Help your clients prove the reasonable cyber security steps they are taking
Most MSP compliance tooling measures technical controls. Cleverer answers the broader Australian question: can the business demonstrate the reasonable steps it has actually taken?
You already manage many of the technical controls. Cleverer brings the policies, people, responsibilities, training, governance and evidence around them into one ongoing compliance record.
Australian owned and built for Australian SMBs.
What this gives your business
Technical compliance is only part of the picture
Most MSP compliance tooling starts with technical scanning, framework maturity and configuration gaps. That work matters and you should keep doing it. Cleverer starts somewhere else: with the broader Australian reasonable-steps problem, where organisational measures carry as much weight as technology.
What technical compliance tooling answers
- Is MFA enabled?
- Are devices patched and encrypted?
- Is endpoint protection deployed?
- Are backups configured and running?
- What framework maturity level has been reached?
What Cleverer answers
- What reasonable steps has the business actually taken?
- Who owns each responsibility?
- Are policies established, adopted and acknowledged?
- Has the team had training appropriate to their role?
- What evidence exists, and how current is it?
- What risks and gaps remain, and who is addressing them?
- What has management actually reviewed and signed off?
- Can the business demonstrate all of this over time?
Where Essential Eight fits
Essential Eight is genuinely useful and forms a real part of a client's security position. Cleverer tracks control coverage against it alongside the Privacy Act and SMB1001. The distinction is scope: Essential Eight can form part of the evidence, it is not the entire reasonable-steps story. A maturity score says how well the technology is configured. It does not say whether the business has policies its staff have acknowledged, training matched to roles, decisions its management has reviewed, or a record it can produce when someone asks.
Your clients are more secure than they can prove
You have done the technical work properly. The business still cannot demonstrate it, and the policies, responsibilities, training and oversight that make up the rest of reasonable steps are usually far less mature. Cleverer closes that gap.
The controls exist
MFA is enforced, endpoints are protected, backups run and patching is managed. You know it because you built it.
The client cannot describe it
Ask the business owner what security controls they have and most will name one or two, then point at you.
The organisational layer is missing
Policies, responsibilities, training records, asset ownership and management review usually sit outside your scope entirely.
Security controls do not tell the whole reasonable-steps story
Under Australian expectations, reasonable steps combine technical controls with organisational measures and a record that both were real, current and maintained. Most SMBs have the first part managed well by their MSP and the other two barely started.
Technical controls
- MFA
- Endpoint protection
- Microsoft 365 security
- Backup
- Patching
- Access control
- Device management
- Monitoring
Organisational measures
- Policies
- Responsibilities
- Role based training
- Management oversight
- Risk decisions
- Asset register
- Vendor register
Evidence over time
- Evidence records
- Framework coverage
- Gap issues and owners
- Manager attestation
- Management reviews
- Board reporting
- Evidence pack export
A demonstrable reasonable-steps position
Not just what technology is configured, but what the business itself has done: who owns it, what was reviewed, what was decided and what still needs attention. Your technical work sits inside that record instead of outside it.
Cleverer does not touch your stack. It works around it.
Cleverer does not scan, monitor or connect to client systems. You remain the source of truth on what is technically in place. Cleverer is where that gets structured, recorded, evidenced and reviewed alongside everything the business itself is responsible for.
Stays with you
- Designing, deploying and maintaining technical controls.
- Microsoft 365 and identity configuration.
- Endpoint protection, RMM, EDR, backup and monitoring.
- Patching, device management and network security.
- Technical remediation when a gap is identified.
- The client relationship and the support agreement.
Handled in Cleverer
- Cyber and privacy policies, built and adopted with the Policy Builder.
- Role based training for staff, managers and directors.
- Asset and vendor registers owned by the business.
- Control coverage against Essential Eight, Privacy Act and SMB1001.
- Gap issues with a recommended fix and an assigned owner.
- Manager attestation, management reviews and board reporting.
- Incident and notifiable data breach workflow.
- Evidence records and an exportable evidence pack.
Cybersecurity cannot live entirely with IT
Your MSP can implement the controls, but the business still needs to own its policies, people, decisions and responsibilities. Most SMB owners quietly assume that signing a managed services agreement transferred all of it to you. It did not, and that assumption is a problem for both of you.
The technical controls
- Security tooling and configuration
- Identity, access and device management
- Backup, patching and monitoring
- Technical remediation work
Everything that is not a setting
- Policies and how they are applied
- Responsibilities across the team
- Staff behaviour and training
- Management decisions and sign off
- Risk it chooses to accept
- Evidence and ongoing reviews
Cleverer gives management a structured role in that process and creates a clearer record of what has been reviewed, accepted and acted on. Decisions get made by the people who should be making them, and they get recorded.
For you, that changes the dynamic. When a client defers a control or accepts a risk, it becomes a documented business decision rather than something you carry alone and quietly worry about. You are advising a business that is participating in its own security position instead of one that has handed you the whole thing and stopped thinking about it.
Make the security work you already deliver easier to see and value
Most preventative work is invisible by design. Nothing breaks, so nothing gets noticed. When the client can see their compliance position, the controls you maintain stop being an assumption and start being a documented part of how the business protects itself.
What is in place
Controls recorded against recognised frameworks, so the client can see the coverage rather than guess at it.
What is maintained
Reviews, attestations and dated activity showing the position is being kept current, not set once and forgotten.
What evidence exists
Evidence records behind each area, and an evidence pack the business can export when a client or insurer asks.
What still needs attention
Open gaps and outstanding actions, with progress over time visible to both the client and you.
Give your security recommendations a reason to be actioned
Every MSP has a list of recommendations clients keep deferring. Conditional access. Proper backup testing. Removing shared logins. Tightening admin rights. The technical case is sound. The client hears another IT expense.
Recommendation on its own
- "We think you should enable conditional access."
- Sits in a quote or a QBR slide with no wider context.
- Competes with every other discretionary spend.
- Easy to defer to next quarter, then the quarter after.
Recommendation inside a compliance position
- The gap is identified in the client's own compliance record.
- It carries a recommended fix and an assigned owner.
- It stays visible until it is addressed or consciously accepted.
- Management can see it, which changes who is making the decision.
The decision moves up the business
When an open gap sits in front of an owner or director alongside their other compliance obligations, it stops being an IT preference and becomes a business decision with a name attached to it. When the client decides to act, you are already the natural provider to do the work.
Working through the compliance position surfaces real work
Establishing a compliance position means going area by area through what the business actually has. Some areas are already strong because of the work you do. Others have not been looked at properly, and those become legitimate projects where you are the obvious provider.
Microsoft 365 and identity
Conditional access, admin role separation, legacy authentication, guest access and licensing that matches the security expectation.
Access lifecycle
Joiner, mover and leaver processes, shared accounts, dormant accounts and periodic access reviews that nobody currently owns.
Backup and recovery
Coverage of Microsoft 365 data, retention that matches the business need, and restore testing that has actually been done.
Endpoint and device management
Unmanaged devices, personal devices holding business data, encryption and consistent policy across the fleet.
Asset and vendor visibility
An asset register the business owns, and a vendor register covering the third parties holding their data.
Vulnerability and patching
Systems outside the patch scope, unsupported software and the servers everyone forgot were still running.
Security awareness
Training that is assigned by role, completed, refreshed and recorded rather than sent once and never followed up.
Incident readiness
A documented response process, escalation paths and the notifiable data breach steps the business would need to follow.
The point is not to generate findings. It is that once the business can see its own position, the work it needs is obvious to everyone, including the person paying for it.
An ongoing cycle, not a one-off audit
In practice, the client works through a guided activation inside Cleverer: confirming the organisation, assigning roles and responsibilities, adopting policies, assigning training, building the asset and vendor registers, and answering structured questions about each control area. Their answers, along with the evidence attached to them, build the compliance position. Where an area is not in place, it becomes an open issue with a recommended fix and an owner.
Compliance positions decay. Staff turn over, systems change, policies go stale and reviews fall overdue. That is exactly why this works as a recurring service rather than a project.
You manage the technical controls
The security work you already deliver continues exactly as it does today.
Cleverer establishes the position
Policies, roles, registers, training and control coverage get set up and owned by the business.
Gaps become visible
Gaps identified through the compliance process become open issues with a recommended fix and clear ownership.
You remediate the technical gaps
Billable work you are already positioned to deliver, now with a clear reason behind it.
Evidence and progress are recorded
Completed work becomes dated evidence in the record rather than a closed ticket nobody can find.
People obligations keep running
Training, policy acknowledgements and responsibilities continue across the year, including for new starters.
You review the position together
Management review, attestation and board reporting give you a structured agenda with the people who sign off spend.
The position stays current
New risks, new staff and new systems feed back in, and the cycle continues.
What this looks like on a typical client
A 20 person professional services firm
The MSP already manages Microsoft 365, endpoint security, backup and MFA for this client. The technical foundation is solid. Working through the compliance position, the picture looks like this.
Already strong
- MFA enforced across all users
- Endpoint protection deployed and monitored
- Microsoft 365 backup in place
- Patching managed on a defined cycle
Needs work
- No asset register the business itself owns
- Policies not established or acknowledged by staff
- Training inconsistent and not tracked by role
- Access reviews happen informally with no record
- Evidence scattered across inboxes and folders
The MSP delivers the setup and picks up the technical work that comes out of it. Cleverer holds the policies, training, registers, evidence and review cycle from that point on. Six months later, when the firm's largest client sends a security questionnaire, the business has something real to answer it with.
Your first Cleverer clients are probably already on your books
You do not need to find a new market for this. If you look after businesses that hold a lot of personal information, work in regulated sectors, deal with cyber insurance renewals or get asked to show their security position, the candidates are already on your client list.
You already do the technical work for those clients. Cleverer is how you build the rest of the picture around it and charge for it as an ongoing service.
Good first Cleverer clients
The ones where the conversation is easiest to start.
- They already ask you compliance or cyber insurance questions.
- They hold health, financial, employee or a lot of customer data.
- Bigger customers and suppliers send them security questionnaires.
- They are working towards SMB1001 or Essential Eight.
- The technical controls are solid. The policies, training and records are not.
- Management is asking whether the business is "compliant" and nobody has a straight answer.
Start with one existing client
You do not need to roll this across your base. Do one properly and you will know what the service looks like before you take it anywhere else.
- Pick a client that already leans on you for security.
- Establish their reasonable-steps position in Cleverer.
- See what is already covered and what is missing.
- Pick up the technical remediation that belongs with you.
- Run the same process on the next client that looks like them.
Client types where this conversation usually lands first.
The setup itself is a paid engagement, and the gaps you find are usually technical work you are already the natural person to do. The next section covers how the money works.
Four revenue lines, not one commission
The broader scope is what makes this commercially useful rather than academic. Because Cleverer covers the organisational side as well as the technical, there is real work in it for you at every stage. This is built to become a service line inside your business. The recurring platform revenue is only one part of the opportunity. Implementation, ongoing compliance services and the technical work that follows all sit alongside it.
Implementation
The Guided Compliance Setup is a paid engagement that gets a client structured properly from day one. The intent is that trained partners deliver it themselves and retain that revenue.
Platform revenue
Recurring partner revenue on the Cleverer subscription, with the annual Compliance Policy Builder available alongside it for clients who need policies built quickly.
Compliance services
Periodic compliance reviews, management review sessions and board reporting support, priced and delivered however suits your existing service model.
Technical work
The projects and managed service improvements that come out of identified gaps remain entirely yours, delivered by the provider the client already trusts.
On the numbers
Partner commercials, including recurring rates and how implementation revenue is handled, are being set with our first partners rather than published as a fixed schedule. Tell us how you price and package your services and we will talk through what fits.
Built to complement your existing stack
Cleverer is not another tool competing for a slot in your security stack. It sits in a layer most MSPs do not currently sell and do not want to build.
Does not replace your tooling
Cleverer does not replace your RMM, EDR, backup, Microsoft 365 security, SOC or MDR. It sits around the work you already deliver, adding the governance, people and evidence layer your clients need around those controls.
Does not touch client systems
No agents, no tenant connections and nothing new to deploy into the client environment. You can put this in front of a client this month without touching their systems.
Does not take the relationship
You introduce it, you implement it, you stay in front of the client. Cleverer is the platform underneath your service.
You do not need to build a GRC consultancy
The MSPs this suits are not compliance firms. They are IT businesses that already understand their clients' operations and want a practical way to deliver SMB cyber compliance without hiring a specialist or learning a heavyweight framework methodology.
Structured, not open ended
The platform guides the business through activation in defined phases. You are working through a process, not designing a compliance programme from scratch.
Policies without drafting them
The Compliance Policy Builder produces the policies the business needs. You are guiding decisions, not writing legal documents.
Partner training and support
We provide training and guidance on delivering the process, and support you through your first clients while you build confidence with it.
Opening to a small number of Australian MSPs
Cleverer is live and in use by Australian businesses today. We are now opening it to a small number of Australian MSPs. Early partners work directly with us on onboarding, service delivery and commercial arrangements while building Cleverer into their existing client offering.
If your clients are asking harder questions about security and compliance than your current stack can answer, this is worth a conversation.
Questions MSPs ask us
Does Cleverer replace our existing security stack?
No. Cleverer does not replace your RMM, EDR, backup, Microsoft 365 security, SOC or MDR, and it does not connect to client systems or collect telemetry. It sits around the controls you manage, adding the governance, people and evidence layer, which is work most MSPs are not currently selling.
Do we need a compliance specialist on staff?
No. The platform structures the process, the Policy Builder produces the policies, and the framework coverage and gap tracking are built in. We provide partner training and support you through your first clients. You need people who understand your clients' businesses, not certified GRC consultants.
Who owns the client relationship?
You do. You introduce Cleverer, you deliver the implementation, and you stay the primary relationship. Cleverer is the platform underneath your service, not a competing supplier to your client.
Can the MSP deliver the onboarding?
That is the intent of the partner model. Trained partners deliver the Guided Compliance Setup themselves and retain the implementation revenue. Early on we will run these with you so you can see how the process works before taking it on independently.
Can we add our own services around Cleverer?
Yes, and most partners should. Compliance reviews, management review facilitation, board reporting support, remediation projects and security improvement work are all yours to price and package however you choose.
Does Cleverer perform the technical remediation?
No. Cleverer is where gaps in the client's position are recorded, owned and tracked, and where the outcome is captured once the work is done. The technical work belongs to you, which is the point.
What does Cleverer actually give the client?
Policies and acknowledgements, role based training for staff, managers and directors, asset and vendor registers, control coverage against recognised frameworks, gap issues with recommended fixes, manager attestation, management reviews, board reporting, an incident and notifiable data breach workflow, and an exportable evidence pack.
Can Cleverer guarantee our clients are compliant?
No, and be careful with anyone who says otherwise. No platform can guarantee legal compliance. What Cleverer does is help a business build and maintain the governance, training, accountability and evidence records that support a stronger and more defensible position.
How do we get started?
Send us a short enquiry below. We will get in touch to talk through how you currently deliver security work, where compliance fits, and what a partnership would look like for your business.
Interested in Cleverer for your MSP?
Tell us a little about your MSP and we will get in touch to discuss how Cleverer could fit into your existing services.
It is a conversation, not a pitch. Worth having if you manage Australian SMB clients, already deliver the technical security work, and want a practical way to turn that into a compliance service your clients understand and value.
Explore an MSP partnership
Four fields are all we need to start.
We use these details only to contact you about a Cleverer MSP partnership. You are not signing up to a mailing list, and you can ask us to remove your details at any time by emailing hello@cleverer.au. See our privacy policy.
Useful background
General information only. This page is not legal advice.
