing a £200k contract because they failed a security questionnaire, or not facing a fine because they couldn't demonstrate GDPR compliance after an incident. Lead with the business risk, not the certification.
What You Need in Place to Deliver CaaS
A GRC platform with multi-tenant architecture. This is non-negotiable. Without it, you're managing spreadsheets per client and the economics fall apart. You need a platform where each client has their own instance — separate risk registers, policies, evidence — managed from a single MSP dashboard.
Framework knowledge. You need working knowledge of ISO 27001:2022, Cyber Essentials, and UK GDPR at minimum. You don't need to be a certified auditor, but you need to understand what controls are required, what evidence auditors look for, and how to conduct a gap analysis. If your team doesn't have this yet, it's worth one person getting CISM or ISO 27001 Lead Implementer qualified.
A repeatable onboarding process. The gap analysis, initial documentation setup, and client briefing should follow the same process every time. Document it, template it, and make it repeatable. This is what makes the economics work as you scale.
A standard policy library. You don't write policies from scratch for every client. Start with a core set of template policies that you customise per client — information security policy, acceptable use policy, access control policy, incident response plan, business continuity plan, GDPR privacy notice. Your GRC platform should provide these templates.
SnapGRC for MSPs
SnapGRC is built specifically for the MSP CaaS model. Each client gets their own separate instance with their own risk register, policy library, evidence storage, and compliance dashboard — all managed from a single MSP view.
Pre-mapped frameworks for ISO 27001, Cyber Essentials, UK GDPR, NIS2, SOC 2, and 40+ others mean you're not building compliance programmes from scratch. Policy templates, gap analysis tools, attestation tracking, and supplier assessments are all included.
The multi-tenant architecture means client data is completely separate — no risk of mixing evidence between clients, clean audit trails per client, and the ability to generate client-specific reports instantly.
See how SnapGRC works for MSPs →
Summary
Compliance as a Service is the most natural expansion of what UK MSPs already do. Your clients trust you with their IT infrastructure. Compliance is the next layer — and they need help with it.
The opportunity is real, the demand is growing, and the competition among MSPs offering proper CaaS in the UK market is still limited. The MSPs who build this capability now will have a significant advantage as ISO 27001, Cyber Essentials, and NIS2 requirements continue to tighten.
The steps are straightforward:
- Choose two or three frameworks to specialise in — ISO 27001, Cyber Essentials, and UK GDPR cover most UK SMB needs
- Get the right multi-tenant GRC tooling in place
- Build your standard onboarding process and policy templates
- Identify existing clients where compliance is becoming urgent
- Lead with a gap analysis and let the problems sell the ongoing service
The economics work. The demand is there. The question is whether you move on it before your competitors do.
SnapGRC is a compliance management platform built for UK MSPs offering Compliance as a Service. Multi-tenant, pre-mapped frameworks, MSP pricing. Learn more →
