{"id":41335,"date":"2020-08-26T06:17:01","date_gmt":"2020-08-26T13:17:01","guid":{"rendered":"https:\/\/www.enxmag.com\/twii\/?p=41335"},"modified":"2020-08-26T06:17:46","modified_gmt":"2020-08-26T13:17:46","slug":"cybersecurity-is-a-process-not-a-product-what-to-consider-when-building-your-offering","status":"publish","type":"post","link":"https:\/\/www.enxmag.com\/twii\/building-mssp\/2020\/08\/cybersecurity-is-a-process-not-a-product-what-to-consider-when-building-your-offering\/","title":{"rendered":"Cybersecurity Is a Process, Not a Product: What to Consider When Building Your Offering"},"content":{"rendered":"\n<p><strong>You\u2019ve decided to offer cybersecurity services, but aren\u2019t sure where to start. Unfortunately, you won\u2019t find one list that everybody agrees, or that shows which products and services should be included. Many people have differing opinions on cybersecurity, and that\u2019s OK.<\/strong><\/p>\n\n\n\n<p>Cybersecurity is a process, not a product. The approach we take at Collabrance is based on a constantly changing landscape. Successful managed service providers (MSPs) are more focused on the holistic IT solution than any one product you may be providing.<\/p>\n\n\n\n<p>To build our managed security service provider (MSSP) offering, we used the National Institute of Standards and Technology (NIST) Framework to help guide us to outcomes that focus on the end user\u2019s cybersecurity needs. Although much of the managed services industry is unregulated, the federal government does have guidelines that are embodied in the Framework, which NIST describes on its website:<\/p>\n\n\n\n<p><strong><em>What is the Framework, and what is it designed to accomplish?<\/em><\/strong><\/p>\n\n\n\n<p><em>The Framework is voluntary guidance, based on existing standards, guidelines and practices for organizations to better manage and reduce cyber cybersecurity risk. In addition to helping organizations manage and reduce risks, it was designed to foster risk and cyber cybersecurity management communications amongst both internal and external organizational stakeholders.<\/em><\/p>\n\n\n\n<p><strong><em>Is my organization required to use the Framework?<\/em><\/strong><\/p>\n\n\n\n<p><em>No. Use of the Framework is voluntary. <\/em><\/p>\n\n\n\n<p>Even though the Framework is not law today, smart money is betting that, in the future, some or all of it could eventually become law. Progressive IT service providers are already aware of this and keep it top of mind.<\/p>\n\n\n\n<p class=\"has-text-color has-vivid-cyan-blue-color\"><strong>To what extend should you outsource?<\/strong><\/p>\n\n\n\n<p>When it comes to cybersecurity, keeping up with the demands of the market is nearly impossible to do on your own. No reseller has the money or expertise to do it all. Every time an issue comes up, you need to decide whether to build what you need, buy it or outsource it. With that in mind, here are a few best practices you can implement to help your organization keep pace. <\/p>\n\n\n\n<p class=\"has-text-color has-vivid-cyan-blue-color\"><strong>Have an Evolving Road Map<\/strong><\/p>\n\n\n\n<p>You need to make someone responsible for the technology road map in your organization. You have your current IT stack that needs to be monitored, but you also need to keep a constant eye to the future and adjust accordingly. You should have built an IT priority list of short-, medium- and long-term needs that stays top of mind with everyone in the organization. This means your technology road map needs to be fluid. Just because it looked a certain way five months ago, that doesn\u2019t mean the priorities can never change. MSPs must be agile enough to make adjustments and keep moving forward.<\/p>\n\n\n\n<p class=\"has-text-color has-vivid-cyan-blue-color\"><strong>Vet Constantly<\/strong><\/p>\n\n\n\n<p>Many people don\u2019t realize cybersecurity is a full-time job. The number of IT needs your customers have, combined with more-sophisticated competitors in the marketplace, means you need to have someone fully dedicated to vetting potential solutions for things such as: <\/p>\n\n\n\n<ul class=\"style1List\"><li>Technical ability<\/li><li> Support acumen<\/li><li> Current stack alignment<\/li><li> Price vs. value<\/li><li> Tenure<\/li><li> Financial health<\/li><li> Ownership structure<\/li><\/ul>\n\n\n\n<p>If you don\u2019t have someone whose job it is to vet technology solutions, I strongly suggest you partner with someone who does have this capability.<\/p>\n\n\n\n<p class=\"has-text-color has-vivid-cyan-blue-color\"><strong>Keep Your Finger on the Pulse<\/strong><\/p>\n\n\n\n<p>You must stay close to your customers and know what is happening in the IT channel to help stay ahead of the \u201cbad guys.\u201d This positions you as a leader and not a laggard in your market from a competitive perspective. MSPs who have made the transition into cybersecurity offerings have adjusted their approach to be in the business of risk mitigation rather than information technology.<\/p>\n\n\n\n<p><strong>What Should You Do Next?<\/strong><\/p>\n\n\n\n<ol class=\"style1List\"><li>Look at the NIST Framework, and evaluate if you meet all the demands.<br> a. If you do, you\u2019re ahead of most providers\u2014good job!<br> b. If not, see #2 <\/li><li>To fill the NIST gaps you can\u2019t meet, you must decide if you want to:<br> a. Build it<br> b. Buy it <br> c. Partner up<\/li><li>If you picked 2a, do you have the time and money to get it in the market quickly?<\/li><li>If you picked 2b, look at the rest of your gaps; do you have the resources to buy the technology in order to own the solution? This is VERY expensive today, as cybersecurity multiples are constantly soaring.<\/li><li>If you want to have rock solid cybersecurity offering TODAY with minimal investment, I suggest you outsource and partner.<\/li><\/ol>\n\n\n\n<p>Your customers demand and deserve the best you can offer. To help maximize your profitability and reduce your risk, partnering can help you achieve your goals while at the same time delivering excellence to your customer. <\/p>\n\n\n\n<p class=\"has-text-color has-vivid-cyan-blue-color\"><strong>Collabrance White-Label MSP &amp; MSSP Solutions<\/strong><\/p>\n\n\n\n<p>It would be worth your time to compare your offerings. Today we make a distinction between MSP and MSSP. In the future, my hunch is the MSSP offering will be considered table stakes. I believe the expectation of the customers will continue to rise, so your cybersecurity IT solution must adapt to remain relevant and be successful. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>You\u2019ve decided to offer cybersecurity services, but aren\u2019t sure where to start. Unfortunately, you won\u2019t find one list that everybody agrees, or that shows which products and services should be included. Many people have differing opinions on cybersecurity, and that\u2019s OK. Cybersecurity is a process, not a product. The approach we take at Collabrance is based on a constantly changing landscape. Successful managed service providers (MSPs) are more focused on the holistic IT solution than any one product you may be providing. To build our managed security service provider (MSSP) offering, we used the National Institute of Standards and Technology (NIST) Framework to help guide us to outcomes that focus on the end user\u2019s cybersecurity needs. Although much of the managed services industry is unregulated, the federal government does have guidelines that are embodied in the Framework, which NIST describes on its website: What is the Framework, and what is it designed to accomplish? The Framework is voluntary guidance, based on existing standards, guidelines and practices for organizations to better manage and reduce cyber cybersecurity risk. In addition to helping organizations manage and reduce risks, it was designed to foster risk and cyber cybersecurity management communications amongst both internal and external organizational stakeholders. Is my organization required to use the Framework? No. Use of the Framework is voluntary. Even though the Framework is not law today, smart money is betting that, in the future, some or all of it could eventually become law. Progressive IT service providers are already aware of this and keep it top of mind. To what extend should you outsource? When it comes to cybersecurity, keeping up with the demands of the market is nearly impossible to do on your own. No reseller has the money or expertise to do it all. Every time an issue comes up, you need to decide whether to build what you need, buy it or outsource it. With that in mind, here are a few best practices you can implement to help your organization keep pace. Have an Evolving Road Map You need to make someone responsible for the technology road map in your organization. You have your current IT stack that needs to be monitored, but you also need to keep a constant eye to the future and adjust accordingly. You should have built an IT priority list of short-, medium- and long-term needs that stays top of mind with everyone in the organization. This means your technology road map needs to be fluid. Just because it looked a certain way five months ago, that doesn\u2019t mean the priorities can never change. MSPs must be agile enough to make adjustments and keep moving forward. Vet Constantly Many people don\u2019t realize cybersecurity is a full-time job. The number of IT needs your customers have, combined with more-sophisticated competitors in the marketplace, means you need to have someone fully dedicated to vetting potential solutions for things such as: Technical ability Support acumen Current stack alignment Price vs. value Tenure Financial health Ownership structure If you don\u2019t have someone whose job it is to vet technology solutions, I strongly suggest you partner with someone who does have this capability. Keep Your Finger on the Pulse You must stay close to your customers and know what is happening in the IT channel to help stay ahead of the \u201cbad guys.\u201d This positions you as a leader and not a laggard in your market from a competitive perspective. MSPs who have made the transition into cybersecurity offerings have adjusted their approach to be in the business of risk mitigation rather than information technology. What Should You Do Next? Look at the NIST Framework, and evaluate if you meet all the demands. a. If you do, you\u2019re ahead of most providers\u2014good job! b. If not, see #2 To fill the NIST gaps you can\u2019t meet, you must decide if you want to: a. Build it b. Buy it c. Partner up If you picked 2a, do you have the time and money to get it in the market quickly? If you picked 2b, look at the rest of your gaps; do you have the resources to buy the technology in order to own the solution? This is VERY expensive today, as cybersecurity multiples are constantly soaring. If you want to have rock solid cybersecurity offering TODAY with minimal investment, I suggest you outsource and partner. Your customers demand and deserve the best you can offer. To help maximize your profitability and reduce your risk, partnering can help you achieve your goals while at the same time delivering excellence to your customer. Collabrance White-Label MSP &amp; MSSP Solutions It would be worth your time to compare your offerings. Today we make a distinction between MSP and MSSP. In the future, my hunch is the MSSP offering will be considered table stakes. I believe the expectation of the customers will continue to rise, so your cybersecurity IT solution must adapt to remain relevant and be successful.<\/p>\n","protected":false},"author":244,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3867],"tags":[],"_links":{"self":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/41335"}],"collection":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/users\/244"}],"replies":[{"embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/comments?post=41335"}],"version-history":[{"count":3,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/41335\/revisions"}],"predecessor-version":[{"id":41338,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/41335\/revisions\/41338"}],"wp:attachment":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/media?parent=41335"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/categories?post=41335"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/tags?post=41335"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}