Commercial Integrator 2023 - 13

properly being managed.
As a CISO, I fi nd that the most eff ective
strategy is to attempt to educate the
client over time. Respect that they must
make risk decisions and convey a simple
message: All you seek is for them to make
informed risk decisions. Simultaneously,
it is necessary to share with clients the liability-management
requirements of the MSP.
For example, that might mean that you are
required by your cybersecurity or errors
and omissions (E&O) insurance to off er
certain services to all clients because doing
otherwise is not defensible.
Document the ways in which you
have communicated to the client these
necessary services, their value, the risk
mitigation they provide and their costs,
whether via emails, proposals or meetings.
If the client declines a service, send them
a polite follow-up email, thanking them for
their time to become an informed risk decision-maker.
Include information regarding
how you will be there for them if they
change their mind. But be sure to include
written notifi cation that, by declining the
service, they do not possess a legally
defensible information-security riskmanagement
posture and may be invalidating
their legal and insurance protections.
Politely also make it clear that the
MSP cybersecurity-insurance policy does
not off er coverage to the client.
Include at the end of every statement of
work (SOW) or proposal a section about
legal compliance. Every SOW must also
include a section on client responsibilities
related to the service.
Disputes About Service
Levels, Support Hours
Ideally, a well-established and properly
communicated support policy would be
proactively known to all parties involved.
Resolving disputes about service levels or
support hours is no diff erent from resolving
disputes regarding any other aspect of
the relationship.
1. Proactively communicate the policies
and procedures in advance in order to
manage expectations.
2. Identify if clients believe they need service
levels or support hours outside what
the existing support policy sets forth.
Determine if the MSP is willing to modify
commercialintegrator.com
the support policy to include additional
service levels or support hours, as well as
how that aff ects fees.
3. Each time someone is emotional about
the topic, listen and have empathy,
while remaining calm. However, direct
them back to the support policy. It
might be detrimental to be accommodative
in violation of the support policy
simply in order to resolve a person's
emotional distress because, if you are
accommodative, they learn that kind
of behavior will elicit a response that
is benefi cial to them but not benefi cial
to the MSP. Abusive client staff can be
the reason why an MSP loses valuable
employees. It is important for MSP management
to support MSP staff .
Felicia King is president of QPC Security,
vCISO and security architect. Get more
information at QPCSecurity.com.
Celebrating Nearly 50 Years as the Top Choice for Pro Audio,
Video, & Lighting Integrators and Contractors
800-356-5844 * fullcompass.com
Free Shipping | Free 2-Year Service | Low Price Guarantee
Flexible Financing | Certified Experts
JUNE 2023 Commercial Integrator 13
http://www.QPCSecurity.com http://www.fullcompass.com http://www.commercialintegrator.com
Commercial Integrator 2023

Table of Contents for the Digital Edition of Commercial Integrator 2023
