Cybersecurity and Compliance in Managed IT: HIPAA, FTC Safeguards, PCI DSS and CMMC

Hiring a managed service provider (MSP) does not transfer your legal compliance obligations to the provider. Under rules such as HIPAA, the FTC Safeguards Rule, PCI DSS and the Department of Defense CMMC program, your business remains responsible for protecting the data it holds, while the provider helps implement and document controls. What you can and should do is choose a provider with relevant experience, sign the right agreements, define who does what in writing and keep evidence that controls are working.

The principle: responsibility stays with you

Regulators and card networks generally hold the organization that owns or controls the data accountable. A provider is a service provider or business associate in the language of these rules: it can be held to contract terms and, in some regimes, directly to the law, but your exposure remains. That is why the contract and your oversight matter.

HIPAA (health information)

The Health Insurance Portability and Accountability Act applies to covered entities such as health care providers and health plans, and to their business associates. Key points for managed IT:

• If your provider can create, receive, maintain or transmit protected health information, it is generally a business associate, and you need a written business associate agreement (BAA) with it.
• The Security Rule requires administrative, physical and technical safeguards, including risk analysis, access controls, audit controls, transmission security and contingency planning such as backups.
• You are expected to perform a security risk analysis and keep documentation. A provider can help conduct it, but cannot make the decision for you.
• The Breach Notification Rule sets deadlines and obligations after a breach of unsecured protected health information.
• HHS has proposed updates to the Security Rule. Check the Office for Civil Rights at HHS for the current status before relying on older summaries.

Ask a provider: Will you sign a BAA? Which of your tools and subcontractors touch our data? Do you encrypt backups? How do you log and report access?

FTC Safeguards Rule (financial customer information)

The Gramm-Leach-Bliley Act's Safeguards Rule, enforced by the Federal Trade Commission, applies to many non-bank financial institutions: for example mortgage brokers, tax preparers, auto dealers that finance, and some lenders and investment advisers outside other regulators. The updated rule requires a written information security program with elements such as:

• A designated Qualified Individual responsible for the program, who may be an employee or from a service provider, though the company retains responsibility.
• A written risk assessment.
• Access controls, encryption of customer information in transit and at rest, and multi-factor authentication for anyone accessing information systems.
• Monitoring and logging, change management, data disposal and incident response plans.
• Oversight of service providers.
• Notification to the FTC for certain security events involving unencrypted information of 500 or more consumers, within 30 days of discovery. This requirement took effect in 2024.

If you are in scope, make sure the provider can support each element and that responsibilities are written down.

PCI DSS (payment card data)

The Payment Card Industry Data Security Standard is maintained by the PCI Security Standards Council and enforced through contracts with card brands and acquiring banks. The current version series is 4.0.x, and the requirements that were future-dated in the initial release became mandatory in March 2025. Points for managed IT:

• Reduce scope first. Using a payment processor with hosted payment pages or point-to-point encrypted terminals can keep card data off your network.
• Your provider may be a third-party service provider under PCI DSS; ask for its responsibility matrix showing which requirements it covers and which stay with you.
• Network segmentation, patching, logging, vulnerability scans and strong authentication are common provider tasks.
• Your acquiring bank or processor tells you which self-assessment questionnaire or validation applies.

CMMC and federal contract information

Contractors handling federal contract information or controlled unclassified information for the Department of Defense face the Cybersecurity Maturity Model Certification program, which builds on NIST SP 800-171 requirements. The program has been phased into contracts beginning in late 2025. Check the Department of Defense CIO site and your contracting officer for current requirements and timelines. For managed IT:

• Many providers that touch such environments must meet matching requirements themselves, and some use specialized, segregated environments.
• Ask for evidence of experience, a shared responsibility matrix and a clear plan for scoping your environment.
• Do not assume that a general-purpose provider has experience with this.

State laws and cyber insurance

All U.S. states have breach notification laws, and several have privacy or data security statutes with their own requirements. Your cyber insurance application may also promise controls such as multi-factor authentication and endpoint detection; failing to maintain them can jeopardize coverage. Read your policy and share it with your provider so controls match what you represented.

Comparison table

Security services to ask about

• Multi-factor authentication for all users and administrators.
• Endpoint detection and response on every computer.
• Email security with phishing protection.
• Patch and vulnerability management with reporting.
• Immutable or offline backups and restore testing.
• Logging and monitoring, and who watches alerts at night.
• Security awareness training.
• Written incident response plan with named contacts.

See what affects the price for how these services affect cost.

What to put in the contract

1. A description of the compliance regimes that apply to you.
2. A shared responsibility matrix for each.
3. A BAA or data processing terms if needed.
4. A commitment to notify you of security incidents within a stated time.
5. Audit and evidence rights, such as copies of reports.
6. Insurance requirements.
7. Return or secure deletion of your data on termination.

Reading an MSP service agreement explains how to review these clauses.

When to consult a professional

Compliance is jurisdiction and industry specific. Consult a qualified attorney or compliance professional who knows your regulation before relying on a provider's assurances. This guide is general information, not legal advice.

Frequently asked questions

Does hiring an MSP make me HIPAA compliant?

No. It can help you implement safeguards, but you remain responsible. You need a BAA, a risk analysis and policies.

Do all businesses need to follow PCI DSS?

Any business that accepts, stores, processes or transmits payment card data is subject to the contractual requirements through its processor, though the validation level depends on volume and how you accept payments.

Can the MSP be our Qualified Individual under the Safeguards Rule?

The rule allows a service provider to fill the role, but your company retains responsibility and must oversee the provider. Document the arrangement.

Is multi-factor authentication required?

Under the Safeguards Rule, yes, for access to information systems, subject to the rule's terms. HIPAA and PCI DSS also expect strong authentication, and insurers commonly require it.

Sources and further reading

• U.S. Department of Health and Human Services — HIPAA Security Rule, breach notification and business associates.
• Federal Trade Commission — Safeguards Rule guidance for businesses.
• PCI Security Standards Council — PCI DSS documents and self-assessment guidance.
• Department of Defense CIO — CMMC program information.
• NIST — Cybersecurity Framework and SP 800-171.
• Cybersecurity and Infrastructure Security Agency — baseline cyber practices.