Credibility Strategy — Narrative Consulting

The Honest Assessment

You are one person selling $3,500–$8,500 engagements to companies that spend $50K–$500K with the Big Four. That sounds like a disadvantage, but it is actually your positioning if you execute correctly. Here is why:

Mid-market companies (300–500 employees) are overserved by large firms. They get junior staff, cookie-cutter frameworks, and bills that far exceed value delivered. A Forrester study found boutique firms achieve 27% higher implementation success rates than generalist firms on complex, industry-specific challenges.
Boutique firms respond 43% faster to changing client requirements than large consulting organizations.
Your price point is a sweet spot. Companies that need IGA work but cannot justify $150K+ engagements with Deloitte are your exact buyer. You are not competing with the Big Four. You are the alternative to the Big Four for companies that were never going to hire them anyway.

Key mindset shift: Stop thinking about how to look big. Start thinking about how to look like the best possible version of what you are: a specialist who delivers outcomes, not billable hours.

1. Credibility Stack

Ranked by impact-to-effort ratio. Do these in order.

Tier 1 Highest Impact, Do Immediately (Weeks 1–4)

Signal	Impact	Effort	Why It Matters
Professional liability (E&O) insurance	Critical	Low ($80–150/mo)	Procurement will ask. No insurance = disqualified. Non-negotiable.
Cyber liability insurance	Critical	Low ($92–150/mo)	Same as above. Bundle with E&O through TechInsurance or Insureon.
LLC formation	Critical	Low (1–2 days)	You cannot sign enterprise contracts as a sole proprietor. Do this now.
ISACA membership	High	Low ($135/yr)	Instant access to 185K+ professional network, local chapter events, CPE credits, and the ISACA logo on your materials.
Okta Certified Administrator	High	Medium (2–4 weeks study)	Your Terraform modules prove you know Okta. The cert makes it official. Procurement teams check boxes.

Tier 2 High Impact, Do Next (Weeks 4–12)

Signal	Impact	Effort	Why It Matters
Okta Certified Consultant	High	Medium (after Admin cert)	The next level up. Positions you as implementation-grade, not just theory.
Okta Elevate Partner Program enrollment	High	Medium	Partner badge on your site. Access to deal registration, co-marketing, and the partner directory where buyers search for help.
3 anonymized case studies	High	Medium	Even from past employment or side projects. “A 400-person fintech needed...” format. No client names needed initially.
Trust center with security posture documentation	High	Low (you already have this)	Fill it with real substance: your own security practices, data handling policies, insurance certificates.

Tier 3 Strong Impact, Ongoing (Months 3–12)

Signal	Impact	Effort	Why It Matters
CISSP certification	Very High	Very High (3–6 months study, $749 exam, 5 years experience required)	The gold standard. Procurement teams know this one. Worth it, but do not let it block revenue.
CISM certification	High	High ($575–760 exam)	Governance-focused. Directly aligned to what you sell. Consider this before or instead of CISSP depending on your experience profile.
Open source portfolio with stars and forks	Medium-High	Already done (maintain it)	Your 11 Okta Terraform modules are a differentiator that no Big Four consultant can match.
Published content in trade publications	High	High (ongoing)	Not blog posts on your own site. Published in venues your buyers read.

What NOT to Pursue Waste of Time

SOC 2 Type II for your own consultancy. Costs $15K–$50K, takes 6+ months. Overkill for a solo consultant. No mid-market client expects their IGA consultant to have SOC 2. Instead, document your security practices on your trust center page and be transparent about your controls.
AWS Security Competency. Requires multiple certified staff and customer references at scale. Designed for firms, not solos.
Microsoft Solutions Partner for Security. Requires multiple certified individuals and significant customer deployment metrics. Not realistic for a solo practice.
Generic cybersecurity certifications (CompTIA Security+, CEH). Too junior. They signal entry-level, not expert. If you already have them, fine. Do not pursue them.
Writing a book. Takes 6–12 months, generates almost zero direct revenue or leads. Write articles instead.

2. Procurement Objection Playbook

Objection: “You are too small. We need a firm with depth.”

Rebuttal

“You are hiring a specialist, not a department. When Deloitte staffs your IGA project, you get one senior person for the kickoff, then the work is done by analysts 2–3 years out of school. With Narrative Consulting, I am the person who scopes the work, does the work, and presents the findings. Every hour you pay for is expert-level work. That is why a $3,500 assessment from me replaces a $35,000 engagement from a Big Four firm — not because I am cheaper, but because there is no overhead, no ramp-up time, and no knowledge loss between the person who sold it and the person who delivers it.”

Supporting evidence to have ready:

Stanford Business School study: boutique firms achieve 27% higher implementation success rates on specialized challenges
Forrester: boutique firms respond 43% faster to changing requirements
Your own completion timeline vs. typical Big Four timelines for comparable scope

Objection: “What if you get hit by a bus?” (Key Person Risk)

Rebuttal

“Three things. First, every engagement produces complete documentation — runbooks, architecture diagrams, decision logs, and configuration-as-code via Terraform. If I disappeared tomorrow, any competent IGA engineer could pick up where I left off because the work product is infrastructure-as-code, not tribal knowledge in someone's head. Second, I maintain a network of vetted IGA practitioners I can bring in for surge capacity or continuity. Third, I carry professional liability insurance specifically to protect you in that scenario. Compare that to a Big Four engagement where ‘your’ team rotates every 6 months anyway.”

What to build to make this rebuttal airtight:

A documented continuity plan (1–2 pages) you can share during procurement
Relationships with 2–3 other independent IGA consultants who would serve as your “bench” (formalize this with a simple mutual referral/backup agreement)
Deliverable templates that are self-documenting by design

Objection: “We need references and you are new.”

Rebuttal

“I am new as a firm. I am not new as a practitioner. [Insert your years of IGA experience, specific platforms, specific outcomes]. Here is what I can offer: a risk-free pilot. My Identity Infrastructure Assessment is $3,500 and takes two weeks. At the end, you have a complete gap analysis and remediation roadmap that is valuable regardless of who does the implementation. If the assessment does not deliver clear value, you have lost two weeks and a fraction of what a Big Four discovery phase costs.”

Supporting structure:

Frame the assessment as a no-regret move: even if they do not hire you for buildout, the deliverable stands alone
Offer to do the first assessment at a slight discount (not free — free signals desperation) in exchange for a testimonial and case study rights
Collect LinkedIn recommendations from past colleagues, managers, and anyone you have worked with in IGA

Objection: “We need to see your security questionnaire / vendor assessment.”

Rebuttal

Do not rebuttal this one. Just be ready for it. Have the following prepared before your first sales call:

Completed VSA (Vendor Security Alliance) questionnaire — the standard for mid-market vendor assessments
Certificate of insurance (E&O + cyber liability)
Your own information security policy (1–2 pages covering how you handle client data, encryption, access controls, device management)
A data processing agreement template
W-9 and business registration documentation

Objection: “Your rates seem low. Is the quality there?”

Rebuttal

“My rates reflect zero overhead, not lower quality. I do not have a downtown office lease, a partner track to fund, or a marketing department to support. Every dollar you pay goes to expert delivery. My deliverables are identical in rigor to what you would get from a Big Four engagement — gap analyses mapped to NIST 800-53 and SOC 2 controls, Terraform-based implementation, and documentation that survives audit. The difference is you are not paying for the 60% of a Big Four bill that goes to overhead and margin.”

3. Partnership Strategy

Priority 1: Okta (Highest ROI)

Why: Your 11 Terraform modules are already Okta-focused. This is your strongest existing signal.

Path:

Get Okta Certified Administrator (prerequisite)
Get Okta Certified Consultant
Apply for Okta Elevate Partner Program as a Solution Provider
Earn digital badges (Tech Champion, etc.) that display on the partner directory

What it unlocks:

Listing in Okta's partner directory (buyers search this when they need implementation help)
Deal registration (protects your pipeline when Okta refers business to you)
Co-marketing opportunities and Okta logo usage rights
Access to partner training, NFR licenses, and pre-release features

Realistic timeline: 3–4 months from certification to active partner listing

Priority 2: ISACA Chapter Engagement

Why: Not a vendor partnership, but functionally similar. ISACA chapters are where your buyers network.

Path:

Join ISACA ($135/year)
Attend your local chapter meetings
Volunteer to present at a chapter meeting within 6 months (these are always looking for speakers)
Aim for a chapter board position within 12 months

What it unlocks:

Direct access to CISOs, compliance managers, and IT directors at target companies
Speaking credibility (ISACA chapter speaker is a real credential)
CISM certification pathway with member pricing

Priority 3: Identity Defined Security Alliance (IDSA)

Why: Niche industry group specifically for identity security. Smaller community means higher visibility.

Path:

Apply for membership
Contribute to their frameworks and publications
Participate in working groups

What it unlocks:

Association with major identity vendors (Okta, SailPoint, CyberArk, Ping are all members)
Thought leadership platform in your exact niche
Networking with identity-focused buyers

De-prioritize for now:

AWS Partner Network: Requires multiple certified staff for meaningful tier status. The Select tier needs 4 accredited individuals. Revisit when/if you hire.
Microsoft Partner Program: Similar staffing requirements. The CSP program is being tightened with new security requirements through 2026. Not worth the overhead as a solo.

4. Certification Roadmap

Ordered by ROI on credibility per hour invested.

Phase 1: Quick Wins (Months 1–2)

Okta Certified Administrator

Cost: ~$250 exam fee
Study time: 2–4 weeks (you likely already know 80% of this given your Terraform modules)
Credibility signal: “I am not just theoretically knowledgeable about Okta — I am certified by Okta”
Business impact: Prerequisite for partner program, listed on your profiles

Okta Certified Consultant

Cost: ~$250 exam fee
Study time: 2–3 weeks after Admin cert
Credibility signal: Implementation-level certification, not just admin
Business impact: Higher partner tier eligibility, stronger positioning for Governance Buildout engagements

Phase 2: Governance Authority (Months 3–6)

CISM (Certified Information Security Manager)

Cost: $575 (ISACA member) / $760 (non-member)
Study time: 2–3 months, ~150 hours
Credibility signal: Governance and risk management focus directly aligned to your service offerings
Business impact: This is the cert that speaks directly to CISOs and compliance officers. More relevant to your practice than CISSP.
Requirement: 5 years of information security management experience (up to 2 years can be waived with other certifications or education)

Phase 3: The Gold Standard (Months 6–12)

CISSP (Certified Information Systems Security Professional)

Cost: $749 exam fee
Study time: 3–6 months, ~250 hours
Credibility signal: The most recognized security certification globally. Procurement teams know this one even if they do not know what it means.
Business impact: Removes the “are they qualified?” question permanently
Requirement: 5 years of cumulative, paid work experience in 2+ of 8 CISSP domains
Note: If you do not have 5 years yet, you can pass the exam and become an Associate of (ISC)2 while accumulating experience

Do NOT pursue (low ROI for your practice):

CCSP (Certified Cloud Security Professional): Cloud-focused, not IGA-focused. Dilutes your positioning.
CompTIA Security+: Too junior. Signals entry-level.
SANS GIAC certs: Expensive ($7,000+), more relevant for pen testing and SOC work than IGA consulting.
SailPoint certifications: Only pursue if you decide to add SailPoint to your practice. Stay Okta-focused initially.

5. Social Proof Accelerators

Tactic 1: The Assessment-to-Testimonial Pipeline

Your $3,500 Identity Infrastructure Assessment is your greatest social proof engine. Here is how to weaponize it:

Deliver the assessment with clear, actionable findings
Two days after delivery, send a short email: “Would you be willing to share a brief quote about your experience? Even 2–3 sentences would be incredibly valuable. I can draft something based on our conversations if that is easier.”
Offer a draft. Most people will not write a testimonial from scratch. Write it for them based on what they said during the engagement, then ask them to approve or edit.
Ask for permission to create an anonymized case study. “A 350-person fintech company needed to prepare for SOC 2 Type II. We identified 14 critical IGA gaps in 10 days...”
Request a LinkedIn recommendation in the same conversation. LinkedIn recommendations are searchable and permanent.

Key insight: Ask immediately after delivering results, when satisfaction is highest. Waiting even 2 weeks reduces the response rate by 50%+ because the emotional impact fades.

Tactic 2: The Pro Bono Assessment

Offer 1–2 free assessments to companies in your target verticals under these conditions:

They agree to a detailed case study (anonymized is fine)
They agree to a testimonial quote
They agree to serve as a reference for future prospects

This is not discounting. This is investing in your reference portfolio. Do this for exactly 2 companies, then stop. More than that, and you are training the market to expect free work.

Tactic 3: Open Source as Social Proof

Your 11 Okta Terraform modules at github.com/sean-iam/narrative-terraform-modules are an asset that no Big Four consultant has. Here is how to leverage them:

Add a professional README with architecture diagrams, use cases, and a link to narrativeconsulting.com
Track stars, forks, and downloads and display them on your site: “Trusted by X organizations” (even 50 stars is meaningful in a niche Terraform module space)
Write a blog post explaining the design decisions behind each module. This demonstrates depth of thought, not just code.
Reference them in every proposal: “Our approach is infrastructure-as-code first. Here is our open source Okta module library that organizations already use in production.”
Contribute to Okta's official documentation or community — this creates a paper trail of expertise that prospects can verify

Tactic 4: LinkedIn Social Proof Blitz

Over 30 days:

Post 3x/week about IGA topics (not sales pitches — genuine insights from your work)
Comment substantively on 5 posts/day from CISOs, compliance leaders, and identity professionals
Request LinkedIn recommendations from every former colleague, manager, and client who knows your IGA work
Join and actively participate in LinkedIn groups: “Identity and Access Management Professionals,” “ISACA,” “Okta Community”

Goal: 10+ LinkedIn recommendations and 500+ connections in your target buyer persona within 90 days.

Tactic 5: The Assessment Engine as Proof of Expertise

Your public /assessment/ pages are brilliant for this. Every prospect who completes the assessment experiences your expertise before they ever talk to you. Make sure the assessment:

Delivers genuinely useful output (not a glorified lead gen form)
References real frameworks (NIST 800-53, SOC 2 TSC, CIS Controls)
Ends with “Prepared by Narrative Consulting” branding that positions you as the authority

6. Insurance & Compliance Checklist

Must-Have Required

Required to pass vendor qualification at any mid-market company.

Professional Liability / E&O Insurance — $1M/$2M policy minimum. Cost: ~$80–150/month through TechInsurance, Hartford, or Insureon. Covers claims of professional negligence, errors in deliverables, or failure to deliver contracted services.
Cyber Liability Insurance — $1M minimum. Cost: ~$92–150/month. Covers data breaches, cyber incidents, and third-party claims related to security failures. Many clients will ask for this specifically. Can often be bundled with E&O as “Tech E&O.”
General Liability Insurance — $1M/$2M policy. Cost: ~$30–50/month. Covers bodily injury, property damage. Required by many commercial leases and client contracts even for consultants who work remotely.
LLC Formation (Pennsylvania) — File immediately. Cost: ~$125 filing fee. Required to sign enterprise contracts, separate personal and business liability, and look like a real business entity.
EIN (Employer Identification Number) — Free from IRS. Required for business banking, tax filing, and most client onboarding forms.
Business Bank Account — Separate from personal. Required for LLC compliance and professional appearance.

Should-Have Strengthens Position

Certificate of Insurance (COI) template — Your insurer provides these. Have one ready to send within 24 hours of any request. Procurement teams ask for these frequently.
W-9 on file — Pre-filled and ready to send.
Completed VSA Questionnaire — The Vendor Security Alliance questionnaire (30–50 questions) is the mid-market standard. Complete it proactively and have it ready to send.
Information Security Policy — 2–3 page document covering: device encryption, MFA usage, data handling procedures, incident response process, client data retention and destruction policies. This is not SOC 2. This is showing you practice what you preach.
Data Processing Agreement (DPA) template — Required if you handle any PII or client data during engagements. Have one ready.
Background check clearance — Some clients will require this. Services like Checkr or Sterling can provide individual background checks for ~$30–50.

Not Needed (Yet) Skip

SOC 2 Type II for your own practice (overkill for solo consultant)
ISO 27001 certification (same — overkill)
FedRAMP (unless pursuing federal contracts, which you should not at this stage)
Directors & Officers (D&O) insurance (no board, no need)

7. Thought Leadership Plan

What actually moves the needle, in order of impact.

1. Speaking at ISACA Chapter Meetings Very High Impact

Local ISACA chapters are always short on speakers
Propose a talk: “Identity Governance Gaps That Fail SOC 2 Audits: Lessons from the Field”
Audience: exactly your buyers (CISOs, compliance managers, IT directors)
Frequency: 1 talk per quarter
Lead generation: hand out business cards, offer free assessment signups
Timeline: Can start within 60 days of ISACA membership

2. Submitting to Identiverse CFP Very High Impact

Identiverse is THE identity conference (3,000+ attendees, curated by independent content committee)
CFP is open to anyone — they judge on content quality, not firm size
Propose: “Infrastructure-as-Code for Identity Governance: Terraform Patterns for SOC 2 Compliance”
Even a rejected submission gets your name in front of the content committee
If accepted, this is an instant credibility multiplier

3. Gartner IAM Summit Attendance + Networking High Impact

1,500+ attendees, 20+ Gartner analysts
You will not speak here initially, but attending and networking aggressively puts you in the room with your exact buyers
Collect contacts. Follow up within 48 hours.
Cost: ~$3,000–4,000 registration. Worth it if you convert even one lead.

4. Writing for Industry Publications High Impact

Target publications: CSO Online, Dark Reading, SC Magazine, ISACA Journal, Help Net Security

Do not pitch generic articles. Pitch specific, opinionated, data-backed pieces:

“Why 80% of Mid-Market SOC 2 Audits Fail on Identity Controls”
“The $50K Mistake: When Companies Over-Invest in IGA Tooling Before Fixing Governance”
“Terraform for Identity: Why Infrastructure-as-Code Is the Future of IGA”

Frequency: 1 published article per quarter is sufficient. Quality over quantity.

How to pitch: Most of these publications accept contributor submissions. Find the editor on LinkedIn, send a 3-sentence pitch with a proposed headline and 3-bullet outline.

5. Contributing to NIST/Industry Frameworks Very High Impact

NIST holds public comment periods on SP 800-63 (Digital Identity Guidelines) and other identity-related publications
Submitting substantive comments gets your name in NIST records
This is a long game but an extremely credible signal: “Contributed to NIST SP 800-63 revision”
Watch for comment periods at csrc.nist.gov

What is a waste of time:

Personal blog posts on your own site (unless they rank for SEO keywords your buyers search). Nobody reads consultant blogs. Write for other people's audiences.
Podcasts you create yourself. Guest on other people's podcasts instead. Security Weekly, Identity at the Center, and CISO Series accept guests.
Twitter/X threads. Your buyers are on LinkedIn, not Twitter.
Webinars with no co-host. Solo webinars look desperate. Co-host with a complementary provider (an auditor, an MSP, a compliance platform).

8. Pricing as Credibility Signal

Your current pricing is correctly structured. Your tiered, productized model ($3,500 / $8,500 / $5,000 / $1,500 monthly) already signals “professional consultancy” rather than “freelancer billing hourly.” Productized services command premium perception because clients are buying an outcome, not your time.

Specific pricing psychology to apply:

1. Never quote hourly rates.

The moment you say “$200/hour,” you are a freelancer. Your assessment is $3,500. Period. If a client asks “how many hours is that?” respond with: “The assessment is scoped to deliver a complete identity governance gap analysis mapped to your compliance framework. It typically takes 8–12 business days from kickoff to final deliverable.”

2. Three-tier anchoring is correct.

Your structure (Assessment at $3,500 → Buildout at $8,500 → Hardening at $5,000) creates a natural upsell path. 68% of buyers choose the middle option in a three-tier structure. The Assessment is your entry point; the Buildout is your core revenue.

3. The Advisory Retainer ($1,500/mo) is your most important product.

This is recurring revenue AND a credibility signal. Frame it as: “Ongoing identity governance advisory to maintain compliance posture between audit cycles.” This positions you as a long-term strategic partner, not a one-off contractor.

4. Add a premium tier.

Consider a “Comprehensive IGA Program” at $15,000–$20,000 that bundles Assessment + Buildout + 3 months of Advisory. This serves two purposes:

Anchors the Buildout as the “middle” option (making $8,500 feel reasonable)
Captures clients who want a complete solution and would otherwise go to a larger firm

5. Proposals should show “Value Comparison.”

In every proposal, include a section: “How This Compares.” Show what a comparable engagement would cost from a Big Four firm ($50K–$150K for comparable scope) and from a generalist freelancer ($2K–$5K but with no methodology, no frameworks, no deliverable templates). Position yourself in the “expert boutique” middle.

6. Payment terms signal professionalism.

Net 30 (standard enterprise terms)
50% upfront for new clients (protects you, signals you are in demand)
Monthly invoicing for retainers
Accept ACH, wire, and check. Credit card is fine but do not lead with it.

9. Network Effects: Building the Referral Flywheel

The Three Referral Partners Who Serve Your Exact Buyer

1. SOC 2 / Compliance Auditors

Why they refer: Auditors frequently identify IGA gaps during SOC 2 readiness assessments but cannot fix them (independence rules). They need someone to refer clients to for remediation.

How to build these relationships:

Identify 5–10 boutique SOC 2 audit firms in your geography or target verticals
Offer to present to their team on “Common IGA Findings in SOC 2 Audits and How to Remediate”
Create a one-page “IGA Remediation Services” document they can hand to clients
Propose a formal referral arrangement: you refer clients who need audits to them, they refer clients who need IGA remediation to you

Target firms: A-LIGN, Schellman, Prescient Assurance, Johanson Group, or regional firms

2. Managed Service Providers (MSPs)

Why they refer: MSPs manage infrastructure but typically lack deep IGA expertise. When their clients need identity governance for compliance, they need a specialist.

How to build these relationships:

Join MSP-focused communities and events (Channel Futures, ASCII Group)
Offer white-label IGA services: the MSP maintains the client relationship, you deliver the IGA work under their brand
Create a “Partner Program” page on your site aimed at MSPs
Pricing for MSP partners: wholesale rate (20–30% discount off retail) in exchange for volume and no sales effort on your part

3. Cybersecurity / Privacy Legal Counsel

Why they refer: Attorneys advising on data privacy, breach response, and compliance often need to recommend technical consultants for implementation. They want someone they trust will not create legal risk.

How to build these relationships:

Attend local bar association technology law events
Offer CLE (Continuing Legal Education) presentations on IGA topics
Have your MSA and SOW templates reviewed by one of these attorneys (they become invested in your success)

The Flywheel Mechanics

Auditor finds IGA gap -> Refers client to you
You deliver Assessment -> Recommend specific controls
Client needs audit -> You refer to auditor
Auditor gets business -> Auditor refers more clients to you

This is a closed loop. One strong relationship with one audit firm can generate 3–5 referrals per year. Three such relationships, and you have a pipeline.

What to avoid:

Paying for referrals. Ethical issues aside, it signals desperation and creates bad incentives. Trade referrals, do not buy them.
Referral “platforms” and lead generation services. These leads are garbage. Upwork, Thumbtack, Bark — avoid all of them. Your buyers do not shop there.
Trying to build referral relationships with competitors. Other IGA consultants are not going to refer work to you unless they are genuinely overbooked. Focus on adjacent professionals, not peers.

10. The 90-Day Credibility Sprint

Week 1–2: Foundation

File LLC in Pennsylvania ($125, online, 1–2 days processing)
Get EIN from IRS (free, immediate online)
Open business bank account (same day at most banks)
Purchase E&O + Cyber Liability insurance bundle (TechInsurance or Insureon, same day)
Join ISACA ($135, immediate)
Register for Okta Certified Administrator exam and begin studying
Write your Information Security Policy (2–3 pages, covers your own practices)
Complete the VSA Questionnaire proactively
Request LinkedIn recommendations from 10 former colleagues/managers who know your IGA work

Week 3–4: Certification & Content

Pass Okta Certified Administrator exam
Begin studying for Okta Certified Consultant
Write first anonymized case study from past work experience
Draft your continuity plan (1–2 pages addressing key person risk)
Improve Terraform module READMEs on GitHub with architecture diagrams and professional documentation
Identify 5 SOC 2 audit firms in your target market for referral partnerships
Start LinkedIn posting cadence (3x/week, IGA insights)

Week 5–6: Partnerships & Outreach

Pass Okta Certified Consultant exam
Apply for Okta Elevate Partner Program
Attend your first local ISACA chapter meeting
Email 3 SOC 2 audit firms proposing a “lunch and learn” or virtual introduction
Pitch your first article to CSO Online, Dark Reading, or SC Magazine
Identify and reach out to 3 MSPs in your target verticals
Complete second anonymized case study

Week 7–8: Social Proof Push

Conduct first pro bono assessment (in exchange for testimonial + case study + reference rights)
Collect and publish first testimonial on your site
Propose a speaking slot at your local ISACA chapter
Begin CISM study plan (target exam in month 5–6)
Create a “Partner Program” page on accessnarrative.com for MSPs

Week 9–10: Pipeline Building

Conduct second pro bono assessment
Publish first article in industry publication (or have it accepted)
Formalize first referral relationship with an audit firm
Collect 3+ testimonials (from pro bono + any early paid clients + past colleagues)
Submit to Identiverse CFP if timing aligns (or note the deadline for next cycle)

Week 11–12: Consolidation & Scale

Publish case studies and testimonials across your site, LinkedIn, and proposals
Deliver your first ISACA chapter presentation
Review and refine your proposal templates incorporating all new credibility signals (certs, insurance, testimonials, case studies, partner badges)
Audit your trust center page — make sure it reflects everything you have built in 90 days
Assess pipeline: How many conversations are you in? Where are they stalling? Adjust strategy based on real feedback.
Decide on CISSP timeline based on experience qualification and revenue trajectory

End-of-Sprint Success Metrics

Metric	Target
Certifications earned	2 (Okta Admin + Consultant)
Insurance policies active	2+ (E&O + Cyber Liability)
LLC formed and operational	Yes
Testimonials collected	5+
Case studies published	3+
LinkedIn recommendations	10+
ISACA chapter presentations	1
Referral partner relationships	2–3 (audit firms or MSPs)
Articles pitched to publications	2+
Okta partner program status	Applied or active
Paid engagements closed	2–3 (stretch goal)

The Bottom Line

The dirty secret of mid-market procurement is this: they do not actually want to hire Deloitte. They want to hire someone who makes them feel as safe as hiring Deloitte. That feeling comes from:

Proof you are real (LLC, insurance, business infrastructure)
Proof you are competent (certifications, case studies, published work)
Proof others trust you (testimonials, references, partner badges)
Proof they are not taking a risk (continuity plan, documentation-first approach, insurance)

Stack these four layers and the “you are too small” objection evaporates. You are not too small. You are specialized. And in identity governance, specialized is exactly what they need.

This document should be reviewed and updated quarterly as credibility signals accumulate and market positioning evolves.

Credibility Strategy / Narrative Consulting