Straight from Blacksmith: Listen to our discussion about these topics on Get NIST-y!
When compliance goes sideways, it rarely does it quietly. For MSPs, a single “helpful” answer on an insurance form or a fuzzy interpretation of MFA can turn into real liability when something breaks — and that is exactly what this episode of Get NIST‑y digs into.
Why MSPs should not “help” too much with cyber insurance
Jared and Mike start with a scenario most MSPs know too well: a client forwards a cyber insurance questionnaire and says, “Can you just fill this out for us?”
They unpack why that innocent request is actually dangerous:
If you answer on the client’s behalf, you risk owning the accuracy of every checkbox — even for controls you do not manage or cannot verify.
In a breach, those answers become evidence. Bad or optimistic responses can be used to deny claims or drag the MSP into the line of fire.
There is a better approach: help clients understand the questions, provide factual, scoped information about what you do manage, and clearly document where your responsibility ends.
If your team has ever argued about whether to “just knock out the form as a favor,” this segment is worth a listen.
How bad answers come back during a claim
The episode walks through how underwriters and breach coaches actually use these forms after an incident.
Key takeaways:
The insurance application is not a survey; it is a representation. When the answers don’t match reality, the carrier has leverage to limit or deny coverage.
“We thought our MSP had that covered” is not a defense. If your name is on the email trail or the form, you may be pulled into unpleasant conversations with lawyers and adjusters.
Helping clients means setting expectations early: who owns which controls, how evidence is maintained, and how you will support them without becoming the de facto guarantor of their compliance.
It is a pragmatic, real‑world conversation about protecting both the client and the MSP when things go wrong.
What MFA compliance really means (and doesn’t)
The second half of the episode tackles another thorny topic: what counts as “MFA compliance” when frameworks like FTC Safeguards or cybersecurity policies talk about multi‑factor but do not spell out every edge case.
Jared and Mike dig into questions like:
Is VPN with MFA enough if internal systems are still single‑factor once you are on the network?
When data is sensitive, do you need MFA at the workstation, for file access, for admin actions — or all of the above?
How do you respond when the framework language is vague, but attackers are not?
Instead of hand‑wavy “MFA everywhere” advice, they explore how to align real‑world architectures with the spirit of the requirement and how to document your decisions so they stand up later.
When compensating controls and risk acceptance make sense
Not every client can rip and replace their stack to satisfy a perfect interpretation of a control. The episode closes with a practical discussion of:
Where compensating controls are reasonable — log monitoring, segmented access, strong endpoint controls — when ideal MFA is not immediately possible.
How to use documented risk acceptance so clients can make informed trade‑offs, and MSPs are not silently carrying the risk on their own shoulders.
Ways to talk about these trade‑offs without sounding like a lawyer or a fearmonger.
If you are navigating messy frameworks, imperfect environments, and clients who want “simple answers” to complex compliance questions, this episode is a tight, 20‑minute masterclass in staying helpful without becoming the fall guy.
Listen to the full episode to hear the specific scenarios, language you can borrow for your own client conversations, and a few cautionary tales you will want your whole team to hear.