Owner/CEO
- Do you have a written security program?”
- Has a client, insurer, or partner ever asked you about your cybersecurity posture?”
- Are you trying to win any government or healthcare contracts in the next 12 months?”
Partner Sales Toolkit
Client Conversations
What to say, when to say it, and how to handle every objection.
Discovery Questions
Ask these before you pitch anything.
IT Lead
- Are you running any compliance frameworks today — HIPAA, NIST, PCI?”
- When did you last do a formal risk assessment?”
- Do your policies cover remote work and cloud apps?”
CFO
- Does your cyber insurance renewal ask about security controls?”
- Have you factored compliance into your IT budget this year?”
- What would a breach or audit failure cost you?”
The Opening Script
The risk assessment pivot — your door-opener.
You
“I'd like to offer you a complimentary risk assessment. It takes about 30 minutes on your end and gives you a clear picture of where your security program stands relative to your industry requirements. No commitment — just findings.”
Client
“What does that involve?”
You
“We run your environment through the Blacksmith platform. It maps your controls against the frameworks that apply to your business — HIPAA if you're in healthcare, NIST CSF if you're general-purpose, PCI if you take card payments. You get a written findings report you can use internally or share with auditors.”
Objection Bank
Handle the 12 most common objections.
-
Your size makes you a target, not a safe harbor. Attackers prefer small businesses because defenses are thinner. And your clients — especially the ones who are growing — will start asking you about their compliance posture before you're ready to answer.
-
Compliance is a process discipline, not just a technical one. Most IT teams are great at keeping systems running — compliance requires ongoing documentation, risk registers, policy management, and audit-ready reporting. That's a different skill set.
-
The average MSP charges $1,300/month per client for a CaaS program. The average HIPAA fine is $50,000. Cyber insurance claims average $200,000. Compliance isn't a cost center — it's risk transfer.
-
Breaches don't wait for convenient timing. Regulatory deadlines don't either. The best time to build a security program is before you need it — not after.
-
What they tried was probably a point-in-time audit, not a continuous program. Blacksmith runs as a living system — policies update, controls track, and your posture improves over time.
-
Cyber policies are tightening. Underwriters are adding security control requirements and denying claims when basic controls weren't in place. A written security program is becoming a coverage requirement, not an optional add-on.
-
Absolutely — and when you do, bring the risk assessment findings. Concrete gaps are a much more productive conversation than abstract risk.
-
With which framework? On what date was that last assessed? Compliance isn't a one-time event — it's a continuous state. We can validate where you stand and identify any drift since your last review.
-
Can you show me what's included? A lot of compliance tools generate a report and stop there. Blacksmith is a continuous program — ongoing monitoring, policy management, and a partner who's accountable to your posture over time.
-
Does your company handle payment cards, employee records, health information, or client contracts? Then you handle sensitive data. Most businesses are surprised how many data categories they're actually responsible for.
-
Compliance requires human accountability — a named responsible party, approved policies, documented decisions. AI can assist, but regulators still require a person to sign off. That's not changing.
-
That's exactly what the risk assessment identifies. We map your industry, client types, and contractual requirements to the applicable frameworks. You walk out knowing exactly what you owe compliance to and why.
QBR Agenda
Running your quarterly compliance review.
-
0:00–0:05
Relationship check-in.
What's changed in the business since last quarter?
-
0:05–0:20
Posture review.
Walk through the Blacksmith findings dashboard. Highlight improvements since last QBR. Name the top 3 open items.
-
0:20–0:30
Framework status.
Any new regulatory requirements, contract demands, or insurance updates? Are there any upcoming audits or certification renewals?
-
0:30–0:40
Roadmap review.
What are the next 90 days of the compliance program? What controls close? What policies need review?
-
0:40–0:50
Value demonstration.
Show the Compliance Task Triage Table. Make the math visible: "Last quarter we closed X controls. At your rate, that's Y risk reduction."
-
0:50–0:60
Next steps + expansion.
Any adjacent services needed? Any new client locations or acquisitions that need to be brought into the program?
Tip
Use the Compliance Task Triage Table (from Step 5 of the binder) to anchor the “value demonstration” segment. It turns a technical review into a business conversation.
Next up
Next: 9-Step Program