Addressing client's security and controllability concerns

Question

After events described in this question, my team and I decided to start our own company (limited liability). So far we are still going through setup procedures, and we are currently working with clients who are fine with us being legally freelancers.

One of our prospective clients is happy with the team skills, and wants to open a representative office in my country and hire all of us as employees.

We are not very happy with being employees, as limited company setup has these advantages to us as a team:

1. Legal. We are better protected from possible layoff, and are free to find other clients/projects in case of any issues.
2. Portfolio/brand. Working together as a company helps us developer our portfolio and brand name.

His main concerns with our proposed limited company setup are:

1. Controllability/reliability. He says that working directly with employees streamlines communication, and is easier. I also implicitly understand that he is concerned about degree of control he might lack otherwise. Our insistence on a an independent entity might also be a signal of wavering commitment and long-term cooperation viability issues.
2. Security. Our client is working in the finance sector, and says that is critical that all work is performed from authorised premises and on secure equipment (laptops with security constraints and VPN).

I've been thinking about the following counter-arguments to the points above:

1. Our limited company basically can out-staff ourselves as his employees, therefore it will be completely transparent to him. The only difference will be the contract, that will be signed between his company and ours, and not between his company and all of us separately. The contract can explicitly mention exactly who will be working on the project. And moreover, there are no long-term guarantees with employees as well.
2. As to the security, we can through secure VPN and access their remote machines through ssh or remote desktop, thus still staying within security boundaries.

My question is: are my proposed arguments valid, and what else can I do in order to address client's concerns #1 and #2?

P.S. If this question does not fit well within this site, please let me know whether there is a better place for it to be posted on.

Thanks!

Answer 1

You have taken the bold step of creating your own company. That is fantastic because now you get to make the decisions (as a group) on how you want to do business. Negotiating contracts and terms of business is part of that.

There is absolutely no reason why you have to comply.

You get to determine how you do business from now on. This prospective client may well want to employ you all, that doesn't mean you have to do it. If he wants you then he has to comply with your terms of business and that's the way it is.

Unless you absolutely must get this work/contract then just tell him "thanks but no thanks, we are happy in the business we created". If you do have to take his business then things are a little more difficult and you will need to negotiate. In that case your arguments are perfectly valid, but the client probably already knows that. They will ultimately be thinking about costs.

Answer 2

You're dealing with control issues. This company could be looking for investors or partnerships who will feel more confident if certain expertise is in-house. Especially if the technology you're creating is a big part of their strategy and not just some cost center.

If from the company's perspective, they are paying you for full-time, you're not going to have time to find other clients in theory unless you hire additional staff who do not work for this client. Personally, I don't think it is a strong argument for them.

You could also offer them right of refusal when hiring new people for their project. It gives them a little more control. Also, there are aspects of all projects that do not require a full-time person. You could spread a full-time person on your staff to their project only as needed. They get an expert without going to yet another consultant or hiring people they don't need.

Get a more expert opinion on your security claims. The level of security you use to access a corporate network doesn't matter if you're doing it from a compromised machine and/or network. Requiring company reviewed, protected and managed equipment on their network is not uncommon. There is a lot of BYOD in the corporate world, but in some areas of Finance, it's not as prevalent.

Answer 3

I suggest you to take a look at the contracts pentesting firms sign with their customers for ideas. They have to deal with some of the same issues you have to, specially since they are breaking into the customer's network to try to get to the crown jewels. A tremendously limited list they usually deal with are:

• Scope: what can they access and what they should keep away from.
• Guarantees/Insurance: do you have a general security policy for your business? Spell out how you are going to access their resources and clear with their security team. It is also wise to have insurance in case something goes awfully wrong; pentesting firms do have that.
• Retainer: would you consider being in their retainer, where they pay you a flat rate every month just to be available to them. This might including having a specific person in your team assigned as the point of contact to them, response time expectations, and which topics are covered, "for X/month you will get a response within Y hours and these topics are included if they take less than Z time to solve. If it is a more complicate issue, these reduced hourly rates are enacted."

Bottom line is define expectations in writing. It shows professionalism and protects you from feature creep-like events.