On this page
What do clients need to see about their compliance?
Clients rarely want every technical detail. They want to answer a few questions quickly, often because an auditor, insurer or customer has just asked:
- Where do we stand overall? A score or grade, with the date of the last assessment.
- What is failing? The gaps, written in plain language, with the most important first.
- Why does it matter? The business impact of each gap, not just the setting that is wrong.
- What is being done? Who owns the fix, the target date, and whether it is in progress.
- Can we prove it? Evidence for the checks that pass, such as screenshots, exported settings or signed policies.
A compliance view that answers those five questions is useful to a client. One that lists hundreds of technical settings with pass or fail next to them usually is not.
What should stay internal?
Some information belongs with the MSP's team:
- Raw technical notes and troubleshooting detail, until they have been rewritten for the client.
- Findings that are still being verified, so the client does not act on a false alarm.
- Risks the MSP has not yet assessed or agreed with the client.
Separating internal notes from client-visible notes on each check keeps this simple: the engineer writes what they found, then a client-ready version is published.
Ways to share compliance status with clients
| Method | Strength | Weakness |
|---|---|---|
| Emailed report or PDF | Familiar, easy to forward to an auditor | Out of date as soon as it is sent; clients wait for the next one |
| Slides in a business review | Good for explaining priorities face to face | Only seen a few times a year |
| Shared spreadsheet | Flexible | Hard to control versions and who sees what |
| Client portal view | Available on demand, always shows the latest recorded results | Needs permissions set up so each person sees the right scope |
Most MSPs combine a portal view for day-to-day questions with a periodic report for the business review. See What are the best reports for an MSP to send clients? and Should MSPs give clients a live dashboard instead of reports?
How to write compliance findings clients understand
Clients do not know what a CIS Benchmark, a GPO or a conditional access policy is. Write each client-visible finding in three parts:
- Summary. "USB storage devices can be used on company laptops."
- Business impact. "Company data can be copied to a personal drive and lost or taken."
- Remediation. "We will block USB storage by policy, with exceptions for approved staff, by the end of next month."
The same structure works for frameworks with legal weight, such as NIS2. See How can MSPs help clients prepare for NIS2?
Don't overstate what a score means
A compliance score summarises the checks that were assessed. It is not a certification, and a high score does not mean a client meets a regulation. Say which standard the checks come from, when they were last assessed, and what is out of scope. Public guidance such as the CIS Benchmarks describes recommended configurations; whether a client is compliant with a law or contract is a question for the client and their advisers.
How MSPortal shows clients their compliance status
In MSPortal, Compliance sits in the client's branded portal next to their tickets and reports:
- What clients see. Their score and A to F grade, pass and fail counts, overdue checks, public notes, shared files and any risks you approve for them. Private notes are never shown to client users.
- What you control. You can keep a run internal with "Hide from company users", and you choose per risk whether it is visible to the client. If you give a client role write access, those users can update check status and upload evidence.
- Where checks come from. Import CIS Benchmarks by product, NIS2, CAN/DGSI 104 and best-practice playbooks, build your own checks, or describe what to check and have AI draft checks for your review. Runs can be scheduled to repeat.
- Client-ready notes. The AI Draft button turns private notes into a public note with Summary, Business Impact and Remediation sections. It saves straight into the client-visible notes, so review and edit it before clients rely on it.
- From gap to fix. Open a ticket or Planner item from a failed check, or add it to a risk register with likelihood, impact, owner and treatment plan.
- In reports. Compliance blocks cover score, breakdown by group, progress over time and non-compliance items, and scheduled reports can wait for your approval before they send.
- Multiple locations. A permitted parent company user can include child companies in the view, so a client with several sites sees each one from one login.
With a Liongard integration, linked metrics update matching checks automatically. The Compliance documentation explains what company users can read and change. To see a sample client's compliance dashboard, book a demo.
Related questions
Should clients see failed compliance checks?
Usually yes, once the finding is verified and written in plain language with a remediation plan. Hiding failures makes the score look better but leaves clients unprepared when an auditor or insurer asks. Keep unverified findings internal until they are confirmed.
Does a compliance score mean a client is certified?
No. A score summarises the checks that were assessed against the standard you chose. Certification and legal compliance are decided by auditors, regulators or contracts, not by a portal score.
How often should an MSP reassess client compliance?
On a regular schedule that matches the client's risk and obligations, often quarterly or at least yearly, plus after major changes. Scheduled assessment runs keep results current without relying on someone remembering.
How do MSPs use CIS Benchmarks with clients?
They pick the benchmarks that match the client's systems, assess each recommended setting, fix gaps in a tested way, and report progress in plain language. See How do MSPs use CIS Benchmarks with clients?