Can an MSP deliver CIS Controls work to clients?
Yes, but only under the right CIS membership. Delivering CIS Controls work to a client requires the SecureSuite Controls membership, priced at 3,600 US dollars a year, which includes CIS CSAT Pro for tracking each customer's implementation of the Controls. A SecureSuite End User membership cannot be used for client or commercial work, even though End User pricing carries multi-year discounts. Before signing a client, confirm with CIS which membership category covers your exact services, because the category determines what you may do, not the size of your team.
The roles should be settled in writing before work starts. The client owns its controls and decides which Implementation Group and Safeguards apply to its environment. Your firm prepares systems, configurations, policies and evidence, and tracks progress in the client's assessment records. Only the client's chosen independent assessor reports on whether the Safeguards are met, and a provider's own statement of compliance should never be presented as an assessment result. Ask the client which assessor it will use and agree early on what evidence that assessor expects.
CIS Controls Accreditation is a separate and optional step. It is run with CREST and is open to CIS SecureSuite Consulting and Services, Controls and Product Vendor members, so CREST membership is not required to apply. The application fee is 1,500 US dollars for CREST members and 2,500 US dollars for non-members, according to CIS. Accreditation signals a provider's capability to clients, but it does not replace the client's assessment or grant any certification. Decide whether it matters for your bids, and confirm current terms directly with CIS before committing.
Which CIS membership fits each kind of service provider
An managed service provider that patches, configures and administers client endpoints, servers and identity systems is delivering CIS Controls implementation as a service. That work falls under the SecureSuite Controls Membership, which CIS aims at consultants, MSPs and MSSPs and which costs 3,600 US dollars a year. The membership includes CIS CSAT Pro, which the provider uses to track each customer's progress across the Safeguards it manages for that client.
- Membership type: The Controls Membership is the entry point for providers delivering Controls work to multiple clients.
- CSAT Pro use: Record each client's asset inventory, Safeguard status and remediation items in a separate tracking view per client.
- Recurring cost: The annual fee recurs with the membership term, so the provider should budget it per year rather than as a one-time purchase.
- Client-side Safeguards: Safeguard 6.5 requires multi-factor authentication on every administrative account for enterprise assets, including assets the provider manages on the client's behalf.
- Contracts: Safeguard 15.4 expects service provider contracts to carry security requirements consistent with the client's service provider management policy.
Before signing, confirm with CIS which membership covers your exact services and whether client data may sit in CSAT Pro under the membership terms.
A managed security service provider that runs security monitoring, detection and response for clients is also a service provider under the CIS Controls. The same SecureSuite Controls Membership at 3,600 US dollars a year applies to the work of delivering Controls services, and CSAT Pro serves as the tracking layer for client Safeguard status. Monitoring alone does not change the membership category; what matters is that the provider is delivering Controls implementation or assessment for a client.
- Scope of services: Document which Controls the MSSP delivers, such as Control 8 log management or Control 17 incident response, and which remain with the client.
- CSAT Pro use: Track Safeguard evidence and open findings per client, keeping each client's records separate.
- Client-facing responsibilities: Safeguard 17.1 allows personnel to be employees, service providers or a hybrid, and when a service provider is used, at least one internal person must oversee its work.
- Review cycle: The incident handling designation is reviewed annually or after significant enterprise changes, so build that review into the client engagement calendar.
- Client-side vs. provider-side: The client owns its Controls; the MSSP prepares systems and evidence.
Ask CIS to confirm whether monitoring-only services fall under the Controls Membership or require a different category.
A consultant hired to run a one-off CIS Controls assessment for a client is doing client work, even if the engagement lasts only a few weeks. The End User membership is priced for an organization assessing its own environment, and its pricing pages state that it does not allow client or commercial use. The consultant therefore needs the Controls Membership for this work. The End User discounts of 5% for a 2-year term and 10% for a 3-year term reduce the End User price but do not change that restriction.
- Why End User fails: Running an assessment for a paying client is commercial use, which End User membership does not permit, regardless of term length.
- Discounts do not help: The 5% and 10% End User discounts apply to a membership that still excludes client work.
- Correct membership: Use the SecureSuite Controls Membership at 3,600 US dollars a year for the engagement period, and check the term with CIS.
- CSAT Pro use: Use it to record assessment results and produce the client's Safeguard status, with the client's data handled under your contract.
- Accreditation: CIS Controls Accreditation is a separate route for consulting members and is not required to run a client assessment.
Confirm the membership category in writing with CIS before accepting a client engagement.
What CIS Controls Accreditation adds for providers
CIS Controls Accreditation, run with CREST, is the step that lets a SecureSuite member show it can deliver CIS Controls work to others. The cards below cover who may apply, what the application costs, and what to confirm with CIS before committing budget and staff time.
What accreditation covers
CIS Controls Accreditation, run with CREST, accredits CIS SecureSuite member organizations that provide CIS Controls implementation, auditing or assessment services. It is a statement about the provider's organization and its delivery of the Controls, not a certification of any client's environment. A provider that only resells tooling or only hosts a platform should check whether its services fall within the categories the accreditation names before applying.
Eligible membership categories
Only CIS SecureSuite Consulting and Services, Controls, and Product Vendor members may apply for CIS Controls Accreditation. A provider on a different membership, including an End User membership, cannot apply through it. Confirm which membership category your organization holds today, because the category determines eligibility before any fee is considered.
CREST membership is optional
CREST membership is not required to apply for CIS Controls Accreditation. CREST membership does change the application fee, so a provider that already holds CREST membership should factor that into its comparison. Providers without CREST membership can still apply, and the difference in fee is the main financial effect of that choice.
Application fees by status
The application fee is 1,500 US dollars for CREST members and 2,500 US dollars for non-CREST members, as listed on the CIS accreditation page. Ask CIS whether the fee is one-time, whether renewal or reassessment carries further charges, and whether any costs fall outside the application fee. The figure is a starting point for budget discussions, not a full cost of accreditation.
Confirm terms before budgeting
CIS publishes these fees and eligibility rules, but programs of this kind change. Before setting a budget or committing staff time, ask CIS for the current application fee, the review process, the timeline, and what the accreditation requires of your staff and delivery methods. Get the answers in writing so the internal business case reflects current terms.
How a provider delivers CIS Controls to a client
The sequence moves from confirming licensing and scope to a documented, evidenced Controls program that the client's own assessor can test, with a review cycle that keeps it current.
Confirm licensing and client scope
Before any client work starts, the provider confirms that its own CIS SecureSuite membership covers consulting and client use. The SecureSuite Controls Membership is the category built for consultants, MSPs and MSSPs, and it includes CIS CSAT Pro. End User membership does not allow client or commercial use, so it cannot be used for this work. The provider then writes down which client environments, assets and business units are in scope, and who at the client owns the Controls. The output is a signed scope statement and a confirmed licence record that the provider can show the client on request.
Set the Implementation Group target with the client
The provider and the client agree on a target Implementation Group, IG1 to IG3, based on the client's size, the sensitivity of its data and the threats it faces. IG1 is CIS's essential cyber hygiene baseline, IG2 adds Safeguards for more operationally complex organizations, and IG3 covers regulated, sensitive environments facing sophisticated attacks. The provider records the target, the reasons for it and the Safeguards in scope for that target. The output is an agreed IG target and a Safeguard list that both parties sign off, so later progress is measured against something the client accepted.
Track Safeguard status in CSAT Pro
The provider loads the client's environment into CSAT Pro and records the status of each Safeguard in the agreed scope. This step establishes the baseline: which Safeguards are implemented, partly implemented or not started, and who owns each one on the client side. The provider keeps the tracker current as work proceeds and shares it with the client in a form the client can review. The output is a baseline tracker with an owner and status for every in-scope Safeguard, which becomes the starting point for every later review.
Implement and document the controls
The provider and the client's teams implement the in-scope Safeguards, drawing on the Benchmarks, configuration work and policies that apply to each one. Each change is documented as the control is built: the written process, the configuration, the owner and the date it took effect. For Safeguard 15.4, service provider contracts must include security requirements consistent with the client's service provider management policy, and for Safeguard 6.5, MFA is required on every administrative account where the asset supports it, including accounts on assets a third party manages. The output is a documented control set that a reviewer can follow without the provider in the room.
Prepare evidence for the client's chosen assessor
The provider assembles the evidence an independent assessor would ask for, organized by Safeguard. The CIS Controls Assessment Specification defines the inputs, operations, measures and metrics for each Safeguard, so the provider checks each piece of evidence against what that specification says to measure, and notes where the evidence does not yet meet it. The provider does not issue findings or certify the result. The client chooses the assessor, and the assessor forms its own conclusions. The output is an evidence pack per Safeguard, with gaps listed openly so the client can decide what to fix before the assessment starts.
Review annually or after significant change
The provider and the client review the Controls program on a set cycle and whenever the environment changes significantly, such as a new cloud platform, an acquisition or a major service change. Safeguard 17.1 describes the same discipline for incident handling personnel: designated people are reviewed annually or after significant enterprise changes, and where a service provider does part of the work, at least one internal person oversees it. The provider updates the tracker, re-checks evidence, and records what changed and why. The output is a dated review record and an updated tracker, which keeps the program accurate between assessments.
Client-side Safeguards that apply to providers
Three Safeguards decide whether a provider's own access and contracts meet the CIS Controls when it works inside a client's environment. Safeguard 6.5 requires multi-factor authentication on every account with administrative access to any enterprise asset where the asset supports it, and it explicitly covers assets a service provider manages. For an MSP, that means the remote management console, the RMM platform, the hypervisor login and every administrator account the provider uses on a client's firewalls and servers. The evidence is a configuration export or screenshot per administrative account showing the MFA enforcement setting, plus the list of accounts that the provider can produce on request. Confirm with each client which assets the provider administers, because that list defines the scope of the check.
Safeguard 15.4 asks that service provider contracts include security requirements consistent with the enterprise's service provider management policy. A provider should expect its client to ask for this, and should check that its own master service agreement and each client order form carry the requirements the client's policy names, such as incident notification, access logging, data handling and secure offboarding. The evidence is the signed contract and its security schedule, cross-referenced to the client's policy. Ask each client for its policy before drafting, since a generic provider contract often fails the consistency test that an assessor applies.
Safeguard 17.1 lets incident handling personnel be employees, service providers or a hybrid of both, but if a provider is used, at least one internal person must oversee its work. Clients should name that overseer in writing, and the designation must be reviewed annually or after a significant change in the enterprise, such as a merger or a change of provider. The evidence is the named designation, its review date and the record of that review. A provider can help draft the designation, but the client owns the decision about who oversees it. Plan for this in the first client onboarding, not during an incident.
Reselling CIS Hardened Images to clients
CIS runs a reseller program that lets MSPs, MSSPs and IT consultants sell CIS Hardened Images to their clients. The cards below connect that resale to Control 4 and the CIS Benchmarks, and set out what the provider must verify before a hardened image is treated as part of a client's CIS Controls program.
What the reseller program allows
CIS runs a reseller program under which MSPs, MSSPs and IT consultants can sell CIS Hardened Images to their clients. The provider is the channel for the image, not the author of it. Before offering the image, confirm with CIS the exact reseller terms, including what the provider may sell, how it may describe the product, and what support the provider must give the client.
Link to Control 4 and Benchmarks
Control 4 asks enterprises to establish and maintain secure configurations for assets and software. CIS Hardened Images are built to CIS Benchmark settings, so they put Control 4 into practice on new or rebuilt systems. The provider should map each image to the Benchmark profile it follows and record that mapping for the client's configuration baseline.
Check image fit to client assets
An image only helps if it matches the systems the client actually runs. Compare the operating systems, versions, cloud images and applications in the client's asset inventory against the image catalog. Where an asset falls outside the image, the provider must document a separate hardening path, because an unhardened asset will still appear in the Control 4 assessment.
Set a patch cadence
A hardened image starts secure on the day it is built and then ages. The provider should agree with the client how often images are rebuilt, how quickly vendor security updates are applied to running systems, and who owns each step. Put that cadence in the service agreement so the client can show Control 7 patching is covered rather than assumed.
Hardening is not compliance
A hardened image is one input to Control 4 and related Safeguards. It does not prove that the client has met the CIS Controls, and it does not replace a policy, an access review, logging or an assessment against the CIS Controls Assessment Specification. Tell the client plainly which Safeguards the image supports and which still need their own evidence.
Who does what on a provider-delivered CIS Controls engagement
This table compares the client, the service provider and the independent assessor across scope, Safeguard ownership, evidence preparation, CSAT Pro tracking and the final report. Read each row as a handoff: the client decides and owns, the provider prepares and tracks, and only the assessor reports on whether the Safeguards are met.
| Area | Client organization | Service provider (MSP, MSSP or consultant) | Independent assessor |
|---|---|---|---|
| Scope decision | Sets the enterprise boundary, Implementation Group target and which Safeguards apply | Proposes scope in writing and flags Safeguards that depend on systems it does not manage | Confirms the scope it will test and the Safeguards in or out of it |
| Safeguard ownership | Remains accountable for each Safeguard, including those a provider operates | Operates the controls it has contracted to run and states which ones stay with the client | Tests the controls and does not own or operate them |
| Policies and process | Approves and adopts written policies and processes | Drafts documents, maintains the records and helps staff follow them | Reviews whether documented processes match practice |
| Evidence preparation | Provides access to people, systems and records | Collects, organizes and retains evidence from its own tools and the client's environment | Samples evidence and decides whether it is sufficient |
| CSAT Pro tracking | Receives status and reviews open gaps for its environment | Uses CSAT Pro to track each client's implementation (included in the SecureSuite Controls Membership) | Does not rely on tracking alone and asks for underlying evidence |
| Contract terms | Specifies security requirements for the provider under Safeguard 15.4 | Agrees to those requirements and to the shared responsibility for admin accounts under Safeguard 6.5 | Not a party to the contract |
| Report or attestation | Receives the report and decides remediation | Does not issue a report, certificate or attestation of a client's compliance | Issues the independent report or assessment result |
Where provider engagements go wrong
Most problems in CIS Controls provider work come from membership terms, unclear targets and responsibilities that nobody wrote down. The cards below cover five recurring failures and a practical check for each, so the provider and client agree on scope before work starts.
Using End User membership for client work
Organizations sometimes buy an End User SecureSuite membership and then use it to run Controls work for customers. End User membership does not allow client or commercial use. A provider delivering the Controls to clients needs the SecureSuite Controls membership, which includes CSAT Pro for tracking each customer. Before signing a client, confirm in writing which membership and tool the provider will use, and ask CIS to confirm the terms that apply to that use.
Unclear Implementation Group targets
A client that says it wants "the CIS Controls" has not yet defined a target. The Implementation Groups set different Safeguard counts, from 56 for IG1 to all 153 Safeguards across the Controls. Without an agreed IG, the provider cannot size the work, price the engagement or report progress honestly. Ask the client to name its IG and the Safeguards in scope, and record both in the statement of work.
Unowned Safeguards between provider and client
Many Safeguards are split between the provider's tooling and the client's staff, such as account reviews, backup restore tests and incident contacts. When no one owns a Safeguard, it fails quietly and the evidence gap appears at assessment time. Build a responsibility matrix that names one owner per Safeguard, marks the provider's and client's duties separately, and sets who keeps the evidence and how often it is reviewed.
Weak provider contracts under Safeguard 15.4
Safeguard 15.4 asks that service provider contracts include security requirements consistent with the enterprise's service provider management policy. A provider's own service agreement often omits these terms, such as evidence delivery, incident notice, access rules and secure exit. Review the client contract against the client's policy, add the security schedule and confirm that the provider can produce the evidence the contract promises.
Presenting hardening as certification
Hardening a client's systems to CIS Benchmarks or using a hardened image does not certify the client against the CIS Controls, and CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. Providers who describe their work as certification create liability for themselves and their clients. Describe deliverables as implementation and evidence, and say that only an independent assessor or certification body issues a report or certificate.
Skipping MFA on provider-managed admin accounts
Safeguard 6.5 requires multi-factor authentication on every account with administrative access to an enterprise asset where the asset supports it, including assets a service provider manages. Providers often hold administrator accounts on client systems and forget to enrol them. Inventory every provider administrator account on each client asset, confirm MFA is enforced where supported, and keep the list as evidence that the client can review.
Questions MSPs and consultants ask before delivering CIS Controls
Can we use a CIS SecureSuite End User membership to deliver CIS Controls work to clients?
No. End User membership does not allow client or commercial use, so a managed service provider or consultant working for other organizations needs the SecureSuite Controls membership instead. End User membership is priced for an organization applying the Controls to its own environment, and CIS's pricing pages state that the license does not extend to delivering the work for customers. Confirm the license terms directly with CIS before you onboard your first client, and keep your membership category aligned with the way you actually bill and deliver the work.
How much does the CIS SecureSuite Controls membership cost?
The CIS SecureSuite Controls Membership, aimed at consultants, MSPs and MSSPs, costs 3,600 US dollars a year, according to CIS's membership page. That fee includes CIS CSAT Pro, the tool for tracking each customer's implementation of the CIS Controls. It is a recurring annual cost, so budget for renewal each year. Ask CIS whether the price changes by term, whether taxes or currency conversion apply, and which CSAT Pro features are included before you add the membership to a client proposal.
Do we need CIS Controls Accreditation to deliver CIS Controls services?
No. Accreditation is optional, and you do not need it to deliver CIS Controls work under a SecureSuite membership. It is a separate credential that signals to prospective clients that your firm meets CIS's accreditation requirements for implementation, auditing or assessment services. Only CIS SecureSuite Consulting and Services, Controls, and Product Vendor members can apply, and CREST membership is not required to apply. Decide whether accreditation helps your sales process before paying the application fee.
What does CIS Controls Accreditation cost to apply for?
The application fee is 1,500 US dollars for CREST members and 2,500 US dollars for non-CREST members, according to CIS's accreditation page. The fee covers the application itself, so ask CIS what additional costs might follow, such as renewal, audits of your delivery practice or training requirements. The difference between the two fees is the reason many firms check CREST membership first, but confirm current figures with CIS because accreditation terms can change.
Can our firm issue a CIS Controls report or certificate to a client?
No. A service provider can prepare the client's systems, configurations and evidence against the CIS Controls, but only an independent assessor or auditor issues an assessment report or attestation. CIS also states that the Controls do not replace any regulatory, compliance or authorization scheme. Describe your deliverables as implementation, gap analysis and evidence preparation, and make sure the client knows which independent party will perform any formal assessment they need.
What does the client need to provide when we deliver the CIS Controls?
The client keeps ownership of its controls, risk decisions and policies, and it must give you access and decisions to do the work. Typical inputs include an asset and account inventory, administrator access to in-scope systems, named contacts for each Control, and approval for changes in production. Under Safeguard 15.4, service provider contracts should include security requirements consistent with the client's service provider management policy, so expect to agree on those terms in writing. Confirm these inputs in the scope before work starts.
What must we do for client administrator accounts under the CIS Controls?
Safeguard 6.5 requires multi-factor authentication on every account with administrative access to an enterprise asset, where the asset supports it, and this includes assets your firm manages on the client's behalf. Plan to enable MFA on your own administrator accounts as well as the client's, and record the configuration as evidence. Check each platform's MFA support before promising coverage, because a feature that cannot be enabled on an asset must be documented as an exception.
Can DeployOpen help an MSP or consultant prepare client environments for CIS Controls assessments?
Yes, DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and it prepares systems, controls and evidence for compliance assessments. DeployOpen does not issue audit reports, attestations or certifications, and those come only from independent assessors. Most engagements are fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts, and a quote follows from that written scope. Ask for the scope in writing and confirm which SecureSuite membership your firm needs for the client work.
How DeployOpen works on this
DeployOpen helps MSPs, MSSPs and consultants prepare the systems, controls and evidence they need to deliver the CIS Controls to their clients. We plan and build self-hosted open-source platforms inside the client's own infrastructure, and we document what a provider's team must own. Independent assessors and certification bodies, not DeployOpen, issue any reports or accreditations.
How we scope
- Engagements are fixed-scope, with the client environments, Implementation Group target and Controls covered agreed in writing before work starts.
- The written scope names which Safeguards the provider owns, which the end client owns, and which are shared.
- Scope records the contractual terms and service provider responsibilities that Safeguard 15.4 expects to appear in client agreements.
How we build
- We implement and harden open-source platforms in the client's own cloud accounts, data centers or air-gapped networks.
- Builds cover asset inventory, account and MFA configuration, logging and backup where the agreed scope includes them.
- Configuration is set up so the provider can show the Safeguards it delivers and the evidence each one produces.
How we hand over
- We test the agreed controls and document results, owners, procedures and the evidence each Safeguard needs.
- Handover includes runbooks so the provider's staff can operate, review and reproduce the configured controls.
- Documentation states which Safeguards need an internal person to oversee a service provider, so responsibilities stay clear.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after handover.
- Retainers can cover periodic review of the client environment against the agreed scope and documented evidence.
- Ask during scoping which tasks the provider must keep in-house, such as CSAT Pro tracking and designated personnel reviews.
