What should an MSP do if a client refuses to pay for security?
Put the risk and the client's decision in writing, keep the basics you can, and do not quietly take responsibility for what they declined. Explain in plain terms what could happen without the measure, such as days without systems after ransomware, and what it would cost compared with the measure. Offer a smaller first step. If the client still says no, send a short written summary of the recommendation and their decision, and keep it. That record protects you if something happens. For network detection, the cost argument can disappear: the NetSenX Free plan covers 3 devices with no time limit, so a small client can start without a licence fee, while you agree how much of your time is included.
Read next
Related questions
- When my customer falls under NIS2, does the MSP fall under it too?
- What is in a NIS2 supplier questionnaire, and how do I answer it?
- What NIS2 evidence can an MSP give its clients every quarter?
- How can an MSP give clients incident evidence quickly?
- Does an EU MSP need an EU-hosted security vendor for its clients?