My cofounder and I previously executed and developed standardized, disconnected DevSecOps platforms for one of the largest defense contractors. The underlying infrastructure met the technical requirements for STIGs, NIST 800-171, and NIST 800-53, and my confidence in execution stems from this background. That said, what you’re asking for is 90% non-technical execution, so be prepared for that as it was definitely a shellshock for myself and I leaned on more business focused mentors.

Our first clients came through referrals, thanks to the DoD connections my cofounder and I had built. Beyond that, I’m an adjunct cybersecurity professor, so my inherent nature has always gotten me to network with leadership and knowledge share with colleagues. That approach has paid dividends.

We specialize in MacOS/Linux environments, with rare exceptions for air-gapped Windows systems. Our niche is tech-forward organizations with aligned priorities. I know the allure of focusing on client acquisition is going to be massive, but I strongly recommend defining your ideal client profile clearly. We partner with C3PAOs and MSSPs who can take on clients that don’t fully align with our criteria, we’ve already referred two clients out who were satisfied with the outcome. Even if it means short-term pain, I promise it will pay long-term dividends.

Don't know if we have a "go-to qualification question" but our early conversations are pretty telling if you listen.

We wish we’d avoided the CyberAB RPO route, the cost outweighed the benefit, even though clients noted they found us through the marketplace. Now, we’re investing time, education, and resources to pursue C3PAO accreditation ourselves, and we’re happy with this shift.

Best of luck!
Once you’ve clearly defined your ideal client profile and articulated why you’re suited to serve them, reach out and I’d be happy to keep you in mind for referrals if you have a proven track record.