u/BrightDefense

Hello,

We offer a cybersecurity compliance managed service. We get out leads three ways: SEO / our website, partner referrals, and client referrals. These three have allowed us grow our business and meet our growth targets. We don't currently have an outbound motion. I'd like to build outbound as a fourth pillar of our lead generation strategy. I'm having trouble finding a solution that works today.

I built and managed sales teams pre-pandemic using a playbook I'm not sure works anymore in a remote world. I'm not sure if hiring a sales person will yield results. Are they supposed to cold call? How do you even reach someone on the phone now?

I tried an "AI enabled" email service. It didn't generate any leads. I'm skeptical of this these "AI SDR" services that spam billions of mailboxes to hope that you get leads through volume. I've got some campaigns set up in Apollo, but those don't seem to do much either. It seems like email is too saturated to work. LinkedIn is getting there.

What are small business owners doing to generate leads that actually works? Or, am I already doing it? Customers are finding us via our website and referrals. We just have a hard time finding them. I'm worried about missing the universe of customers that need what we offer, but we didn't show up on their radar for whatever reason.

Thanks for the intel!

One thing that came up today in a client discussion that I figure other small contractors are confused by as well, so I'm sharing in the hopes its helpful to people out there.

This contractor read that CMMC Phase II is paused while under 60-day review, and assumed that meant that CMMC Level 2 is paused. They were under the impression that, due to the pause, they now only need to meet Level 1 controls.

The Levels and the Phases are two different things (I know, it's confusing 😅). Setting the record straight (as I understand it).

The current version of CMMC has three levels (1, 2, and 3). If your contract requires CMMC Level 1, you're expected to implement the 15 basic safeguarding requirements for Federal Contract Information (FCI). If your contract requires CMMC Level 2 because you handle Controlled Unclassified Information (CUI), you're expected to implement the 110 security requirements of NIST SP 800-171.

The requirements were being rolled out in phases. We are currently in Phase I, where Level 2 contractors continue using self-assessments where applicable.

Phase II was scheduled to begin on November 10, 2026 and would have required many Level 2 contractors to obtain a third-party assessment from a C3PAO. That transition has now been paused while the Department conducts a 60-day review.

So what's the takeaway? Phase II is paused. CMMC Level 2 is not.

Of course, we'll all be watching closely to see what comes out of the Department's review over the next 60 days.