Most businesses choose an IT provider based on reputation, a few references and a good feeling in the first meeting. Then they hand over the keys: admin credentials, the security tools, the backups and remote access to every machine.
That's a lot of trust to place on a good feeling.
We started working towards the Assurix trustmark in August 2026. This post covers why we started, where we've got to, and why I think the rest of the industry is heading the same way, whether it likes it or not.
The uncomfortable bit
An MSP is one of the most attractive targets in any client's supply chain. Compromise one provider and you may have a route into dozens of businesses. Attackers worked that out a long time ago. The Kaseya attack in 2021 reached around 1,500 businesses through their IT providers. Closer to home, the 2022 ransomware attack on Advanced, a software and managed service supplier, disrupted NHS 111.
That's an awkward thing for an MSP to write. It's also true, and pretending otherwise doesn't help anyone.
The government is catching up
The Cyber Security and Resilience Bill was introduced in November 2025. It cleared the House of Lords at the start of November 2026 and is now back in the Commons, where MPs are working through the Lords' amendments before Royal Assent.
For the first time, medium and large managed service providers will be regulated directly, with the Information Commissioner's Office as regulator. In practice that means:
- Putting appropriate, proportionate security measures in place.
- Reporting significant incidents within 24 hours, with a full report within 72.
- Telling the customers likely to have been affected.
- Fines of up to £17 million or 4% of global turnover for the most serious failures.
A lot of the detail, including exactly which MSPs are in scope, will come through secondary legislation. The real deadlines are likely to be 2027 into 2028. That sounds like plenty of time, but anyone who has run a compliance project knows it isn't.
Why it matters even if you're not in scope
Depending on where the thresholds land, plenty of smaller MSPs won't be regulated directly. I don't think that changes much.
Regulated organisations will be expected to manage the risk in their supply chains. That means asking their suppliers to evidence their controls. Insurers are already asking harder questions at renewal. "Trust us, we're good" is going to stop working as an answer, and I'd rather be ready before a client has to ask. It's the same pattern we wrote about with the Cyber Resilience Pledge: requirements set for large organisations travel down the supply chain.
Why we didn't stop at certificates
We hold Cyber Essentials, and ISO 27001 has its place. Both have the same weakness: they show you met a standard on the day you were assessed. A lot can drift in the eleven months between audits, and nobody outside the business would know.
Why Assurix
Assurix is an independent trustmark for UK MSPs. It assesses 59 controls across three areas:
- Cyber security, aligned to the NCSC Cyber Assessment Framework 4.0.
- Operational maturity: SLAs, patching, change control and how tickets are handled.
- Business resilience: continuity planning and supplier risk.
The difference is how it gets its evidence. It connects read-only to the tools an MSP uses every day and checks them continuously, instead of the provider filling in a form once a year. If a control falls out of tolerance, there are 30 days to fix it. If it isn't fixed, the trustmark is publicly suspended and the public directory shows it.
That last part focuses the mind. Letting a certificate quietly lapse is one thing. Being publicly suspended is quite another.
Where we are now
We're around 60% of the way there, and aiming to achieve the trustmark in early 2027. We've mapped our environment against all 59 controls and are working through the rest. You can see where we're up to on our Assurix directory listing.
The biggest change so far hasn't been technical. Awareness has gone up across the whole business, including people in non-technical roles. Everyone understands why doing the right thing for our clients has to happen every day, whether or not anyone is checking.
One thing I've learned so far: doing the work and proving you did the work are two quite different jobs. The second one involves a surprising number of spreadsheets.
What we've found so far
- Most gaps were in consistency and evidence, rather than missing tools.
- Some processes that "everyone just does" weren't written down anywhere.
What this means for our clients
- The work behind the trustmark is improving the service you get now, before accreditation.
- You can check our status yourself in the Assurix public directory, at any time. Once we achieve the trustmark, it will show there.
- If our standards slip, you'll see it. There's no quiet lapse.
- If you sit in a regulated supply chain, you'll have independent evidence for your own supplier assurance and insurance questions.
Five questions to ask your IT provider
Whoever looks after your IT, these are worth asking:
- What certifications do you hold, and when were you last assessed?
- How would we know if your standards slipped between audits?
- Do you expect to be in scope of the Cyber Security and Resilience Bill, and what are you doing about it?
- How quickly would you tell us about an incident affecting your own systems?
- Who has admin access to our environment, and how is it controlled and reviewed?
If any of those answers come back vague, that tells you something.
Common questions
Will MSPs be regulated in the UK?
Yes. Under the Cyber Security and Resilience Bill, medium and large managed service providers will be regulated directly for the first time, with the Information Commissioner's Office as regulator.
When will the new rules apply?
The Bill is close to Royal Assent. The detailed duties will follow through secondary legislation, likely from 2027 onwards.
What is Assurix?
Assurix is an independent UK trustmark for MSPs. It checks 59 controls continuously using live data from the provider's own tools, and publicly suspends providers who stay out of compliance for more than 30 days.
If you'd like to talk through where we're up to, or what the Bill could mean for your own supply chain, talk to us. You can also read more about why we're doing this.