Run it alongside the change

"we're looking at changing the PSA and we're looking at doing, you know, various other things within the business."

"it's pretty manic at moment. So this will probably be one of those slow burn things"

There is always something else first: a Halo migration, an Inforcer implementation, onboarding a SOC, hiring a new engineer, a growth push. Every MSP has its own list. Finishing those first makes sense. The question is whether the Trustmark has to wait for them.

Usually it doesn't, and waiting often means doing some of the work twice.

Why running it alongside saves work

• The new setup is evidenced as it goes in. Assurix connects to the PSA, RMM, Microsoft 365 and security tools you run. Connect the new system as it goes live, and the evidence comes from it from the start rather than being rebuilt for an audit later.
• Your existing work carries over. Policies and evidence from ISO 27001 or Cyber Essentials are reused where they overlap. In Launchpad, Rosie reads what you already have and maps it to the controls.
• The documents get written while the change is fresh. A migration is when processes change and nobody writes them down.

"when you're a small team, you know, everything's in everyone's heads"

Two ways to fit it around a busy period

1. Start alongside, at a low pace. From 2 hours a week, with your customer success call every two weeks rather than weekly. Raise the pace once the migration is done.
2. Agree now, start later. We take on 10 new MSPs a month, so agreeing now holds your start slot. Fix a start date after the migration and book a review call for that date, so it doesn't drift into "next quarter" again.

What doesn't work is an open "let's revisit in six months" with no date. Without a date, the next project often takes the place of the last one.

The cost of waiting. The work doesn't go away. It arrives later as a separate project, usually just before something is due.

"we're scurrying around, making sure, fixing things"

What it means for you. You don't have to choose between the migration and the Trustmark. Pick the option that fits the next three months, and put a date on it.

From 2 hours a week, and not on your own

"My concerns would be the amount of extra work and stuff that we would need to achieve the right levels"

It starts from 2 hours a week, and you set the pace. In total it is around 50 hours to the Trustmark. At 2 hours a week that is around 25 weeks. At 3 or 4+ hours a week, it is quicker. ISO 27001 holders typically need less, and Cyber Essentials helps.

The worry behind "we haven't got the time" is often a different one: that the work lands on one person's desk and nobody helps. That isn't how it works. It is done with you, not left to you.

How we start

• A kick-off session. We agree the scope and who on your side does what.
• Launchpad, with you. Your starting baseline, built in the first week. See below.
• Your tools, connected. We help you set up the connections to your PSA, RMM, Microsoft 365 and security tools, so evidence starts coming in from the first week rather than being gathered by hand.

What Launchpad does

Most compliance projects start with a long list of tasks and no idea where you stand. Launchpad starts with what you already have.

1. Bring what you already have. Upload your existing policies and documents, from ISO 27001, Cyber Essentials or your own. Rosie reads each one, matches it to the controls it covers and pre-fills the answers it can, showing where each answer came from.
2. Connect your tools. Assurix pulls current figures from the tools you run, such as Microsoft 365 Secure Score, patch compliance, EDR coverage and backup status.
3. Answer the rest. The questions Rosie can't answer from your documents are grouped by the person best placed to answer them, so the technical questions go to the technical lead. Answer them in the platform yourself, or on a guided call with our customer success team.
4. Get your Launchpad report. It shows:
   • a maturity score, with what you already have in place
   • your critical gaps, ranked, in plain language
   • your estimated journey: the hours left and a timeline at the pace you choose
   • your first tasks, the quick wins that cut the most risk

What you have at the end of week one: your real position rather than a guess, a ranked list of what to fix, and a plan at your pace. Your customer success calls then work through that plan with you.

Why it saves time: you don't repeat what is already written down, and you start with the tasks that matter most rather than the whole list.

What a report looks like. One MSP's Launchpad report in September 2026 showed it was 59% of the way there, with 10 ranked gaps and about 53 hours of work left. At the pace it chose, that came to about 25 weeks.

A named person and a regular call until you hold the Trustmark

Every customer has a named customer success person and a call with them, normally 30 minutes, every week or every two weeks depending on how fast you want to go, until you reach the Trustmark. The call is on top of your 2 hours a week. Each call covers three things:

1. Progress against the pace you chose.
2. The next batch of tasks, with dates.
3. Anything unclear, sorted on the call rather than left to stall.

That regular rhythm is what stops it becoming the project that slips behind client work.

Why the hours stay low

• Assurix pulls evidence from the tools you already run. No new tooling. Anything it can't pull is assessed evidence, which counts the same.
• Rosie, the Assurix AI, explains each control, reviews your evidence when you ask and when you submit, and drafts policies and documents.
• The Policy Wizard and a template for every documented control mean nothing starts from a blank page.
• Work you have already done for Cyber Essentials or ISO 27001 is reused where it overlaps.
• Quick wins come first, so the hours that cut the most risk are spent early.
• An Assurix assessor, a person, signs off.

Where the time goes. Finding the gaps is quick, because most of the evidence is pulled from your tools. Closing them is the part you pace. Most of the 50 hours go on closing gaps, in the order that cuts the most risk.

For comparison. Assurix founder Mit Patel's own MSP, Netstar, spent 180 hours and £28,000 on ISO 27001 in its first year.

What it means for you. You size it, not us. Pick 2, 3 or 4+ hours a week, and the date follows from it. Your calls keep it to that pace. If you want to see your own numbers before you decide, ask us about running Launchpad first.