The Challenge

You need sell your Initial Risk Assessment to figure out how best to serve the client. That’s baseline. But here’s the problem. The client doesn’t always see the value in paying for that. A lot of times, they are only willing to pay for your labor to fix the problem.

They say, “Why do you need to do an initial risk assessment to figure out how to help me? You’re the expert. You should already know what to do.”

I hear it, too

I hear the exact same thing. My business is marketing, not compliance. But we have the same process, and our clients have the same misconceptions. We need them to understand we cannot know how best to apply our solutions until we know exactly what the problem is.

They say, “Oh, come on. You know what to do. You could come up with a 6-month plan in your sleep.”

Of course I could! But we’d be dreaming if we thought some random strategy would work without customizing it for your business.

What should we do about it?

I’m sure you’ve seen this to your business, as you deal with organizations seeking CMMC certification. How do you convince them of the value of starting with an initial risk assessment when they tell you you’re dreaming?

Or where you think THEY are dreaming?

Bring it back to reality. Relate it to something they understand, like going to the doctor.

Here’s an example. This is a true story. My dad was suffering from a lot of hip pain. He was really in excruciating pain. He’s like, “Man, I think I’m going to have to have my hip replaced because I’m in extreme pain. It really hurts. My hip really hurts.”

And after a long time complaining about it, we finally got him to go to the doctor.

First the nurse comes in, takes his vitals, and leaves. Then doctor comes in. My dad’s sitting on the table wearing one of those flimsy hospital gowns. “It’s really painful, Doc,” he says. “I’m almost 80 years old, and it looks like I’m going to need hip replacement surgery, like Al in my men’s group.”

The doctor nods. Then he looks over at the pile of my dad’s stuff on the chair. He says, “What’s this?”

And he picks up my dad’s wallet. And it’s literally THIS big. It’s this brick that he’s been stuffing with receipts and business cards and all kinds of things.

The doctor says, “How long have you been sitting on this?”

My dad admits it has been quite a while.

The doctor sets the wallet back on the pile of clothes and goes on with the physical exam. And when he’s done, he says, “You’re fine. You don’t need hip surgery.”

My dad was shocked. “Well, then, how do I make the pain go away?”

“Just don’t sit on that wallet anymore.”

He did what the doctor said. A few days later, the pain was gone.

That’s how people are. That’s what happens when we think we’re in trouble. We assume we have this extreme thing. We tell the doctor all about it, “I’ve got this extreme problem.” And then we’re like, “I know what’s wrong. I just need you to fix it.”

And the doctor says, “I’ve not done a diagnosis yet. It would be malpractice to start treating you without diagnosing you.”

You can see how this applies to defense contractors. When they can’t understand why it’s important to pay you for the initial risk assessment, try saying something like this:

“Look, it’s going to cost you a lot of money if you have us start working on something, only to find out six months later that we didn’t need to do that in the first place. Wouldn’t it be better to start with a diagnosis of what’s going on, so that I can give you the right solution?”

In the case of my dad, the right solution was not a hip replacement, but just telling him to remove the big, fat wallet from his pocket, and hold onto it.

Hold onto your money, dad. You don’t need surgery.

My dad said, “Oh, that makes sense.”

I use the doctor analogy all the time and I’ve never had one person say, “That doesn’t make any sense.”

So give it a try with new CMMC clients. You’ll get them saying YES to your initial risk assessment because it makes sense to them.

If this makes sense to you, be sure connect with me on LinkedIn. And let’s meet back here in the next blog post.