Cybersecurity consulting

State the risk in plain language, then the work that reduces it.

Security consultants sell to owners who have been told they need compliance and are not sure by whom. A client-ready proposal names the system, the likely failure, and the control you will actually put in place during the timeline.

The failure in plain language

Write the failure as an event, not a framework. The mailbox of the person who pays invoices gets forwarded. The laptop of a leaver still opens the file share. A customer asks for a questionnaire the company cannot answer without inventing the answers. Owners can buy an event. They cannot buy 'improved posture' without guessing what you will do on Monday.

Name the standard only if a real buyer, insurer, or customer has asked for it. Otherwise the proposal becomes a tour of acronyms, and the comparison is with a cheaper scan they already ignored.

The control you will actually install

List the controls in verbs. Turn on the second factor for the mail and the bank. Remove leaver accounts against a list from HR. Draft the answers to the customer questionnaire from evidence, and mark the questions you cannot truthfully answer. A penetration test with no one assigned to fix the findings is a PDF, and you should not pretend it is a program.

Incident response on retainer, a full ISO program, and 24-hour monitoring are different sales. If this engagement is a bounded fix, say what happens if they call you at midnight. Usually the answer is: they can't, not for this fee.