Compliance, by framework

Whatever framework your clients answer to, it reaches you too.

Compliance posture tracking isn't one generic dashboard — it's control-level tracking mapped to the specific frameworks your clients actually answer to. Pick one below.

SOC 2

The audit framework a lot of your clients' own customers require them to answer for — and that requirement flows straight down to you as their MSP.

A widely-adopted, vendor-neutral structure for cybersecurity posture — Identify, Protect, Detect, Respond, Recover — that shows up in RFPs, cyber-insurance questionnaires, and board conversations alike.

HIPAA

If any client handles protected health information, HIPAA's Security Rule reaches your MSP the moment you touch their systems — business associate agreement or not.

PCI-DSS

Any client that takes card payments — a retail shop, a restaurant, a small e-commerce operation — answers to PCI-DSS, and their network security posture is frequently the MSP's responsibility to maintain.

ISO 27001

The international standard for an information security management system — increasingly requested by clients with overseas customers or enterprise procurement teams that default to ISO language.

FERPA/COPPA

The two federal frameworks that govern student data and children's online privacy — directly relevant if any client you serve is a school, district, or ed-tech vendor.

These pages describe what the Nexus compliance module tracks against each framework — not a claim that Nexus, or any client running on it, is certified or audited. See the compliance & QBR module for how the tracking actually works.

See your framework's posture built for real.

Join the design-partner cohort and we'll walk through what tracking looks like for the specific frameworks your clients answer to.