Published by
Throne of Profit EditorialReviewed by
William Hassell
Founder & Chief Editor, Throne of Profit
A few years ago, a client's cyber insurance renewal was a one-page form nobody read closely. Now it's a multi-page questionnaire that asks whether every account has multi-factor authentication, whether endpoint detection is deployed everywhere, whether backups are tested and offline, and whether privileged access is locked down. And the client forwards the whole thing to you with a note: "Can you fill this out?" The moment your clients' insurers started auditing controls, they quietly handed your MSP a new, ongoing delivery workload — and most shops absorbed it without pricing it, staffing it, or even naming it.
That's the trap. Answering the questionnaire honestly means the controls actually have to be in place, deployed, and maintained across the whole client base. Answering it optimistically means you've put your name on an attestation that a claim adjuster can later pick apart. Neither the "yes" nor the "no" is free, and both land on your team.
ONE INSURANCE QUESTIONNAIRE
client forwards form
│
├─ controls already deployed → attest truthfully → renewed + covered
├─ controls partly deployed → scramble to remediate → unbilled sprint
└─ answered optimistically → gap surfaces at claim → coverage deniedOwner symptoms
Clients forward insurance questionnaires and expect you to complete them, fast and free.
Renewal deadlines trigger unplanned remediation sprints that nobody scoped or billed.
You're unsure whether the "yes" answers you've attested to are actually true everywhere.
Why this happens
Insurers shifted from selling coverage on trust to selling it on verified controls, and the natural place to verify is the IT provider. Most MSPs never redrew their service agreements or pricing to match. The controls insurers now demand — MFA everywhere, EDR, tested and immutable backups, privileged access management, email filtering, security awareness training, patch cadence — are real projects with real labor, but they arrive disguised as a form to fill out. Because the request looks administrative, it gets treated as a favor rather than a project, and the delivery work hides until a deadline forces it into the open.
Common mistakes
Treating the questionnaire as paperwork rather than the trigger for a real controls project.
Attesting to controls you haven't verified across every user, device, and location.
Absorbing remediation for free because it arrived as a client favor, not a scoped job.
Signing the form yourself and quietly taking on liability that belongs to the client.
Deploying controls once and never checking that they stayed on as staff and devices change.
Business consequences
The honest version of this work is a standing delivery load: assessing each client against current requirements, remediating gaps, documenting evidence, and re-verifying at every renewal. Absorbed silently, it eats technician hours that were never priced, and it puts your signature on attestations you can't fully stand behind. The dishonest version is worse — an optimistic "yes" that holds until a client files a claim, the adjuster finds a gap, coverage is denied, and the client turns to the provider who filled out the form. The MSP that names this workload, scopes it, and prices it turns insurance pressure into a recurring security-project line. The one that treats it as a favor carries the labor and the liability for free.
How experienced operators think about it
They stop seeing the questionnaire as a form and start seeing it as a recurring compliance cycle they deliver: assess, remediate, document, attest, monitor, repeat at renewal. They separate the roles cleanly — the MSP implements and verifies controls; the client (or its named officer) signs the attestation, because it's the client's policy and the client's representation to make. They treat "MFA is on" not as a one-time deploy but as a state that drifts, so they build re-verification into regular service rather than into a renewal panic. And they price the whole cycle as security delivery, because insurer requirements only ratchet upward — what qualified last year rarely qualifies next year.
Practical actions
Turn the questionnaire into a scoped assessment. Map each requirement to what's actually deployed across every client, and treat gaps as a project with hours and a price.
Put the attestation signature back on the client. You supply the evidence; the client's officer signs. Document that boundary in writing before renewal season.
Build a standing controls baseline. Define the MFA, EDR, backup, and access controls every managed client must run, and remediate anyone below it as billable work.
Re-verify on a schedule, not at deadlines. Check that controls stayed on — new hires, new devices, disabled agents — as part of regular service.
Keep an evidence file per client. Screenshots, reports, and dates, so completing next year's form is retrieval, not a scramble.
Questions every owner should ask
If a client filed a claim tomorrow, could I prove every control I've attested to is actually in place?
Am I pricing insurance-driven remediation as delivery work, or absorbing it as a favor?
Whose name is on the attestation — mine, or the client's, where the liability belongs?
Frequently asked questions
Should my MSP sign the insurance attestation on the client's behalf?
As a rule, no. The policy belongs to the client, and the attestation is the client's legal representation to its insurer. Your job is to implement and verify the controls and hand the client clear evidence — reports, dates, coverage figures — so an authorized officer can sign with confidence. Signing it yourself pulls your business into the client's coverage dispute if a gap ever surfaces at claim time. Keep the delivery on your side and the representation on theirs, and document that split in your agreement. This is general business information, not legal advice. Consult a qualified professional for your situation.
How do I charge for controls that clients think should already be included?
Draw a line between what your existing agreement covers and what the insurer is newly requiring. Baseline management is one thing; deploying and maintaining a lengthening list of insurer-mandated controls across every user and device is another. Present it as a security package or a scoped remediation project tied to their renewal, with the requirement — not your preference — as the driver. Clients accept the cost far more readily when they see it's their insurer, not their MSP, setting the bar.
Related articles
Running a Profitable Managed IT Services Business — the pillar.
Scaling a Managed IT Business Beyond Its First Market — delivering consistent controls across locations.
Buying Another MSP's Client Base Without Losing the Accounts — inheriting an unknown controls baseline.
Why Jobs Take Longer Than You Quoted — the estimating problem underneath.
Where Time Leaks on a Typical Job — where hidden hours go.
Every business has more decisions than time
Whether you need help solving one problem, evaluating a major opportunity, or making a company-changing decision, Throne of Profit gives you consulting capacity on demand.
Purchase only the consulting capacity you need and use it across Weekly Focus, Strategic Focus, Financial Focus, and ThinkTank engagements.