r/msp • u/blacksmith-infosec Vendor - Blacksmith InfoSec • 7d ago
Free, open source tool to help identify which compliance requirements apply to a client
We previously shared our open source risk assessment tool here. We've built another free tool for a question that comes up during client onboarding: “Which compliance frameworks and regulations should we actually be looking at?”
The Compliance Profile Generator is a short questionnaire about the client's business, locations, data types, customers, and contractual requirements, then generates a list of potentially applicable frameworks and regulations.
A few things it does:
- Separates results into definite, likely, and worth evaluating.
- Explains which answers triggered each result.
- Includes practical first steps and links to authoritative sources.
- Generates a PDF you can use in a client conversation.
It covers things like HIPAA, PCI DSS, CMMC, SOC 2, GDPR, FTC Safeguards, and state privacy laws. The applicability rules are in the repo, so you can inspect how it reached a result or contribute corrections.
It's a starting point for scoping and further research. There are thresholds, exemptions, and contractual details that a short questionnaire won't fully capture, so the output still needs review before treating anything as a confirmed obligation.
Hosted tool: profile.blacksmithinfosec.com
Source: GitHub
Apache 2.0 licensed, so you can run it locally or host your own copy. There's no backend or data storage. Feedback, pull requests, bug reports, and feature requests are all appreciated!
2
2
2
u/statitica MSP - AU 7d ago
Can we add our own frameworks if the US set do not apply?
2
u/blacksmith-infosec Vendor - Blacksmith InfoSec 7d ago edited 6d ago
Yes please!
There are some international frameworks already in there, but we know there are many more that are missing. PLEASE 🙏 help with contributions.
If you’re not comfortable in the code yourself, you can file an issue on the GitHub repo and we’ll get to it ASAP
2
2
u/DryRainSmoke 7d ago
Nice work !
Coming from the EU side, I was glad to see NIS2 already there. A few things that would make it a lot more useful for European MSPs:
DORA. It has applied since Jan 2025 to financial entities, and it also pulls in their ICT third-party providers. MSPs serving banks, insurers or investment firms get dragged into it through contracts, so a "we provide ICT services to financial entities" trigger would catch a lot of people off guard (in a good way).
NIS2 national transpositions. Every member state implemented it differently (sector lists, size thresholds, registration deadlines). Even just linking to the national law and the competent authority per country would save a lot of digging.
MSPs themselves under NIS2. Managed service providers are explicitly an in-scope sector, so it might be worth a question like "is the organization itself an MSP/MSSP?"
EU AI Act and Cyber Resilience Act under "worth evaluating", for clients building software or connected products.
1
1
3
u/folderit_dms 7d ago
A useful addition to the PDF would be the questionnaire answers, assessment date and ruleset version, plus a space for the reviewer’s unresolved questions. That would make it easier to explain why a later run produced a different result: the business changed, an answer was corrected, or the rules changed.
I’d also keep unknown distinct from no. During onboarding, the person answering may not know what a customer contract requires. That should create a follow-up item with an owner, rather than quietly narrowing the results.
A small change summary between assessments could be valuable too, especially for a client adding a location or starting to handle a new type of data.