Last updated: 25 October 2026
Quick answer: A compliance QBR is a quarterly business review in which an MSP shows a client’s leadership where their security and privacy compliance stands, what changed, which risks need decisions, and what happens next quarter. Done well, it turns vCISO and vDPO work into visible value, supports board oversight duties, and creates natural upsell and renewal conversations.
Most MSPs already run quarterly business reviews. Many of them still focus on tickets closed, uptime and hardware refresh cycles. That is useful, but it does not answer the question a managing director or board now asks: are we compliant, and are we exposed?
This guide shows how to run a compliance QBR with clients: what to include, which metrics matter, how to adapt it for EU, UK and US clients, and a ready-to-use agenda you can adopt next quarter.
What is a compliance QBR?
A compliance QBR is a structured, quarterly meeting between an MSP and a client’s decision-makers that reviews governance, risk and compliance status rather than only IT operations. It covers frameworks and laws in scope, control progress, risk decisions, incidents, vendor issues and the plan for the next 90 days.
For MSPs that deliver vCISO or vDPO services, the compliance QBR is the moment where ongoing, often invisible work becomes a clear story for the client’s leadership. It is also where the client makes the decisions only they can make: accepting a risk, approving a budget, or signing off a policy.
How it differs from a traditional QBR
| Aspect | Traditional IT QBR | Compliance QBR |
|---|---|---|
| Audience | IT manager, operations lead | Managing director, board members, DPO, risk or finance lead |
| Focus | Tickets, SLAs, uptime, assets | Framework progress, risks, incidents, obligations, decisions |
| Key output | Service performance report | Decision log, risk acceptances, roadmap for next quarter |
| Evidence value | Low for auditors | Minutes can support management review and oversight evidence |
Why do clients need compliance QBRs now?
Because laws and frameworks increasingly expect leadership, not just IT, to approve and oversee security and privacy measures. A quarterly review gives clients a documented, repeatable way to meet that expectation.
Under Article 20 of the NIS2 Directive, management bodies of essential and important entities must approve the cybersecurity risk-management measures taken under Article 21 and oversee their implementation, and their members are required to follow training. Article 21 itself lists policies and procedures to assess the effectiveness of those measures among the minimum requirements.
On the privacy side, Article 24 of the GDPR requires controllers to be able to demonstrate compliance, and Article 32(1)(d) calls for a process for regularly testing, assessing and evaluating the effectiveness of security measures. A compliance QBR is a practical way to create that regular, recorded assessment.
Frameworks point the same way. NIST’s Cybersecurity Framework 2.0, published on 26 February 2024, added a Govern function in which the organisation’s cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. ISO/IEC 27001 requires top management to review the ISMS at planned intervals.
In practice: a quarterly compliance review will not replace a formal ISO 27001 management review, but its minutes and decision log can feed directly into one, saving the client time at year end.
How do compliance QBR expectations differ in the EU, UK and US?
The core agenda is the same everywhere, but the legal hook for leadership oversight differs. Tailor the “why this matters” slide to the client’s jurisdiction.
| Region | Leadership oversight driver | What to emphasise in the QBR |
|---|---|---|
| EU | NIS2 Article 20 management body approval and oversight; GDPR accountability; DORA for financial entities | Approval of measures, training records, incident reporting readiness, supplier risk |
| UK | UK GDPR accountability; the government’s voluntary Cyber Governance Code of Practice, published on 8 April 2025 for boards and directors | Board-level ownership of cyber risk, resilience and incident planning, data protection complaints handling |
| US | Sector rules and state privacy laws; for public companies, the SEC’s 2023 cybersecurity disclosure rules requiring descriptions of board oversight | Risk management process, board oversight narrative, incident materiality readiness |
For clients operating in several regions, one QBR can cover all of them if your platform maps controls across frameworks, so each control update counts once but reports against every obligation.
What should a compliance QBR include?
Cover six areas: compliance status by framework, risk register changes, incidents and near misses, vendor and third-party issues, policy and training status, and decisions plus the next-quarter roadmap. Keep it to 45 to 60 minutes and send the pack in advance.
Compliance QBR agenda template
- Headline summary (5 minutes). Three sentences: overall posture, biggest change since last quarter, and the one decision needed today.
- Compliance status by framework (10 minutes). Percentage of controls implemented and evidenced for each framework or law in scope, with the trend since last quarter. Use a structured compliance assessment so the numbers are repeatable.
- Top risks and treatment (10 minutes). New, increased and closed risks from the risk register, plus risks awaiting acceptance or budget.
- Incidents, breaches and requests (5 minutes). Security incidents, personal data breaches, regulator notifications and data subject requests, with response times against deadlines.
- Vendors and third parties (5 minutes). Critical suppliers assessed, overdue reviews and any supplier incidents, drawn from the vendor risk programme.
- Policies and people (5 minutes). Policies due for review or approval in policy management, training completion and phishing results.
- Regulatory horizon (5 minutes). Upcoming deadlines or changes that affect the client, such as a transposition law, a new standard edition or a certification audit.
- Decisions and next 90 days (10 minutes). Record each decision with an owner and date, and agree the priorities for next quarter.
Common mistake: showing a 40-slide technical deck. Leadership needs trends, exceptions and decisions. Put detail in an appendix and keep the main pack to a handful of pages.
Want to run compliance QBRs for every client from one multi-tenant, white-label platform? Book a partner demo to see how it works.
Which metrics belong in a compliance QBR?
Use a small, stable set of metrics that show progress and exceptions, not activity. The same metrics every quarter make trends visible and let clients compare periods.
Compliance QBR scorecard
| Metric | What it shows | Good sign |
|---|---|---|
| Controls implemented and evidenced, by framework | Progress towards each obligation | Rising trend, evidence current |
| High and critical risks open | Exposure requiring leadership attention | Stable or falling, all with owners |
| Overdue remediation actions | Execution discipline | Few, with reasons |
| Incidents and breaches, with notification timeliness | Response capability | All deadlines met |
| Data subject requests closed on time | Privacy operations | All within statutory deadlines |
| Critical vendors assessed in last 12 months | Supply chain oversight | Full coverage |
| Policies within review date | Governance hygiene | No overdue policies |
| Security awareness training completion | People risk | High completion, repeat offenders addressed |
Avoid vanity metrics such as the number of alerts processed. They show effort, not outcomes, and invite the question “so what?”.
How do you run a compliance QBR step by step?
Prepare two weeks ahead, pre-brief the client sponsor, present exceptions and decisions, then send minutes and actions within two working days. Consistency across clients is what makes QBRs scalable.
- Two weeks before: refresh assessments, risks and vendor reviews; confirm attendees include a decision-maker.
- One week before: build the pack from live data, not copy-pasted screenshots, and send a short pre-read.
- Pre-brief: walk the client sponsor through any bad news before the meeting so there are no surprises in front of the board.
- Meeting: follow the agenda, keep time and push for explicit decisions.
- Within two working days: send minutes, the decision log and the action list, with owners and dates.
- Between QBRs: track actions in tickets or tasks so progress is visible at the next review.
If you already package vCISO and vDPO services separately, a joint compliance QBR is a natural way to show clients why they need both. Our article on vCISO vs vDPO and why clients need both explains the split, and the Enactia for MSPs overview shows how partners deliver both services from one platform.
How do compliance QBRs grow MSP revenue?
They make value visible, surface new needs in a structured way, and anchor renewals in documented progress. The upsell comes from the client’s own risk register, not from a sales pitch.
- Retention: a documented history of progress and decisions makes it harder for a competitor to displace you on price alone.
- Expansion: new frameworks, entities or suppliers identified in the regulatory horizon section become scoped projects.
- Pricing: clear evidence of effort and outcomes supports moving from ad hoc hours to a managed compliance retainer.
Scaling this across dozens of clients requires a consistent method and a platform that lets you run it per tenant. Our guide to a vCISO and vDPO platform for MSPs covers what to look for.
Key takeaways
- A compliance QBR reviews governance, risk and compliance with client leadership every quarter and ends in recorded decisions.
- NIS2 Article 20, GDPR accountability, NIST CSF 2.0’s Govern function and ISO 27001 management review all reward regular leadership oversight.
- Use a stable eight-part agenda and a small scorecard focused on trends and exceptions.
- Tailor the oversight message for EU, UK and US clients.
- Minutes and decision logs double as audit evidence and as the basis for renewals and expansion.
Frequently asked questions
How long should a compliance QBR be?
Aim for 45 to 60 minutes for most small and mid-sized clients. Send the pack at least a few days in advance so the meeting is spent on discussion and decisions, not reading slides. Larger or regulated clients may need a longer session or a separate deep dive on specific risks, incidents or audit findings.
Who should attend a compliance QBR on the client side?
At least one decision-maker who can accept risk and approve budget, such as the managing director, a board member or the finance lead. Add the internal DPO, IT manager or risk owner where relevant. Without a decision-maker, the meeting becomes a status update and decisions slip to email, which weakens the audit trail.
Can a compliance QBR replace an ISO 27001 management review?
Not on its own. ISO 27001 sets specific inputs for management review, such as audit results, nonconformities and changes in context. However, if your QBR agenda covers those inputs and the minutes are retained, quarterly reviews can feed directly into the formal management review and reduce the effort needed at year end.
What if the client has no formal framework?
Start with a baseline such as NIST CSF 2.0, CIS Controls or Cyber Essentials for security, plus the privacy law that applies to them. Report progress against that baseline each quarter. Over time, the QBR often reveals when a client needs a certifiable standard such as ISO 27001, typically because a customer or regulator starts asking for it.
Should security and privacy be reviewed in the same QBR?
Usually yes, for small and mid-sized clients. Incidents, vendors and policies affect both areas, and leadership benefits from one joined-up picture. Keep separate sections for vCISO and vDPO topics so responsibilities stay clear, and consider a separate privacy session where the client has a large volume of data subject requests or DPIAs.
Making the compliance QBR your standard
A compliance QBR is one of the simplest ways for an MSP to prove the value of vCISO and vDPO services. It gives clients the leadership oversight that NIS2, the GDPR and modern frameworks expect, and gives you a repeatable, evidence-based way to retain and grow accounts. Start with the agenda and scorecard above, run it consistently for two quarters, and refine it with client feedback.
To see how partners run compliance QBRs across all their clients from Enactia, the GRC platform for vCISO and vDPO services, contact us or book a partner demo.
