FAQ Library — Enterprise-Grade SMB Services
Use this as a modular “FAQ bank” for your website, one-pagers, proposals, and sales emails.
How to use: For each question, pick one answer style that matches your brand voice:
- [Exec] Calm, board-friendly, risk-aware
- [Direct] Clear, practical, no fluff
- [Bold] Contrarian, punchy, memorable
Service tags: [SEC] Security Assessment • [DR] Disaster Recovery Verification • [MIG] Data Migrations • [CRM] CRM Setup • [INT] Systems Integration
Audience tags: [CEO] [Ops] [IT/MSP] [Nonprofit] [SaaS]
Quick-Select FAQ Packs
Pack A — Minimal (Website Starter, 12 FAQs)
- What do you actually do?
- Who is a good fit? Who is not?
- How fast can we start?
- How do pricing and prepay work?
- Do you replace our MSP/IT team?
- What access do you need? Is it safe?
- What do we get at the end (deliverables)?
- How disruptive is this?
- How do you handle confidentiality / data?
- “Can’t AI handle this?”
- What if you find something serious?
- What happens after the project?
Pack B — Full (Website + Sales Enablement, 25 FAQs)
Pack A + scope/limitations, pentest vs assessment, compliance/insurance, SLAs, on-site vs remote, tool recommendations, change management, documentation/training, guarantees, ownership/hand-off.
Pack C — Service-Specific (Pick the relevant section below)
- Security: “assessment vs pentest”, evidence, remediation, user risk, vendor risk
- DR: RTO/RPO, restore drills, vendor retention vs backup, ransomware scenario
- Migrations: downtime/rollback, data integrity, cutover, validation, permissions
- CRM: platform choice, adoption, workflow design, training, reporting
- Integrations: APIs, iPaaS vs custom, monitoring, data quality, security
Global FAQs (Firm / Process / Trust)
1) What do you actually do?
[Exec] We deliver enterprise-grade outcomes for small and mid-sized teams: verified security posture, recovery readiness, and systems that work together. We don’t just “advise” — we produce evidence-backed findings, a prioritized execution plan, and (if desired) implement the highest ROI fixes.
[Direct] We help you stop guessing. We assess risk, verify backups with restore drills, migrate data cleanly, set up CRMs that people actually use, and integrate your systems so information flows reliably.
[Bold] We fix the gap between “we think we’re covered” and “we’re actually covered.” Proof artifacts, real checklists, tested recovery — not security theater.
2) Who is a good fit for your services?
[Exec] You’re a fit if you value reliability, accountability, and documentation — and you’re willing to assign an internal point person for decisions.
[Direct] You’re a fit if you’re busy, you know things are messy, and you want a clear plan + execution without a months-long project.
[Bold] You’re a fit if you want fewer surprises and don’t want to “buy another tool” as a strategy.
3) Who is not a good fit?
[Exec] Organizations looking for a purely compliance checkbox, or who cannot provide required access and decision-making bandwidth, are usually not a fit.
[Direct] Not a fit if you want “free advice,” won’t assign an owner, or want outcomes without changing anything.
[Bold] If you want a 40-page PDF and no action, we’re the wrong shop.
4) How fast can we start?
[Exec] We reserve delivery slots and can typically begin within 1–2 weeks, sometimes sooner depending on scope and access readiness.
[Direct] If you can sign and provide access, we can often start this week or next.
[Bold] The bottleneck is rarely us — it’s access and decision-makers. If you can move, we can move fast.
5) How does pricing work? Do you bill hourly?
[Exec] We prefer fixed-fee packages with defined deliverables and timelines. Larger work uses milestone pricing with deposits.
[Direct] No hourly surprise bills. You buy a package or a sprint with a clear scope and a clear finish line.
[Bold] We don’t sell time. We sell completion.
6) Do you require prepay? Why?
[Exec] Yes, prepay reserves a delivery slot and aligns incentives around outcomes rather than time.
[Direct] Prepay keeps things simple and prevents scope creep. We commit to delivery; you commit to the slot.
[Bold] Prepay is how we keep projects moving and avoid “endless review cycles.”
7) What’s included vs out of scope?
[Exec] Each package has explicit deliverables, assumptions, and exclusions. Anything beyond scope is quoted as a small add-on sprint.
[Direct] We’ll define what’s in and out in writing. No fuzzy boundaries.
[Bold] If it’s not on the deliverables list, it’s not included — until we agree otherwise.
8) Do you replace our MSP / internal IT team?
[Exec] No. We complement your team with specialist verification, planning, and execution where needed. We aim to make your IT function more effective.
[Direct] We don’t fight your MSP. We give them a prioritized list they can execute, and we handle the tricky parts if they prefer.
[Bold] We’re not here to steal your IT vendor. We’re here to make the boring failures stop.
9) What access do you need? Is it safe?
[Exec] We follow least-privilege principles. Where possible we use read-only access or guided screenshare. Access requirements are documented per engagement.
[Direct] Typically: workspace admin review (read-only), backup tool access, and a list of systems/users. We can work through your MSP.
[Bold] We don’t ask for the keys to the kingdom unless it’s necessary — and we document everything we touch.
10) How do you handle confidentiality and sensitive data?
[Exec] We sign NDAs, follow strict data-minimization, and retain only what’s needed for deliverables. We can align to your data handling requirements.
[Direct] We don’t hoard your data. We collect what we need, deliver the artifacts, and clean up.
[Bold] Your data is not our “training set.” We treat it like it’s radioactive.
11) Do you work on-site or remote?
[Exec] Most work is remote; on-site sessions are available when they improve alignment (workshops, tabletop exercises, cutovers).
[Direct] Remote by default. On-site if needed.
[Bold] We’ll show up if it matters — but we won’t waste your money on theater.
12) What do we receive at the end?
[Exec] You receive executive-ready deliverables, a prioritized backlog, and an implementation path with owners and dates.
[Direct] You’ll walk away with: findings, evidence, a plan, and next steps your team can execute.
[Bold] You’ll get receipts: what’s real, what’s not, and what to do next.
13) What if you find something serious or urgent?
[Exec] We escalate immediately with recommended containment steps and options for an expedited response plan.
[Direct] If there’s a critical risk, we tell you right away and prioritize fixes.
[Bold] We don’t bury bad news in a report. We call you.
14) “Can’t AI verify our security / migration / integration?”
[Exec] AI can accelerate analysis but cannot replace accountable scope, verification, evidence, and decision-making. We use AI as an assistant within a disciplined process.
[Direct] AI can spot patterns. It can’t run your restore drill, own your cutover plan, or be accountable when something breaks.
[Bold] AI is a junior analyst. You still need a senior who’s responsible for the outcome.
Service FAQs — Security Assessment [SEC]
15) What’s the difference between a security assessment, vulnerability scan, and penetration test?
[Exec] An assessment evaluates posture and process, a scan identifies known weaknesses, and a penetration test simulates adversarial exploitation. We typically begin with assessment + targeted scanning, then recommend pentesting only when warranted by risk and maturity.
[Direct] Scan = automated findings. Assessment = what matters + why + what to do. Pentest = deeper, scoped exploitation.
[Bold] Scans find noise. Assessments find priorities. Pentests test reality under pressure.
16) What systems do you assess?
[Exec] Common scope includes identity/access, email security, endpoint posture overview, key SaaS/vendor exposure, and critical workflows like vendor payments and payroll changes.
[Direct] Workspace, admin access, email risk, key apps, and the workflows attackers abuse.
[Bold] The stuff that steals money and locks companies out: identity, inboxes, and approvals.
17) Will you recommend a bunch of new tools?
[Exec] We prioritize leveraging and hardening what you already pay for. New tools are recommended only when there is a clear gap and ROI.
[Direct] We start with configuration and process fixes before new purchases.
[Bold] Buying tools first is how security budgets die.
18) Can you help implement the fixes?
[Exec] Yes via implementation sprints, or we can hand off to your MSP/internal team with clear steps and acceptance criteria.
[Direct] We can do it or your team can do it. Either way we make it clear.
[Bold] We’ll roll up sleeves—or we’ll hand your team the exact checklist.
Service FAQs — Disaster Recovery Verification [DR]
19) What’s the difference between backup, retention, and disaster recovery?
[Exec] Retention keeps versions for a period; backup is an independent copy; disaster recovery is the planned ability to restore operations within defined objectives. We validate all three with evidence.
[Direct] Retention isn’t backup. Backup isn’t DR. DR is “can we run again on time?”
[Bold] If you can’t restore on command, you’re not backed up.
20) What is a “restore drill” and why does it matter?
[Exec] A restore drill is a controlled, documented restoration of selected critical data/systems to prove recovery capability and surface gaps before an incident.
[Direct] It’s a practice restore—so you know it works before you need it.
[Bold] Backups you haven’t tested are optimism.
21) Do we really need independent backups if we’re in the cloud?
[Exec] Often yes. Cloud platforms are resilient, but independent backups protect against accidental deletion, ransomware, misconfiguration, and account compromise. We assess your risk and recommend the right level of independence.
[Direct] Usually, yes—especially for email/files and critical SaaS.
[Bold] The cloud is not a time machine by default.
Service FAQs — Data Migrations [MIG]
22) How do you reduce downtime and risk during a migration?
[Exec] We plan cutovers with phased approaches, rehearsals, validation checks, and rollback plans. Critical migrations are staged to reduce operational impact.
[Direct] Cutover plan + validation + rollback. No surprises.
[Bold] The difference between a good migration and chaos is a real rollback plan.
23) How do you validate data integrity?
[Exec] We define acceptance criteria (counts, reconciliation, sampling, and functional tests) and document results.
[Direct] We verify counts, spot-check records, and run functional tests.
[Bold] “It looks fine” is not validation.
Service FAQs — CRM Setup [CRM]
24) How do you prevent “CRM shelfware” (nobody uses it)?
[Exec] We design around real workflows, keep fields minimal, define ownership, and build reporting that leaders actually review weekly. Adoption is built, not hoped for.
[Direct] Simple workflows + clear fields + useful dashboards + training.
[Bold] If leadership doesn’t use the dashboard weekly, the CRM will die.
25) Can you integrate the CRM with our other tools?
[Exec] Yes—email, marketing, accounting, support, and data platforms. We choose iPaaS vs custom based on reliability, cost, and maintainability.
[Direct] Yes—CRM is only useful when it connects to reality.
[Bold] A CRM that doesn’t integrate becomes a second job.
Service FAQs — Systems Integration [INT]
26) iPaaS (Zapier/Make/etc.) vs custom code — what do you recommend?
[Exec] We choose based on criticality, complexity, security, and long-term maintenance. Low-risk automations often fit iPaaS; mission-critical workflows often need more robust engineering and observability.
[Direct] If it’s critical, we engineer it. If it’s simple, we automate it cheaply.
[Bold] Don’t run payroll logic through a fragile zap.
27) How do you handle reliability and monitoring?
[Exec] We build in retries, logging, alerting, and clear runbooks so failures are visible and recoverable.
[Direct] We add monitoring and error handling so you’re not blind.
[Bold] If it fails silently, it’s not an integration—it’s a liability.
FAQ Components You Can Reuse Anywhere
Signature lines (pick 1–2):
- “Retention isn’t backup.”
- “If you can’t restore on command, you’re not backed up.”
- “AI is a junior analyst. Accountability is human.”
- “We don’t sell tools first—we verify what you have.”
- “We don’t sell hours—we sell completion.”
One-sentence value props (pick 1):
- “We verify your exposure and your recovery—and leave you with a prioritized backlog.”
- “We reduce risk by fixing the boring failure modes most teams ignore.”
- “We make your systems reliable enough to scale—without enterprise bloat.”