When is ControlMap the better pick?
ControlMap is easy to start with, because you can see the price before you talk to anyone. The Free plan lets you assess each client against one framework, with 10 policies, 10 risks and 10 evidence items. ScalePad pitches it at MSPs "proving demand before launching a paid vCISO or CaaS motion" (ScalePad).
When a client is ready to pay, Essentials adds any one of 63+ frameworks for $99 a tenant. Pro, at $299, adds multi-framework management with crosswalks, automated evidence gathering and audit readiness tools.
When a client is ready to pay, Essentials adds any one of 63+ frameworks for $99 a tenant. Pro, at $299, adds multi-framework management with crosswalks, automated evidence gathering and audit readiness tools (ScalePad).
If your service is a vCISO program with regular client reviews, and you'd like to test demand before you commit, ControlMap's a good fit.
What does using Cyber Verify look like?
UCS (the Unified Certification Standard) is the standard: 72 requirements across 5 domains, with the full text free at mspalliance.com/ucs. UCS has been around since 2004. Cyber Verify launched in 2023 and uses it as the framework for its certification program.
Cyber Verify is the certification you earn against UCS, and the platform where you do the work, first for your own MSP and then for your clients. MSPAlliance runs the program. An independent audit firm, pre-approved by MSPAlliance, performs the audit.
Here's what you'll do, step by step:
Assess. You answer the guided assessment (CVAT). It takes under an hour and scores you across the 5 UCS domains (MSP Verify).
Fix. You get a gap list sorted by impact and effort, plus templates for missing policies. Most MSPs close their critical gaps in 60 to 120 days (MSP Verify).
Prove. You upload evidence, and your compliance sherpa reviews it before the auditor does.
Get certified. The audit is part of certification. You get a written report signed by the audit firm, plus a seal to use in marketing and sales. Most MSPs finish in three to six months, and you renew each year.
Add frameworks. Certification is the foundation for this step. SOC 2, ISO 27001, CMMC and others sit on the same platform and reuse the evidence you've collected. Each framework's auditor still decides what they'll accept.
Sell it to clients. Each client gets its own tenant and white-labeled reports. We bill you per client, and you set the client's price and bill them yourself. For client audits, we connect you to CPA firms, ISO registrars and C3PAOs, and that firm works under its own engagement with you or your client.
When is Cyber Verify the better pick?
ControlMap's Pro plan gets a client ready for an audit. Cyber Verify takes your own MSP through one.
That audit checks things a client framework doesn't ask of an MSP. UCS wants a written plan for handing a client to a new provider (requirement 02.08). It checks for signed MSAs and accurate invoices (09.01, 09.02). It even caps your largest client at 20% of managed services revenue, and your top five at 50% (10.02).
Prospects can't see any of that from outside, so the certification shows it for them. Mike Deskin, President of Dresner Group, put it this way:
“Cyber Verify separated us from the pack. We've won millions of dollars in contracts because of it.”
Once you're certified, the same assess, fix and prove steps become your client service, in a tenant per client.