Start a consulting company.... what will it take?

TheFORCE

What will it take to start a consulting company? I'm talking specifically with the people at TE. A bunch of us, maybe 5 or 10 or more getting together to creating a consulting firm. We all have various background, various experiences and everyone has their strong areas. Do you think it could work?

This is just theoretical, just an idea now. What do you guys think?

stryder144

I've been toying with the idea of putting one together. Unfortunately, I haven't moved past the toying phase. I am quite interested to see what others bring to the table on this.

DatabaseHead

Would need a good point man who has a lot of energy and the ability to sell.

MitM

I had a consulting company a few years ago. With a full-time job, finding the was the toughest part. I wound up taking a lot of projects on the west coast due to the time difference.

GeekyChick

I'm working with a team of security folks right now trying to launch a cybersecurity consulting company. We have been working at it for about 6 months now. I know you didn't ask what some of the difficulties were, but DatabaseHead is spot on. One of our problems is finding someone who has enough tech knowledge to sell our services and write a marketing plan. Also it's been difficult to find someone who could write a business plan. We have very smart and technical people on our team but we are lacking in those areas. So as you build your team don't forget that you need to find people strong in business and sales.

I personally think there is a need for this otherwise I wouldn't have joined the team I am on. I think if you find a niche that other companies aren't addressing that would also give you an advantage. What kind of business were you interested in starting?

bigdogz

It has basically been word of mouth for me. I have received 4 side jobs that have paid well and help me grow my business.
You need a DBA, a separate bank account for the company, .... a website would help.
I perform Forensics, Pen tests, and VA's. The extra money has help me buy some more tools and some Infosec classes.

wd40

GeekyChick wrote: »

I'm working with a team of security folks right now trying to launch a cybersecurity consulting company. We have been working at it for about 6 months now. I know you didn't ask what some of the difficulties were, but DatabaseHead is spot on. One of our problems is finding someone who has enough tech knowledge to sell our services and write a marketing plan. Also it's been difficult to find someone who could write a business plan. We have very smart and technical people on our team but we are lacking in those areas. So as you build your team don't forget that you need to find people strong in business and sales.

I personally think there is a need for this otherwise I wouldn't have joined the team I am on. I think if you find a niche that other companies aren't addressing that would also give you an advantage. What kind of business were you interested in starting?

This.

I have a friend that decided to start a restaurant business, he decided to cut corners and save money (I can make my own business plan, and design the place, and apply for permits etc etc) it ended up costing him 2 times the plan and delayed the opening for 6 months (total cost was around 400k US$) two years later he just started making tiny profits.

So if you need sales people get sales people, don't decide to do it yourself.

jamesleecoleman

I'm interested to know. I'm thinking about doing IT consulting for small schools in a couple of years.

BuhRock

You need a business development person firstly. It's a good idea to have a lawyer on standby and someone who can help draft up SOWs and respond to RFPs. Are you going federal or commercial, or both? If federal, you'll need to get on the GSA 70 schedule. You'll probably benefit from 8a or a hubzone certification as well, check out www.sba.gov

bigdogz

wd40 wrote: »

This.

I have a friend that decided to start a restaurant business, he decided to cut corners and save money (I can make my own business plan, and design the place, and apply for permits etc etc) it ended up costing him 2 times the plan and delayed the opening for 6 months (total cost was around 400k US$) two years later he just started making tiny profits.

So if you need sales people get sales people, don't decide to do it yourself.

Correct. It is more difficult to find the customers, write the paperwork and perform the projects assigned. In some cases you may have some customers by word of mouth after you have done a great job.

In my case, I am just filling some space, time, and my wallet for some side work.

thomas_

You would want some thoroughly fleshed out joint venture/partnership agreement with every person that is a part of the consulting firm.

TheFORCE

OK we have gotten some good feedback so far.

1. We will need a contract that identifies the entity (the firm) and the people involved, their commitment etc etc.
2. We will need a business plan, this should be high level, maybe 2 or 3 pages long. Identifying what our approach will be, what we will offer, where we will focus, how we will do it.
3. We will need to identify where we will focus our energy and time, federal, private, commercial. Honestly, I think we should be starting small and not get involved with federal contracting gigs. Instead focus on our areas where we live, this makes it more personal, the market could be, private schools, doctors office, small law firms, travel agencies, accounting offices, insurance offices.

Any other ideas?

Ertaz

I'd be in. Would we figure out what our services were and then market them in the areas we each live in? There are a number of businesses around me who don't know anything about security. Would it be only consulting or would we offer some form of managed security services for folks who couldn't afford their own staff?

TheFORCE

Ertaz wrote: »

I'd be in. Would we figure out what our services were and then market them in the areas we each live in? There are a number of businesses around me who don't know anything about security. Would it be only consulting or would we offer some form of managed security services for folks who couldn't afford their own staff?

That's a good point, for now I think we should offer simple services, like user training, assessments, policy creation, control gaps. As we mature these services, we can pitch assistance with closing the gaps etc by providing some type of managed service. Again, i think it would easier to adjust if we start slow and grow organically rather than trying to do to much too soon.

MitM

TheFORCE wrote: »

OK we have gotten some good feedback so far.

1. We will need a contract that identifies the entity (the firm) and the people involved, their commitment etc etc.
2. We will need a business plan, this should be high level, maybe 2 or 3 pages long. Identifying what our approach will be, what we will offer, where we will focus, how we will do it.
3. We will need to identify where we will focus our energy and time, federal, private, commercial. Honestly, I think we should be starting small and not get involved with federal contracting gigs. Instead focus on our areas where we live, this makes it more personal, the market could be, private schools, doctors office, small law firms, travel agencies, accounting offices, insurance offices.

Any other ideas?

Don't forget insurance

Kinet1c

You need customers, everything else is easy. Finding and convincing customers that you should be the one to manage their IT/project is the hard part.

TheFORCE

MitM wrote: »

Don't forget insurance

What type of Insurance and why would we need insurance if we offer assessments and services where the customer is made aware that they are responsible for mitigating? That's why i didnt want to jump into managed services or project implementations right away.

TheFORCE

Kinet1c wrote: »

You need customers, everything else is easy. Finding and convincing customers that you should be the one to manage their IT/project is the hard part.

Thats where we would have to make some flyers and distribute them around i guess.

Blucodex

Stand up a quick website and social media presence. Will probably have to do a lot of low end jobs until the clientele base is stronger.

The hard part will be finding the time and choosing partners that are as dedicated as you are. Let me know if there's a chance for remote work

JoJoCal19

TheFORCE wrote: »

What type of Insurance and why would we need insurance if we offer assessments and services where the customer is made aware that they are responsible for mitigating? That's why i didnt want to jump into managed services or project implementations right away.

Errors and Ommissions (E&O) insurance is a must. It's there to CYA for financial damages in case you screw up. For example let's say you bring down a company's website on accident and cost them $150k in lost sales. You want the E&O to be able to cover that.

ITSec14

TheFORCE wrote: »

OK we have gotten some good feedback so far.

1. We will need a contract that identifies the entity (the firm) and the people involved, their commitment etc etc.
2. We will need a business plan, this should be high level, maybe 2 or 3 pages long. Identifying what our approach will be, what we will offer, where we will focus, how we will do it.
3. We will need to identify where we will focus our energy and time, federal, private, commercial. Honestly, I think we should be starting small and not get involved with federal contracting gigs. Instead focus on our areas where we live, this makes it more personal, the market could be, private schools, doctors office, small law firms, travel agencies, accounting offices, insurance offices.

Any other ideas?

I think targeting local markets is a good approach. Most local organizations/businesses don't have the means to hire a security team or contract the larger firms. Government contracts can be very competitive and resource intensive so I would definitely not go there.

Nerkle

One of the hardest things about running a business is finding clients which involves marketing yourself. There is a question on who is your customers. The reason why this is important is how much you want to invest in marketing and getting the right customers(premium services or everyday services to all).

If you are aiming for local businesses, head to local business conventions(this does not need to be specifically cybersecurity, even startups need consultants) and see if you can book a booth there or able to attend the different local networking events in cybersecurity. If you want to go to a national and international level, you will need to do a bit more leg work and have some great social networking in your arsenal. The way to go about that is to have a twitter and facebook for your business along with your main website, and announce to your audience and customers where your crew will be at not just local cyber and business conventions but take trips to the bigger conventions out of state and save up for ones that are out of country as well. Not only that, but you can hire someone to set up SEO so your consulting website will be the first on search engines so people can contact you first or find your linkedin, facebook, twitter page. For people who love your service, ask for recommendations and testimonies on your business' linkedin or facebook so that the good reviews will eventually start piling up in searches.

If starting small, I would still definitely suggest investing a little into social media so people can find your company, find your recommendations, as well as the sharing a section in your About Us page that shows the bigger clients you have worked with once you do eventually get bigger businesses on board.

A final word on marketing is to set up a blog or a youtube series that shares small cybersecurity trends and safety tips that can then link back to your website. It can help bring in people as well as give a face to your business pending on the blog's style or whoever is hosting the youtube series and the editing for it. Though that can come later too. The idea is to give some useful free content so people will be interested in what your premium services would be like.

Network_Engineer

Count me in. I am looking for after hours projects.

EANx

Most new consulting companies have the tech part down, they need someone who can do sales as well as all of the program management stuff. They need someone who can write proposals, figure out the insurance and tax side, know when you're about to run afoul of laws related to HR, etc. I second the recommendation to talk to someone from the Small Business Admin. if you're in the US.