What do our certifications really mean?

Hayley Mollett, our head of marketing, recently caught up with our Policies Manager to ask why we bother with all these certifications and why they matter in an industry that isn’t even regulated. 

Seeing that I’d instantly hit a nerve, he replied, “You know, what I find daunting sometimes is just how much sensitive data MSPs are expected to look after, and yet there’s no law saying we have to do it properly. Your IT partner has access to customer information, financial systems, operational tools, the lot. And most people don’t realise there’s no formal requirement for MSPs to meet any security or accountability standards.” 

“That gap is exactly what puts businesses at risk. Unregulated providers often operate without proper processes, clear documentation, or consistent security controls. If they get compromised, attackers can access every client they support. It’s why cyber criminals see MSPs as such a tempting target. GDPR and other frameworks expect businesses to actively protect data, but if your MSP isn’t taking security seriously, it’s your business on the line, not theirs.” 

When I asked him how Better-IT deals with that, he said, “We’ve chosen to voluntarily meet recognised security and quality standards because guessing isn’t good enough. Cyber Essentials Plus, for example, is far more than a tick-box exercise. CE Basic is self-assessed, which means anyone could technically pass it without properly implementing the controls. We see that a lot, companies pass on paper but still don’t have consistent monitoring or secure configurations in place. CE Plus is different. It involves real, hands-on auditing. Controls are tested and verified. That’s what gives clients confidence, and honestly, it keeps us honest too.” 

After we recently renewed our ISO certifications, I asked Paul what this means for Better-IT and its clients.  

“ISO 27001 is the global benchmark for information security,” he said. “It’s not just a policy on a shelf. It forces you to define, test, and continually improve how you manage access, incidents, suppliers, assets, and monitoring. For our clients, that means their data isn’t just being looked after, it’s being looked after properly.” 

“And ISO 9001,” he added, “keeps us sharp on quality. It makes sure our processes are clear, documented, and regularly reviewed. That way, every client gets the same high-quality service, and we can spot issues before they become problems. Together, ISO 27001 and ISO 9001 give us a real framework for accountability and continual improvement. They make sure our security and quality processes aren’t just random or based on good intentions.” 

Why does it matter?

Finally, I asked him why it matters for clients choosing an MSP. He said, “Look, being regulated doesn’t make anyone perfect. Nothing in cybersecurity does. But when a provider voluntarily takes on external audits and higher standards, they’re signalling that they take security and compliance seriously. For clients, it’s a strong indicator that you’re starting with someone committed to doing the right thing, not someone hoping nothing goes wrong. It’s the baseline, but it’s an important one.” 

Next on our list is revalidating Cyber Essentials Plus. This is the part that really proves our security controls work in practice, not just on paper. It’s not just a tick-box exercise. Everything we’ve put in place is independently tested and verified, showing exactly what we say we do is exactly what we do. In an industry that isn’t regulated, you really can’t be taking any risks.