How to Price MSP Compliance Services: The Framework That Protects Your Margins

You closed a compliance deal. Healthcare client, 75 users, needs HIPAA support. You quoted $50/user/month because that's what you saw in a vendor webinar.

Six months later, you've spent 200 hours on the engagement. Your effective hourly rate is $18.75. You'd have made more money not taking the deal.

This happens constantly. MSPs price compliance services based on what they've heard, not what the work actually costs. They win deals and lose money.

Here's the pricing framework that prevents that.

Why Compliance Pricing Is Different

IT support pricing is operational. You're maintaining systems, responding to issues, keeping things running. The work is relatively predictable. A 50-user client generates roughly similar support load to another 50-user client.

Compliance pricing is advisory. You're assessing risk, interpreting frameworks, making recommendations, and taking on liability. The work varies dramatically based on the client's current state, their framework requirements, and how much hand-holding they need.

Price compliance like IT support and you'll lose money on complex clients while leaving money on the table with simple ones.

Three principles before we get to numbers:

Principle 1: Price the risk, not just the work

When you provide compliance advice, you're taking on liability. Your assessment could miss something. Your recommendation could be wrong. Your documentation could be incomplete. When things go wrong, you're in the conversation.

Your pricing needs to account for that risk. This isn't padding. It's pricing for the actual value and exposure of the service.

Principle 2: Scope defines price

"Compliance services" isn't a scope. HIPAA compliance support for a 50-user healthcare clinic is different from HIPAA compliance support for a 500-user hospital system. SOC 2 readiness for a startup is different from SOC 2 readiness for an enterprise.

You can't price accurately without a detailed scope. If you're quoting before you've defined scope, you're guessing.

Principle 3: Separate phases, separate prices

Assessment is one thing. Remediation is another. Ongoing management is a third. Bundling them into a single price creates two problems: you can't price remediation accurately until you've done the assessment, and clients don't understand what they're paying for.

Separate the phases. Price them independently.

The Three Pricing Models

Model 1: Per-User Pricing

Charge a fixed amount per user per month. Simple to explain, simple to bill, scales with client size.

When it works: Ongoing compliance management where the work scales roughly with user count. Policy management, evidence collection, basic monitoring, documentation support.

When it doesn't work: Assessment and remediation phases (work doesn't scale linearly with users). Complex frameworks where 50 users can require more work than 200 users depending on systems and data flows.

Typical ranges:

• Basic compliance add-on: $25-50/user/month
• Managed compliance (single framework): $50-100/user/month
• Managed compliance (multi-framework): $100-175/user/month

Minimum fees: Per-user pricing falls apart with small clients. A 10-user client at $75/user is $750/month. That doesn't cover the fixed costs of managing their compliance program. Set minimums: $1,500-2,500/month regardless of user count.

Model 2: Fixed Retainer

Charge a flat monthly fee regardless of user count. Based on scope complexity, framework requirements, and estimated effort.

When it works: Clients with stable environments where you can accurately estimate ongoing effort. Clients where user count doesn't reflect actual compliance complexity (a 30-user law firm handling sensitive data may need more compliance work than a 100-user marketing agency).

When it doesn't work: Clients with rapidly changing environments. Engagements where you can't accurately estimate ongoing effort. Situations where the client expects unlimited access for their flat fee.

Typical ranges:

• Single framework, simple environment: $2,000-4,000/month
• Single framework, complex environment: $4,000-8,000/month
• Multi-framework: $6,000-15,000/month
• vCISO-level services: $8,000-20,000/month

Scope caps: Retainer pricing requires clear scope limits. Define included hours, included services, and what triggers out-of-scope billing. Without this, retainers become all-you-can-eat disasters.

Model 3: Project-Based Pricing

Charge a fixed fee for a defined deliverable. Used primarily for assessment and remediation phases, not ongoing management.

When it works: Assessment engagements with clear deliverables. Remediation projects with defined scope. Audit preparation with specific timelines.

Gap assessments:

• HIPAA: $5,000-15,000
• SOC 2: $8,000-25,000
• CMMC Level 1: $5,000-10,000
• CMMC Level 2: $15,000-40,000
• ISO 27001: $10,000-30,000

Remediation support (highly variable):

• Light remediation (documentation, policy updates): $5,000-15,000
• Moderate remediation (control implementation, process changes): $15,000-50,000
• Heavy remediation (infrastructure changes, significant gaps): $50,000-200,000+

Pricing by Framework

HIPAA

Market context: Healthcare clients expect compliance support from their IT providers. Competition is high, which can pressure pricing. But liability exposure is also high (HIPAA breaches make headlines), which justifies premium pricing.

Assessment pricing:

• Small practice (under 50 users): $5,000-8,000
• Medium practice (50-200 users): $8,000-15,000
• Large practice/hospital system: $15,000-30,000+

Ongoing management:

• Per-user: $50-100/user/month with $2,000 minimum
• Retainer: $2,500-8,000/month depending on complexity

SOC 2

Market context: SOC 2 is typically driven by sales requirements. A prospect or customer demanded it. This creates urgency, which supports premium pricing. But clients often have unrealistic timelines and budgets.

Assessment pricing:

• Startup/small SaaS (under 50 employees): $8,000-15,000
• Mid-market SaaS (50-200 employees): $15,000-25,000
• Enterprise: $25,000-50,000+

Ongoing management:

• Per-user: $75-150/user/month with $3,000 minimum
• Retainer: $4,000-12,000/month

CMMC

Market context: CMMC is required for DoD contracts. Clients must have it or lose business. This creates strong demand, but also a bifurcated market: well-funded contractors who will pay appropriately, and underfunded subcontractors who can't afford real compliance.

Assessment pricing:

• Level 1 (17 controls, self-assessment): $5,000-10,000
• Level 2 (110 controls, C3PAO required): $15,000-40,000

Ongoing management:

• Level 1: $2,000-4,000/month
• Level 2: $5,000-15,000/month

Note: C3PAO assessment fees are separate (client pays directly, typically $30,000-100,000+). Many clients underestimate total cost by 50-80%. A shared responsibility matrix is required, not optional.

Multi-Framework Pricing

Don't simply add framework prices together. There's significant overlap (HIPAA and SOC 2 share many controls, CMMC and ISO 27001 have common elements). But there's also additional complexity in managing multiple frameworks.

Pricing formula:

• First framework: 100% of standalone price
• Second framework: 60-70% of standalone price
• Third framework: 50-60% of standalone price

The Pricing Conversation

How you present pricing matters as much as the numbers. Here's how to structure the conversation.

Step 1: Qualify before you quote

Before any pricing discussion, understand: Which framework(s) do they actually need? Why now? What's their current state? What's their budget expectation? Who's the decision maker? If they want CMMC Level 2 and have a $15,000 total budget, that's a qualification failure, not a pricing problem.

Step 2: Scope before you price

Never quote without a defined scope. At minimum, you need: which framework(s), assessment scope, included services, excluded services, client responsibilities, and timeline expectations. For complex engagements, consider a paid scoping engagement ($2,000-5,000) before quoting the full project.

Step 3: Present phases separately

"SOC 2 compliance will cost $75,000" triggers sticker shock. Instead: "Gap assessment is $15,000. Based on that, we'll scope remediation, typically $20,000-50,000. Ongoing management is $5,000/month. Auditor fees are separate, typically $15,000-30,000 for Type II."

Step 4: Anchor on value, not hours

Weak: "The assessment takes about 40 hours at $175/hour, so $7,000."

Strong: "The assessment is $12,000. It gives you a complete picture of your compliance gaps, prioritized remediation roadmap, and documentation you can show to prospects asking about your security posture."

Common Pricing Mistakes

Mistake 1: Pricing compliance like IT support

IT support is operational. Compliance is advisory. Different value, different risk, different pricing. If your compliance rate is the same as your IT support rate, you're underpriced.

Mistake 2: Including audit prep in base pricing

"Audit preparation support" in your monthly retainer sounds comprehensive. Until audit time arrives and you're spending 60 hours on a client who pays for 10. Separate audit prep or define strict limits.

Mistake 3: Quoting remediation before assessment

You don't know what's broken until you look. Always: Assessment first, remediation quote after.

Mistake 4: No minimum fees

A 10-user client doesn't require 1/10th the compliance effort of a 100-user client. Set minimums: $1,500-3,000/month depending on framework complexity.

Mistake 5: Ignoring scope creep economics

Every "quick question" that turns into research. Every "can you also look at this" request. Track your actual hours against estimates. If you're consistently running 30% over, either your estimates are wrong or your scope management is weak.

Bottom Line

Compliance pricing isn't about picking a number that sounds right. It's about understanding your costs, valuing your expertise, accounting for risk, and communicating value to clients.

Get pricing right and compliance services add significant revenue at healthy margins. Get it wrong and you'll work harder for less money than your standard IT support. Read our comprehensive guide to MSP compliance services for more on revenue models and margin math.

---

Related Reading

• The Business of GRC for MSPs: Revenue Models and Margin Math
• MSP Compliance Liability Guide: Protect Your Business When Things Go Wrong
• Shared Responsibility Matrix Template for MSPs