💼 Compliance-as-a-Service is work you're already half-doing — given a name, a cadence, and a price. This worksheet scopes a client in ~20 minutes and hands you a defensible number. It supports pricing and scoping workflows — it is not legal, compliance, or audit advice. Pricing examples are ILLUSTRATIVE; set your own rates and have every contract reviewed by your attorney.

How to use this (3 steps)

1. Duplicate this page into your workspace (top-right).
2. One copy per prospect. Rename it: CaaS Scope — [Client].
3. Run the 12 scoping questions, pick a tier, sanity-check the margin math, then adapt the SOW outline.

Part 1 — Scoping: 12 questions before you quote

• [ ] Client size — seats / servers / sites
• [ ] Regulated data classes — PHI / PCI / PII / none
• [ ] Frameworks in play — insurer questionnaire only? CSF? An ISO/PCI ask from their customers?
• [ ] Current evidence state — 🟢 organized / 🟡 scattered / 🔴 none
• [ ] Audit or renewal date on the calendar?
• [ ] Who answers questionnaires today?
• [ ] Tooling access you'll have — RMM, IdP, backup console
• [ ] Vendor count (including AI tools)
• [ ] Prior incidents?
• [ ] Internal owner exists on the client side?
• [ ] Board / leadership reporting expected?
• [ ] What broke last time — "tell me about the last scramble"

🎯 Question 12 is the pitch. Their last fire drill is your opening story — you're selling the absence of that.