Week 1 of the MSP security playbook: look the part

The First 90 Days is Client Posture's free, 12-page playbook for new MSPs and for established MSPs adding a security line. It's a 13-week plan in three phases, and each week is 3–5 hours of focused work. Week 1 opens Phase 1 (Days 1–30, "Set up and baseline your clients and prospects"). It's called Look the part.

The playbook's goal for day 30 sets the tone: "every client baselined, 10 prospects contacted, and a branded look that makes you seem bigger than you are." Week 1 is the branded-look part.

The mindset: something true, useful, and branded

The playbook's "Start here" page puts it plainly: "You don't need to know everything about security. You need to show up with something true, useful, and branded, every time." In its words, clients hire the MSP "who notices problems first, explains them plainly, and fixes them for a fair price."

Week 1 gets you ready to do that before you show anything to a client.

The four tasks in week 1

1. Scan your own domain first, and fix what's verified

This is the first instruction in the playbook. The reasoning: "Prospects will check you, and you'll sell this with more confidence once you've lived it."

In practice, run the same external check on your own domain that you'll later run on clients. Fix anything that comes back as a verified fail. If your own DMARC is sitting at p=none, or your SPF record is over the lookup limit, sort that out now. The playbook's "finding to conversation" sheet leads with exactly these email findings, and you'll be explaining them to clients in a few weeks.

2. Put your brand on every report and quote template

The playbook lists four things that belong on every report and quote template: your logo, colors, booking link, and payment link. By week 2 you'll be sending reports to every existing client, and by week 4 briefs to prospects, so set these templates up once now.

3. Write down your service list and prices, and cut what you can't deliver

"Turn off anything you can't deliver yet. A short menu you can deliver beats a long one you can't." This is the most important discipline in week 1. Later weeks build on this list: week 5 packages a paid assessment, week 6 sends Good / Better / Best proposals, and week 7 adds recurring add-ons.

For prices, page 10 of the playbook has example pricing. Every figure is labeled either EXAMPLE (illustrative) or CONTEXT (a published third-party figure). The playbook says to treat them as "starting points to adapt, not recommendations or guarantees," and to set yours "from your costs and market."

4. Turn that list into a one-page service menu

The last task is a one-page service menu, as a PDF or a link. It's what you'll point people to when they ask, "So what would you do about it?"

Adopt the one rule now

The playbook sets one rule for all 90 days: "never put a claim in front of a client that you can't back up." It explains why: "The fastest way to lose a client's trust is a scary finding that turns out to be wrong."

Every check should land in one of three buckets: verified pass, verified fail, or unknown / not tested. Only verified fails become recommendations, tickets, or line items on a quote. Unknowns get an honest sentence: "Here's what's public, and here's what we'd check next."

The playbook pairs the rule with guardrails for every email, call, and report:

• No breach claims, and no "you've been hacked."
• Don't call an external check a pentest.
• Insurance answers belong to the applicant.
• Policies are templates, not legal advice.
• Lead with what's working, then the gaps.
• End every conversation with one next step.

It's worth building these into your templates in week 1, so every deliverable follows them by default.

Why email security comes first

The playbook recommends leading with email security because it's "visible from the outside, easy to show on screen, and easy to explain." It's also "a fix you can scope, price, and finish in about a week, which makes it a good first paid project." That's another reason to get your own SPF, DKIM, and DMARC right this week.

A note on timing

The playbook advises that if you use a free trial of any tool for this phase, you should start it on a day when you can do weeks 1–3 in one push, because "the setup and bulk scans are the heavy lifting." Client Posture's trial is 7 days of Pro, with no card required and no auto-charge, and you keep your data afterward.

Where Client Posture fits this week

The playbook is clear that you can run it with spreadsheets, free DNS checkers, and a word processor. For week 1, its "In Client Posture" note says: upload your logo and colors, scan your domain, and start from a 48-service Service Library with editable prices. 10 core services come pre-selected, and the branded service menu is generated from it.

On plans: Pro includes the Service Library, where you can edit services and prices, and the branded service menu. The 7-day Pro trial gives you both. Founding Partner includes logo and colors and the branded service menu (PDF or share link, with or without prices), but not the Service Library. On Founding Partner, the menu is built from Client Posture's default services and prices, which you can't edit, so you can't turn services off or re-price them in the app. If you're on Founding Partner, keep your own priced list (step 3) separately. Scanning your own domain is free, with no signup needed.

Week 1 checklist (from the playbook's 90-day checklist)

• Scan my own domain; fix verified fails
• Logo, colors, booking and payment links set
• Service list priced; undeliverable items off
• One-page service menu ready

Start week 1 now

Grade your own domain's email security free →

You get one transparent grade from verified SPF, DKIM, DMARC, and MX checks, plus the three fixes to do first. Unknowns never cost points.

Get the free 90-day playbook (12-page PDF) →

Founding Partner: $1,999, one time. Look the part from day one. Founding Partner covers 50 client domains with full branding (logo and colors), a branded service menu, weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →