Stop 8 of 8 · Weekly
Curtis's practice and week
The business behind the work: proposals out, contracts signed, invoices paid, referrals earned, and three routines that run without you.
The half of the job nobody trained you for
Curtis was good at the work long before he was any good at selling it. A consulting practice runs on documents that have nothing to do with security: the proposal follow-up, the contract, the invoice, the scope change, the referral note, the page on the website that makes a chief of staff pick up the phone.
None of it contains client data, which makes it the safest ground in this course and the easiest place to hand work over.
The contract is where the discipline in stop 1 stops being a habit and becomes a term. Curtis's engagement letter states what he holds, where he holds it, which contractors see it and what gets destroyed at the end of a movement. Clients notice that clause, and more than one engagement has turned on it. Invoices carry the same rule: an engagement code, hours by label, no site names in the line items, because an invoice travels through an accounts department that has never heard of any of this.
Three routines
Scheduled routines run on a timetable and leave you the output to read. Curtis runs three, all pointed at documents rather than at his diary.
| Routine | When | What it reads |
|---|---|---|
| Engagement digest | Monday morning | The practice Project: open proposals, deliverables due, invoices unpaid |
| Threat trend watch | Friday | A public research pass, no client, no place |
| Invoicing | First of the month | The engagement log with hours by label |
Try this
Write a four line follow-up email for a proposal sent eleven days ago with no reply. Reference one specific finding the Baseline tier closes and what it leaves exposed if nothing is done. Ask one question: whether the sticking point is scope or budget. No chasing language, no apology for emailing, no second copy of the proposal attached. Refer to the client only as your organisation. [paste the tier summary]
Write a complete sample threat and risk assessment for a fictional client, in my structure, on a fictional suburban residence with a fictional family and a fictional set of vulnerabilities. Fifteen pages of substance, invented from end to end, clearly marked as an illustrative sample on every page. This is what I send to prospects instead of real work, so make the reasoning show and make it defensible.
Write the services page for my consultancy. Three sections: assessment and program design, advance and travel work, training and exercises. For each, what the client actually receives as a deliverable, and what changes for them afterwards. Plain, specific, no stock security language, no promises of prevention, no claim about my background beyond nearly thirty years in policing before consulting. Then give me a shorter version for a one page leave-behind.
The capstone
Take a real engagement. Relabel the walkthrough notes, run the sorting prompt from stop 2, score the matrix yourself, build the three tier proposal from stop 3, then run the scrub pass from stop 1 over the whole thing before it goes anywhere. Count the identifying phrases it finds. When that number is zero on the first pass, the habit is yours.