Compliance-Ready Offering at HarborWatch MSSP
HarborWatch is a managed security provider with 40 mid-market clients and three service tiers. Sales wants to launch a 'Compliance-Ready' offering in 90 days, promising 24/7 monitoring, audit evidence packs and a dedicated compliance adviser. Twelve clients have expressed interest; three need HIPAA support and two need PCI DSS. HarborWatch currently runs an 8x5 security operations centre, has no dedicated compliance lead and has never produced an audit evidence pack. Gross margin on existing tiers is 18%; the new price assumes 30% margin. The sales director argues that 'compliance sells itself' and wants to pre-sign clients. The service manager warns the SOC cannot cover 24/7 without new hires, which are not budgeted. You are asked to assess the offering before launch.
1. Should HarborWatch launch the offering as sold, reposition it, or defer it? Use service-offering and value-proposition reasoning.
Read the worked answer
Reposition, do not launch as sold. An offering is a bundle of services, outcomes, service levels, costs and risks, not a sales label. The promise of 24/7 monitoring conflicts with an 8x5 SOC; a dedicated compliance adviser does not exist; audit evidence packs are unproven; and the 30% margin assumption is untested. HIPAA and PCI DSS support also require scoped evidence and customer responsibilities, not just interest from five clients. Launching as sold would create service-level and legal risk. A defensible move is an 8x5 'compliance evidence readiness' offering with explicit exclusions, a roadmap to 24/7, and a pilot with two clients. Defer the 24/7 claim until staffing and evidence production are proven.
2. Define the minimum viable offering boundaries, including customer responsibilities and service levels.
Read the worked answer
Minimum viable offering: 8x5 monitoring for agreed asset classes; a monthly evidence pack covering a defined control set; a quarterly review with the client; onboarding that records scope, regulatory drivers and customer responsibilities. Exclude 24/7 coverage, a dedicated adviser and any guarantee of compliance or audit success. Set service levels for alert response, evidence delivery and review timeliness; state client duties such as timely log access, control ownership and accurate scope data. Price from actual SOC and evidence-production cost, not the hoped-for margin. Publish it in the service catalogue so sales cannot vary it verbally without a change process.
3. How should sales and product management manage expectations with the 12 interested clients?
Read the worked answer
Qualify the 12 interested clients by regulatory driver, scope and willingness to accept the current boundaries. Give sales a written capability statement, a standard demo and a qualification checklist; prohibit pre-signing 24/7 or dedicated-adviser promises. Offer a pilot to two clients with clear success criteria and a feedback loop into product management. Where a client needs HIPAA or PCI DSS, treat it as a scoped project with legal and evidence review, not a standard tier. Manage expectations through contract terms and service-level definitions, and track lost deals to learn whether the gap is capability, price or sales behaviour.