ScalePad presents its second-annual MSP Trends Report exploring the top trends of 2025 based on a survey of 1300+ MSPs. Find out how high-performers are navigating customer success this year.
From awareness to assurance: Key compliance framework changes coming in 2026
6 minute read
October 1, 2025
Mike Vipond
October is Cybersecurity Awareness Month. This is a time for MSPs to double down on security conversations with their clients. But awareness alone isn’t enough. As an MSP, it’s your responsibility to proactively address these compliance framework changes with clients.
In this article, you will learn:
The real-world impact of compliance changes on 4 critical compliance frameworks: CMMC 2.0, NIS2, HIPAA, and GTIA Cybersecurity Trustmark
Additional changes coming to major compliance frameworks in late 2025 and throughout 2026 (including a downloadable reference chart)
How to address these changes with your clients and your team
Upcoming compliance framework changes pose a new cybersecurity challenge for MSPs and clients. According to ConnectWise’ latest report on The State of SMB Cybersecurity in 2025, over half (57%) of small businesses now rank cybersecurity as their top business priority, up from 43% in 2024. And despite relying on MSPs for cybersecurity support, 73% of small businesses aren’t confident their provider can defend them in an attack.
Cybersecurity Awareness Month is your opportunity to change that sentiment.
The cyber threat landscape is evolving, and so are the compliance frameworks designed to manage those risks. Several critical frameworks will undergo major changes between now and mid-2026.
If MSPs and their clients don’t adapt, they risk increased exposure to breaches and the possibility of losing contracts, clients, or regulatory standing due to non-compliance.
That’s why our theme for the month is “Go from Awareness to Assurance.”
Awareness involves tracking upcoming changes, training your team, understanding threats, and fostering a security-first mindset. It’s all about building a solid cybersecurity foundation.
Assurance is the next step — the evidence, systems, and processes that prove your cybersecurity program works. It’s compliance backed by audit-ready documentation. Compliance assurance is how you help your clients win contracts, pass audits, and gain trust. This article is your checkpoint for the year ahead, focusing on four major frameworks with significant upcoming changes:
The Cybersecurity Maturity Model Certification (CMMC 2.0) is no longer a “future” requirement. It’s already reshaping how contractors in the Defense Industrial Base supply chain do business with the U.S. Department of Defense (recently renamed to the Department of War) and other federal entities. Phase 1 of 3 begins November 2025, when organizations handling Controlled Unclassified Information (CUI) must meet specific NIST SP 800-171 controls and prove it through assessments. This is not optional.
What’s changing:
Mandatory third-party assessments for Level 2 contractors
Expansion beyond the DoD to other federal departments, partner nations, and global defense projects
Real revenue impact: non-compliant companies will be disqualified from contracts
If your clients work with federal agencies, they’ve already heard about CMMC. But many don’t realize the magnitude of effort required to get compliant. MSPs can support by stepping in as compliance project managers, helping clients scope, plan, and implement the right controls.
ControlMap Compliance Health Score
ControlMap is fully aligned with CMMC and NIST 800-171 — it’s an end-to-end compliance platform that provides automated evidence collection, role-based task assignments, and audit-ready reporting. These functions make it easier for MSPs to support clients through the full CMMC journey.
NIS2: Europe’s expanding cybersecurity net
Key deadline: October 2024 (transposition), full effect in 2025-2026 Impact: All EU member states + cross-border companies
If CMMC is the U.S. government’s cybersecurity escalation, NIS2 (in addition to DORA) is the EU’s answer. The Network and Information Security Directive 2.0 dramatically expands the scope of cybersecurity regulation in Europe — covering thousands of essential and important entities across sectors like energy, finance, healthcare, IT, and managed services.
What’s changing:
NIS2 applies to any company that offers critical digital services in the EU
Stronger enforcement, breach reporting, and liability for non-compliance
Supply chain security and governance controls are front and center
If your clients operate in or serve the EU, NIS2 will impact operations, even if they aren’t headquartered in Europe. As the compliance burden grows, clients will need clear cybersecurity roadmaps that align with evolving EU expectations.
ControlMap supports compliance frameworks that map to NIS2 requirements, including ISO 27001 and NIST CSF. With the platform, MSPs can manage multiple frameworks in parallel, assign responsibilities across client teams, and centralize audit documentation — all in one place.
HIPAA: A sleeping giant about to wake up
Key change: Security Rule updates expected by late 2025 or early 2026 Impact: All U.S. healthcare organizations and their vendors
For years, HIPAA has been seen as a static standard. But that’s about to change. Proposed updates to the HIPAA Security Rule aim to modernize the framework, remove ambiguity, and raise the bar on areas like encryption, access controls, incident response, and vendor management.
What’s changing:
Removal of "addressable" vs "required" safeguards — everything becomes enforceable
Written inventories, updated risk assessments, stronger encryption, and MFA will likely become mandatory
Potential for larger fines and increased audits
While HIPAA isn’t about winning contracts, it’s absolutely about keeping them. One breach can destroy credibility, damage client relationships, and trigger federal enforcement. Forward-thinking MSPs are advising healthcare clients to prepare now, before the rule becomes final.
ControlMap Compliance Health Report
ControlMap gives MSPs a way to standardize HIPAA compliance management across multiple clients using prebuilt templates, real-time risk tracking, and documentation workflows that ensure audit readiness. That way, you can stay ahead of enforcement.
GTIA Cybersecurity Trustmark: Compliance for MSPs themselves
Key change: Program launched mid-2024, growing adoption expected in late 2025 and throughout 2026 Impact: MSPs across North America
The GTIA Cybersecurity Trustmark isn’t for your clients. It’s for you. Developed by CompTIA in partnership with the Global Trustmark Initiative Alliance (GTIA), it’s a third-party validation of how well you adhere to cybersecurity best practices.
Think of it as a CIS-based alternative to SOC 2 or ISO 27001. But it’s more attainable, tailored to MSPs, and focused on measurable cybersecurity controls.
What’s changing:
Covers ~90% of CIS Critical Security Controls
Becoming a signal of trust to partners, clients, and insurers
ControlMap is one of only three approved vendors supporting the framework
Clients are asking more challenging questions about vendor security, and they want proof to back it up. The GTIA Cybersecurity Trustmark is how you show them you're serious — not just about selling cybersecurity, but living it. It also positions you ahead of the pack as compliance expectations rise across the industry.
ControlMap is one of the few GTIA Cybersecurity Trustmark tool partners. It’s all about meeting the same standards you ask of your clients, enabling you to map, track, and demonstrate your compliance as an MSP.
When clients panic: How MSPs can handle urgent requests around compliance framework changes
As deadlines approach and regulations tighten, some clients will panic. Whether it’s a sudden contract requirement, an insurance audit, or realizing they’re months behind on compliance, MSPs need a game plan for responding fast.
Here’s how to manage urgent compliance needs:
Run a rapid gap assessment: Identify where the client stands today against the framework they’re suddenly worried about (e.g. CMMC, HIPAA, NIS2).
Scope down when necessary: Limit the scope of compliance to critical systems or departments to make quick progress.
Triage high-impact controls first: Start with “quick wins” like enforcing MFA, encrypting sensitive data, tightening access control, and updating vendor agreements.
Document everything: Even interim measures must be logged and justified. Regulators and auditors want to see progress and intent.
Use tools that accelerate evidence gathering: ControlMap automates documentation, task assignments, and audit readiness across various compliance frameworks, eliminating duplication of effort.
This is where MSPs can shine — not just by solving technical issues, but by calming chaos, focusing priorities, and providing clarity when clients need it most.
How MSPs can stay ahead of compliance framework changes
The best MSPs don’t wait for clients to ask — they lead the conversation. Cybersecurity Awareness Month is the perfect time to bring up the changes coming in 2026 and build a plan that turns awareness into action.
ControlMap New Assessment and Evidence Management
Here’s how to lead with confidence:
Call out the specific changes coming to relevant frameworks: Let clients know exactly which relevant frameworks are changing (and when). Don’t wait for them to get blindsided by a contract clause or audit trigger.
Explain the business impact: Make it clear that this is about contract eligibility, breach liability, insurability, and operational continuity.
Build a compliance roadmap: Offer clients a clear plan with milestones, timelines, budget guidance, and responsibilities across internal and MSP teams.
Position compliance as a differentiator: Proactive compliance protects clients, wins contracts, and improves their security maturity. Show them the value, then help them tell that story to customers, regulators, and insurers.
With ControlMap, MSPs can standardize these roadmaps across all clients, track progress, and deliver audit-ready assurance with less manual effort.
To keep track of upcoming framework changes, we put together a handy chart that breaks them down in chronological order. Download it below and keep it on your desk or in your slide decks for quick reference.
