“Are you compliant with anything?” is a dead question. It gets a shrug and ends the call. What moves is finding the third party who is asking and the date they want an answer by, because that’s the only version of compliance a business owner can’t put off.
Compliance is the strongest opening a managed IT provider has, and most of them waste it in one sentence. The owner is asked whether they’re compliant, says something close to we’re fine, we’re not a bank, and the conversation moves to backups.
The owner isn’t lying. They genuinely don’t know, because nobody has ever told them what applies to a business like theirs, and nothing has forced the question yet.
Your job on the first call is to find out whether something has. Not to assess an environment you haven’t seen. To find the person with the deadline.
In short
- Owners defer anything abstract. A named third party with a date isn’t abstract.
- Those questions find the third party: the insurer, the customer, the contract, and the auditor.
- Plenty of ordinary businesses are covered by rules they have never heard of, because the rules go by what a company does and not by what it calls itself.
Why the direct question fails
You’re asking the owner to grade themselves on a subject they have no way to grade themselves on. The honest answer is I have no idea. Almost nobody says that to a stranger who is selling something, so they say they’re fine. Being fine is now a position they have taken out loud.
The second problem is that compliance with nothing in particular has no date on it. An owner running a company with fifty employees defers everything without a date, because that is how the week works.
So stop asking about the state of the business and start asking about who has been asking them questions. Somebody almost always has.
The questions that find the deadline
01
“When does your cyber insurance renew?”
The renewal questionnaire is the most reliable deadline in this whole category. It arrives on a fixed date, it asks specific yes-or-no questions, and somebody has to sign it. Ask who fills it in and whether last year’s answers were all yes.
02
“Has a customer sent you a security questionnaire?”
When a larger customer starts vetting vendors, the deadline belongs to somebody whose business your prospect can’t afford to lose. That’s a different kind of urgency than a regulation nobody is enforcing this month.
03
“What does your biggest contract say about data?”
Most owners have never read that clause. Some of them have signed obligations their systems don’t meet. Asking is free, and finding one is worth more than any assessment you could offer to run.
04
“Who audits you, and when were you last audited?”
An accountant, a franchisor, a licensing body, a payer. The answer names a party with authority and a cycle, and cycles are dates you can work backward from.
None of them ask the owner to assess anything. Every one is about somebody else, which is why people answer them honestly.
Businesses that do not know a rule applies to them
Sometimes all four answers come back empty and there’s still an obligation sitting on the business. The clearest case is the Federal Trade Commission’s Safeguards Rule. It covers far more companies than the phrase financial institution suggests.
The FTC says so plainly. The Rule defines financial institution “in a way that’s broader than how people may use that phrase in conversation”, and adds that “what matters are the types of activities your business undertakes, not how you or others categorize your company.”
The Rule lists thirteen examples of covered entities. Among them: mortgage brokers, collection agencies, tax preparation firms, check cashers, account servicers, credit counselors and other financial advisors, and investment advisors not required to register with the SEC. None of those businesses describes itself as a financial institution over coffee.
What the Rule requires is concrete enough to use on a call. Designate a qualified individual to run the information security program. Produce a risk assessment, in writing. Turn on multi-factor sign-in for anyone who touches customer information. All three are checkable, and all three are frequently missing.
A tax preparation firm that has never heard of the Safeguards Rule, whose email has no multi-factor sign-in, is a real conversation. It’s also one nobody else has had with them.
Get the first call booked
Abstrakt sets appointments with the owners, controllers, and operations managers who decide on managed IT, so your engineers spend their time on assessments instead of on lists. The call, the scope, and the contract are yours.
What to do with the answer
| What you heard | What it means | The next move |
|---|---|---|
| A renewal date, and last year’s answers were guesses | A signature is coming on a document somebody can’t support | Offer to walk the questionnaire with them before it’s due |
| A customer questionnaire arrived and stalled | Revenue is attached to the deadline | Ask to see the questionnaire, not the network |
| Nobody has asked anything | No deadline exists yet, so nothing will move on urgency | Check whether a rule applies anyway, and leave the date you’ll call back |
| “Our IT person handles all that” | Possibly true, and worth one specific follow-up | Ask who signed the last insurance questionnaire |
The first row is the best meeting in managed IT. An owner facing a form they can’t answer honestly, with a date on it, will make time for somebody offering to go through it with them. That’s not an assessment, and it doesn’t have to be free work. It’s a short session that produces a scope everybody agrees on.
When compliance is not the way in
Some businesses have nothing regulated about them. No meaningful contracts, no insurer asking hard questions, no customer big enough to vet them. Push compliance there and you’re talking about something the owner correctly judges not to matter. That costs you the credibility you needed for the conversation that would have worked.
Ask all of them, get nothing back, and move to what is actually breaking. Compliance is a door, not a script, and using it on a building with no lock on that door makes you sound like every vendor who has ever tried to frighten somebody into a contract.
See it in your market
Abstrakt books the conversations with the people who decide on managed IT. You run the assessment and write the number.
What better security lets them do
- Win customers that vet their vendors. Large customers send a security questionnaire before they will buy, and in some industries it is not optional. A company doing defense work has to meet the federal NIST 800-171 controls and keep a self-assessment score on file to be awarded contracts. Anyone handling patient data signs a HIPAA business associate agreement and is accountable under it. Anyone taking card payments answers to PCI DSS, which the card brands enforce through the processor. Enterprise buyers in any industry often ask a vendor for a SOC 2 report. Every one of those is a customer the owner cannot win without the controls behind it.
- Qualify for cyber insurance. Carriers ask specific yes-or-no questions before they will write or renew a policy: multifactor authentication, backups held off the network, monitoring on endpoints, how quickly patches go on. An owner answering no to those has a renewal problem arriving on a date somebody else picked.
- Pass the audits they already sit through. Most of these businesses get reviewed once a year by an accountant, a franchisor, a licensing body or an insurer. Documented access control and logs turn that review from a week of scrambling into a morning.
- Keep the business running. One compromised mailbox or one lost laptop can stop invoicing, scheduling and payroll. This is the only item on the list most owners have already lived through, which makes it the easiest one to open with.
Managed service provider lead generation, in practice
Compliance gives you a reason to call. It does not give you anyone to call, and that is the part most providers are short of.
Managed service provider lead generation usually comes down to reaching owners and operations leaders before anything has gone wrong, because once it has, they are already on the phone to somebody. That means consistent contact over months with businesses that are not looking for you yet.
It is unglamorous work and it is the first thing to slip when the service desk is busy, which is why so many providers grow on referrals and then stall when the referrals slow down.
Frequently Asked Questions
How do managed service providers find new clients?
Mostly through direct contact with owners and operations leaders before a problem forces the issue. Referrals fill a schedule but they are unpredictable in timing, so providers that grow steadily usually run outbound alongside them.
Is cold calling still worth it for an MSP?
It still works for this buyer, because facility and property managers are reachable by phone and rarely respond to email from companies they do not know. What has changed is that it takes consistent volume over months, which is where most providers run out of time.
Should an MSP hire a salesperson or outsource appointment setting?
The in-house comparison is not a salary against a retainer. It is salary plus payroll taxes, benefits, software, ramp time and somebody to manage them. Outsourcing trades that for a fixed monthly cost and a faster start. Which is right depends on whether you can keep a salesperson busy and managed.
Keep going
- Why your number should be in the budget before the proposal
- What to say when they already have an IT provider
- Comparing MSP lead generation agencies
- Outsourced SDR services
- Cold calling services
About this article
Jeff Winters is Chief Executive Officer at Abstrakt. Reviewed by Neil Erker, Chief Marketing Officer. Abstrakt sets appointments for managed IT providers and commercial contractors across the trades, and the patterns here come from that calling.
Jeff Winters is the CEO of Abstrakt Marketing Group, a U.S.-based B2B lead generation and appointment-setting company that books qualified sales meetings for clients across the commercial trades, IT and managed services, manufacturing, and B2B services. He has spent his career building and running outbound sales programs at scale, and he breaks down what actually works in sales and lead generation on Abstrakt's podcast, The Grow Show.
