Compliance Deadlines as MSP Sales Triggers: CMMC, HIPAA and Cyber Insurance

Most MSP outreach fails the "why now?" test. A prospect may agree their IT could be better, but there is no date on the calendar that makes this quarter different from next quarter.

Compliance obligations are one of the few things that put a date on the calendar. A contract clause, a regulator's rule, an insurance renewal questionnaire — each one turns "we should look at security someday" into "we need an answer by a specific date." That makes them some of the most useful triggers an MSP can work, provided you get the facts right and lead with help instead of fear.

This post covers the main triggers in the US SMB market as of October 2026, what is actually in force versus proposed, how to find the companies in scope, and how to open the conversation.

Rule one: get the status right

Compliance is the one topic where a confident, wrong claim does lasting damage. If you tell a defense subcontractor they need a third-party certification by November and they learn otherwise from their prime, you are not their advisor any more.

So before anything else, separate three categories:

• In force now. Obligations a business already has today.
• Scheduled. Dates that are set in a final rule or contract.
• Proposed or paused. Rules that may change, slip, or never arrive.

Each trigger below is labeled accordingly. Always check the primary source before you put a date in front of a prospect, because several of these have moved in the past year.

CMMC: the obligations stayed, the date moved

The Cybersecurity Maturity Model Certification program governs how defense contractors protect Federal Contract Information and Controlled Unclassified Information (CUI).

What is in force. The CMMC program rule (32 CFR Part 170) took effect on December 16, 2024. The DFARS acquisition rule that puts CMMC requirements into contracts took effect on November 10, 2025, starting Phase 1 — Level 1 and Level 2 self-assessments, with scores submitted to SPRS and an annual affirmation by a senior official. Underneath CMMC, DFARS 252.204-7012 and NIST SP 800-171 obligations for contractors handling CUI remain in place.

What changed. Phase 2, which would have required Level 2 certification assessments by a third-party assessor (C3PAO) as a condition of award, was scheduled to begin November 10, 2026. On July 13, 2026, the Department of War (the Department of Defense) suspended Phase 2 and stood up a CMMC Reform Task Force to review the program. The Task Force's report went to the DoW CIO in September 2026; as of this writing it has not been published and no new Phase 2 date has been announced.

What that means for your pitch. Do not sell a November 2026 certification deadline — there is not one right now. The honest and still-urgent conversation is this: self-assessments, SPRS scores and annual affirmations are in force today, a senior official is signing that affirmation, and NIST SP 800-171 is a large body of work that does not get done in the month before a requirement returns. A contractor who uses the pause to close gaps is in a far better position than one who waits for a new date.

Who to look for. Manufacturers, machine shops, engineering firms, logistics companies and IT or professional-services firms in your territory that hold or pursue defense work, especially as subcontractors. Public award data and job postings that mention CMMC, CUI, NIST 800-171 or ITAR are useful tells.

HIPAA: a proposed overhaul, and a rule already in force

What is in force. The existing HIPAA Security Rule already requires covered entities and business associates to perform a risk analysis and implement administrative, physical and technical safeguards for electronic protected health information. Many small practices have never completed a documented risk analysis.

What is proposed. In January 2025, HHS published a notice of proposed rulemaking for significant updates to the Security Rule — among them more specific requirements around asset inventories, encryption, multifactor authentication and testing. It is a proposal, not a final rule. As of this writing it has not been finalized, and the federal regulatory agenda has pushed its target date out. Describe it to prospects as a signal of where regulators are heading, not as a deadline.

Who to look for. Medical, dental, chiropractic, physical therapy, behavioral health and veterinary-adjacent practices; billing companies; and other business associates that handle patient data for them. Small practices often rely on a single office manager for IT decisions, which makes an outside advisor genuinely valuable.

Cyber insurance renewals: the trigger that comes every year

Cyber insurance is not a regulation, but for many SMBs it is the most concrete security requirement they face. Renewal applications and questionnaires commonly ask about controls such as multifactor authentication, endpoint detection and response, backups and how they are protected, and email security. An owner who cannot answer "yes" may face higher premiums, exclusions or difficulty getting coverage.

The renewal date is the trigger. Unlike a regulatory deadline, it is specific to each business, so the way to find it is to ask. "When does your cyber policy renew, and did the last questionnaire ask anything you weren't sure how to answer?" is one of the most productive discovery questions an MSP can use — and it is entirely about helping the prospect.

Other triggers worth knowing

FTC Safeguards Rule. The amended rule took effect in June 2023 for non-bank financial institutions — a category that includes businesses many MSPs do not think of as "financial," such as auto dealers, mortgage brokers, tax preparers and some finance companies. It requires a written information security program, a qualified individual responsible for it, MFA and encryption among other controls. An amendment effective May 13, 2024 added a requirement to notify the FTC of certain security events affecting 500 or more consumers.

PCI DSS 4.0. For businesses that take card payments, the future-dated requirements in PCI DSS 4.0 became mandatory on March 31, 2025. Retailers, restaurants and service businesses that handle card data in-house are in scope.

State privacy laws. Several states have comprehensive consumer-privacy laws with effective dates still ahead. Whether a given business is in scope depends on thresholds in each law, so treat these as a prompt to check rather than a blanket claim.

How to find in-scope prospects

The pattern is the same for each trigger: intersect scope (industry, contract type, data handled, state) with evidence (something you can observe that says the company is affected or exposed).

This is how compliance signals work in MSProspector Lead Signals. One source watches a calendar of enacted regulatory deadlines and flags companies in scope when a date comes inside the lead window — and deliberately removes entries when a deadline is suspended or proposed rather than final, which is why CMMC Phase 2 is not in it today. A second source flags companies that fall within an in-force rule and show an observable gap that rule's controls are meant to prevent, such as missing email authentication, exposed remote-access services, or a disclosed breach. On compliance-flagged signals, the Sales Playbook can add a CMMC Level 2 readiness review alongside the NIST CSF posture — expect a list of questions for the client rather than a verdict, because most of Level 2 is internal.

How to open: help, not fear

Compliance outreach goes wrong when it reads like a threat. Owners hear plenty of "you could be fined" pitches; they tune them out.

What works is narrower and more useful:

• Name the obligation accurately. "Self-assessments and SPRS affirmations are already required under the DFARS rule" is credible. "CMMC is coming and you're not ready" is noise.
• Offer a concrete, small first step. A 30-minute readiness review, a renewal-questionnaire walkthrough, or a NIST CSF baseline. Our NIST CSF 2.0 guide shows how to run a 15-minute version that maps every gap to a service.
• Respect what you do not know. You cannot see inside their environment from the outside. Present observations as observations and ask.
• Be the one who knew the date moved. When regulators change course, the MSP who tells the prospect first, accurately, earns more trust than any campaign.

From there, the follow-up is the same discipline as any other signal — see how to get from a signal to the first meeting.

The takeaway

Compliance gives MSPs something rare: a dated, external reason for a prospect to act. Use it carefully. Lead with what is in force, label what is proposed or paused, find the companies where scope and evidence overlap, and open with an offer to help them answer the question they are already being asked.

---

Sources for dates in this post: 32 CFR Part 170 and the DFARS CMMC acquisition rule (Federal Register); DoW memoranda of July 13, 2026 suspending CMMC Phase 2; the HHS HIPAA Security Rule NPRM (90 FR 898, January 6, 2025); the FTC Safeguards Rule (16 CFR Part 314) and its 2024 notification amendment; PCI Security Standards Council guidance on PCI DSS 4.0. Verify current status with the issuing agency before quoting a date to a prospect.