Designing a good compliance engagement is less about adding more tasks and more about changing the shape of the work so clients feel like they are telling a story, not doing homework. Done well, that structure also makes your delivery more consistent and scalable as an MSP.

Why compliance feels like homework

Most clients experience compliance as a series of disconnected, high-friction requests: “Send this policy,” “Export that log,” “Upload this report.” The work is opaque, interrupt-driven, and easy to procrastinate because they cannot see how each ask fits into a bigger picture. For MSPs, that means stalled projects, weak evidence, and engagements that drag for months.

Blacksmith was built specifically to help MSPs operationalize compliance instead of running ad hoc projects: defined roadmaps, risk registers, and task workflows give you structure out of the box. That lets you reframe the whole effort from “complete these tasks” to “let’s build and maintain your security program together.”

From scavenger hunt to risk narrative

A risk narrative is a coherent story about what could go wrong, what is in place to prevent it, and what is left to fix. Instead of starting with an evidence checklist, you start with a conversation about risks and capabilities, then map evidence to that story.

Contrast the two modes:

• Scavenger hunt: “Upload your change management policy and three change tickets from last quarter.”

• Risk narrative: “Show how you keep production changes from surprising your customers, and how you would detect a bad change.”

Blacksmith’s roadmap and risk register give you a natural container for this narrative: each risk, control, and task is explicit, owned, and visible in one place. Monthly review meetings, like those Blacksmith facilitates for our partners, turn into storytelling sessions about risk posture instead of status meetings about homework.

(Likewise, offering choices for client engagement — i.e. how discussions/education surrounding compliance is carried out — is likely to yield positive outcomes. This article about Phillip Schlechty and the Center for Engagement’s research is about classrooms, but the principles are eerily aligned with what MSPs deal with when it comes to security and compliance.)

Structuring the engagement for momentum

You can make the engagement feel lighter without lowering the bar by designing an arc with clear, named phases. A simple pattern that works well for MSP-led programs:

• Discover: Clarify business context, applicable frameworks, and top risks; capture them in your compliance software as initial risks and requirements.

• Map: Link risks to controls and policies, generating a compliance roadmap your client can see and understand.

• Validate: Gather focused evidence, close gaps, and show progress in dashboards and reports.

• Operationalize: Shift from project to program with recurring tasks, monthly meetings, and continuous improvement.

Every client touchpoint should reinforce that arc. Short, themed sessions (e.g., “Access & Identity,” “Vendors & Data”) are easier to prepare for and process than sprawling, open-ended workshops. Each session starts with what you are trying to understand about risk, not with the list of artifacts you need.

Artifacts should feel like outputs clients want to reuse — risk maps, one-page summaries, prioritized roadmaps — rather than raw exports or spreadsheet dumps. In Blacksmith, the Compliance Roadmap and Risk Register already produce these kinds of artifacts by tying tasks to explicit risks and controls.

Follow-ups that feel like progress, not nagging

Follow-ups are where engagements either maintain momentum or turn into nagging. The trick is to make every request clearly connected to both a risk and a phase:

• “Once we close these three tasks, your identity and access story is complete for this cycle.”

• “This policy update is the last piece for getting your vendor risk area to green.”

Blacksmith’s multi-tenant dashboard, task assignments, and due dates make this visible: clients see what is left, who owns it, and how it affects their risk picture. Regular monthly meetings, like those run with CTS, use the platform’s views to show progress and focus on next steps instead of rehashing old work.

Where Blacksmith’s system removes friction

Treat Blacksmith as the operating system for your compliance engagements, not just a repository. Several capabilities directly cut the “homework” feeling:

• Centralized structure: A single multi-tenant dashboard to manage all programs, mirroring an EOS-style operating system discipline for security and compliance.

• Defined roadmaps: Automatically generated, trackable compliance roadmaps for each client show the path from today’s risk to tomorrow’s readiness.

• Evidence in context: Tasks and evidence live inside the roadmap and risk register, so clients always understand what an upload is “for.”

• Integrations: ConnectWise and other PSA integrations reduce duplicate work by letting technicians handle compliance tasks in tools they already use.

The result for clients is a guided journey with clear milestones, visuals that tell a risk story, and predictable meetings — rather than a pile of scattered requests. For partners, it is a repeatable engagement pattern you can run across dozens of clients without reinventing the process every time.