Sapsiwai - Fotolia

MSPWorld: Regulations, emerging competitors shape the market

Speakers at MSPWorld pointed to an increasingly regulated environment as both an opportunity and risk for MSPs dealing with customers' data security and privacy issues.

ORLANDO, Fla. -- Managed service providers can look forward to a complex regulatory compliance environment, emerging MSP players and an evolving set of business opportunities, according to speakers at the MSPWorld conference, which wraps up today.

Charles Weaver, CEO of conference host MSPAlliance, based in Chico, Calif., said industry regulation has surfaced in a big way with the European Commission's General Data Protection Regulation (GDPR). The commission announced a political agreement on the regulation in December 2015, and enforcement is expected to begin in 2018. The GDPR provisions aim to give individuals easier access to their data; a right to data portability from one cloud service provider to another; a "right to be forgotten," which entails removing an individual's data from a service provider; and a right to breach notification.

Weaver called GDPR "one of the most aggressive direct and indirect regulatory schemes ever aimed at cloud and managed services." He noted that the regulation affects all European Union member states and every company doing business in Europe.

"If ... you have clients in the European Union, you will be subject to these laws," Weaver said.

But the regulation could have significant influence in North America, as well as companies conducting business in Europe.

"It impacts us here, because it provides a template for other governments to follow," Weaver said of GDPR. "Don't think that this isn't being watched by people in Ottawa or Washington. That is our concern. We don't want that to travel over here."

Dealing with regulation, in general, has become a fact of life for many of the industry's participants. The sweep of data security and privacy regulations covers not only traditionally regulated industries, such as financial services and healthcare, but also newer sectors, such as large car dealerships. The result creates opportunities for MSPs, but also increases risk.

Compliance work: Opportunity and risk

Robert Scott, managing partner of Scott & Scott LLP in Southlake, Texas, suggested the regulatory environment requires service providers to fundamentally rethink how they do business.

"We need to start shifting our perceptions of what our role is from keeping people working to keeping people working in a legally compliant manner," he said. Scott participated in a public policy panel discussion at MSPWorld.

But to help clients avoid data security and privacy problems, a service provider needs to become an expert in an industry's regulatory setting, Scott added. And that means focusing on a few verticals, as opposed to many.

"You've got to choose a handful" in which an MSP can develop a deep understanding.

Privacy and security concerns in the headlines are opportunities for us to sell against ... but we have to do so in a way that we manage our risk.
Robert Scottmanaging partner, Scott & Scott

Service providers who can delivery regulatory expertise in a particular vertical are seeing higher valuations, from a merger and acquisition perspective, than those that are not vertically focused, or vertically focused in a nonregulated industry, Scott noted.

But while the regulatory compliance specialization can boost an MSP, it can also introduce downside risk. Service providers that assume responsibility for a customer's compliance are on the hook if something goes wrong -- such as a data breach. And something will inevitably go wrong over the course of a customer relationship, Scott said.

"Privacy and security concerns in the headlines are opportunities for us to sell against ... but we have to do so in a way that we manage our risk," he said.

Scott said MSPs engaged in data privacy and security work should purchase professional liability insurance to help protect themselves.

Friends or foes?

Companies expanding into the managed services arena create another situation that can cut two ways: Are they rivals, or partners?

An MSPWorld presentation on the print and imaging industry showed how companies in that market space are growing their presence in managed services.

Brendan Morse, senior research analyst at InfoTrends, a market research firm in Weymouth, Mass., said diversification has become increasingly important in an industry in which revenue is flat, or slowly declining. Konica Minolta's acquisition of All Covered in 2011 and Ricoh's 2014 purchase of mindSHIFT Technologies underscore the print world's expansion into managed services. But those examples of office equipment OEMs building an MSP business aren't the whole story.

"This expansion is not limited to OEMs," Morse said. "Office equipment dealers have also embraced managed IT services."

Morse said 44% of office equipment dealers are offering managed services, versus 18% just a few years ago. Of those not currently offering managed services, 65% said they are considering entering the market.

David Ramos, director of channel strategy service at InfoTrends, said office equipment dealers have created steady annuity streams and enjoy healthy profit margins, which enable them to expand into new markets.

"They are looking for adjacent market opportunities that allow for them to grow," he said.

So, while the office equipment dealer's push into managed services may look like more competition, the movement could also provide an exit strategy for MSPs looking to sell. Ramos said dealers could also open up MSP partnering opportunities. He said he has spoken with office equipment dealers who have gone the acquisition route and detected some regret.

"They will tell you, if they had to do it again, they would partner," Ramos said.

MSPWorld: Potential MSP markets

Weaver, meanwhile, outlined MSP business opportunities that could emerge over the next four years. Those included:

  • The Internet of Things. Weaver called this technology category "a massive wildcard." He said MSPs could find a lucrative market among both business and even residential customers, as homes have more devices -- from security cameras to refrigerators tethered to the Internet.
  • Shutdowns, turnarounds and outages. Also known as STO, this field refers to the planned or unplanned outages in industrial facilities, according to Weaver. He suggested utilities and industrial firms need help with their supervisory control and data acquisition (SCADA) systems, which control equipment. He said government and law enforcement are concerned that SCADA systems may be vulnerable to cybercriminals or terrorists. Weaver said organizations with SCADA systems are in desperate need for better IT support.
  • Other areas of note -- social media monitoring for celebrities and sports personalities, identity and access management, mobility services, and hybrid and private clouds.

Next Steps

Learn how MSPs create a sales and marketing strategy

Read about the MSPAlliance's MSP/Cloud Verify certification

Find out about the issues involved in creating the ideal MSP business mix

Dig Deeper on Regulatory compliance with cybersecurity laws and regulations