1.0 - Introduction
Proposals are where your hard work turns into revenue in HighGround - helping your clients improve their security posture and end the confusion (wait, who switched the lights on . . .?)
These proposals don’t just beef up your clients' cybersecurity; they also serve as a crystal-clear roadmap, showing them exactly what they’re getting for their hard-earned cash.
No more blank stares when you talk about "enhancing their security posture"—they’ll see the value, and you’ll look like the cybersecurity rock star you are.
2.0 - Package types
When building your Security Packages in HighGround, you've got two options to choose from - standard and custom.
☕ Standard Packages – These are your go-to, one-size-fits-most security bundles. Designed by you, they’re built to give your clients a solid security posture without the guesswork. Think of them as your reliable, well-balanced security meal deal.
🎨 Custom Packages – These are the tailor-made, VIP experiences of the security world. Built around a specific client’s needs, they’re the cybersecurity equivalent of a bespoke suit—fitted, precise, and designed to make that one client feel extra special (and extra secure).
To learn more about security packages, read our Building your Packages article.
3.0 - Define quantity of assets
The price your clients pay for security in directly linked to the count of their assets, so you need your security package prices for clients to automatically adjust based on the number of assets they have. More assets? Higher price. Fewer assets? Lower price. Simple, right?
When you go to Proposals for a client, you’ll be able to define their current asset quantity. If you click 'Get assets', you will see a list of assets you have synced into HighGround from your integrations such as PSA, RMM etc.
Simply changing your clients asset count will instantly update the price for all of your security packages - no lag, no manual recalculations and definitely no excel spreadsheets - just real-time pricing magic!
Now you can spend more time with clients discussing which package best meets their needs and budget and less time on security reports and email proposals - what's not to love!
4.0 - How proposals are priced
Proposals in HighGround are designed to be flexible and reusable. When a clients exact asset quantities are factored in, the exact price is generated on the spot.
This dynamic, scalable approach is what makes HighGround’s proposals a powerful, efficient, and headache-free way to quote your clients for cybersecurity.
The breakdown of this pricing is visible when drilling into the proposal, which is covered in more detail below.
5.0 - Exploring proposals
Proposals hold a lot more information and functionality than just being able to visually show them their future cyber security posture - it's a comprehensive proposal including security components, features, financial breakdown, predicted security scores, included security tools and alignment to the NIST Cybersecurity 2.0 Frameworks.
5.1 - Proposal Details
There are loads of individual details to a package that make up the final proposal, including:
Basic Details: These include the proposal name & description that your client sees.
Type: Whether it's a standard proposal or a custom one you created for a specific clients needs.
Services: The services that are provided within the proposal
Financial Breakdown: This includes a comprehensive financial analysis of the proposal, including:
Period: the billing period of this package - options include /month, /quarter and /year.
Currency: the currency you will sell this package in. This will default to your MSPs own currency by default but can be changed when you create it.
Tax Rate: the tax rate to be used for your package - this will default to your MSPs default tax rate.
Package Pricing: As detailed above.
Note: packages using the per-seat billing model will not have a 'package pricing' section.
5.2 - Security Capabilities
Security Capabilities can be shown in one of two different views - by NIST CSF Function or by Security Pillar.
These two options will both show you the security components of the package organized in different ways, designed to help your clients understand what security is provided in a simple and understandable way. The differences between these 2 different views are detailed below:
5.2.1 - NIST CSF Function
These align with the following five core functions of the NIST Cybersecurity Framework 2.0:
✅ Identify – Know what you’re protecting.
🛡️ Protect – Keep the bad guys out.
🔍 Detect – Spot threats before they become disasters.
⚡ Respond – Take action when things go sideways.
🔄 Recover – Get back on track after an incident.
These functions are automatically inherited from the security components mapped to the NIST CSF Framework. Since this is an international cybersecurity framework, they’re set in stone - meaning you can't change or tweak them - which is a good job because we spent months doing the hard work for you!
5.2.2 - Security Pillar
Think of Security Pillars as the plain-English version of cybersecurity for your client - something business owners and management teams can actually wrap their heads around (without their eyes glazing over).
Instead of diving into deep technical jargon, security components are grouped into functional areas that make sense at a glance. Your options include:
🔐 User Security – how you are keeping the humans from being the weakest link.
💻 Device Security – how you are protecting devices from cyber-attack.
🌐 Network Security – how you are keeping internal and external networks safe.
☁️ Cloud Security – how you are protecting cloud infrastructure e.g. Microsoft 365.
🔄 Business Resilience – ensuring you achieve cyber-resilience if the worst happens
📜 Compliance – keeping those auditors and regulators happy, and fines at bay.
Unlike with NIST CSF functions, you have control over how the security components are arranged in the security pillars. This is done on a per-security-component level when building out their services.
5.3 - Security Posture
When you dive into packages, you’ll get a sneak peek at your client’s security posture—the cybersecurity equivalent of a "before and after" photo. You’ll see where their security stands now and where this shiny new security package will take it, aligned to the NIST Cybersecurity 2.0 Framework.
The visualization we provide with the NIST Functions show your client’s current security posture against the glorious heights their score could reach if they opt for the package you are proposing.
And if that wasn’t enough to make you feel like a cybersecurity superhero, you'll also see their predicted Cyber Resilience score and Cyber Score and exactly how much improvement (%) the security package will boost their security by.
5.3.1 - Merging Postures – The Best of Both Worlds
You will see your client’s current security posture outlined in a blue dashed line, while their new posture (with your package applied) shows up in the colour that is applied to the package. Think of it like a before-and-after shot.
But what if your client likes what they already have and just want to enhance it rather than replace it?
No problem! Click 'Merge' and both postures will morph into one, keeping their existing security strengths while layering on the new improvements from your package.
5.4 Financial Breakdown
When in a security package you’ll get a full financial breakdown of how the price was calculated. You'll see:
the cost of each asset type
the quantity of assets
the price per unit
the total price
These numbers are based on the estimates from when the package was created, but we know life (and client environments) change faster than you can say “unpatched vulnerability.”
That’s why you can override these numbers to get a more accurate and tailored price for your client.
5.4.1 - Overriding the Price – When the Numbers Don’t Quite Fit
So, you’ve built the perfect proposal - checks all the boxes, thought of every possibility - but there’s one problem - the client's arguing about the qty of users or devices.
No worries! You don’t have to scrap the package or break out an excel spreadsheet - just override the price.
To do this, simply head over to the financial breakdown of the proposal, tweak the quantities, unit prices or both, and boom - problem solved.
Now your client gets the right protection at the right price, and you get to look like a pricing wizard without breaking a sweat.
5.4.2 - Contributions – Give Credit Where It’s Due
When applying a proposal to a client, you might notice they’re already paying for some of the included services. Instead of double-charging them (which, let’s be honest, wouldn’t win you any popularity points), you can contribute their existing spend.
This subtracts what they’re already paying from the cost of the package, making sure they’re only paying for what’s new - and keeping your billing transparent and fair.
5.4.3 - Financial Summary
There's a lot of detail going on in the financial breakdown of a package in HighGround - so this is where we pull it all together for you.
This is also your go-to spot for adding discounts. You know the drill - when your client starts giving you that “I-love-it-but-my-budget-hates-it” look.
Instead of making life complicated with creative discounting ideas or screwing with individual product and service prices, just slap on a discount and call it a day. After all, you're in business to make money, right?
5.5 - Included Features
Nobody likes mystery charges (looking at you, streaming subscriptions), so the Included Features section lays it all out for your clients.
They'll see every service that's included in the proposal, along with every individual feature that's included in those services - talk about transparency!
5.5.1 - Security Components
This is where all the nitty-gritty details (that you're client doesn't really care about) about the actual security components included in the security package appear, along with the products that you use to deliver them.
And because we love keeping things neat and tidy, this information is pulled directly from your Services and Stack.
To learn more about security stack module read our Building your Stack article.
5.5.2 - Alignments to the NIST security Framework
Now we're really splitting hairs - as the saying goes, you gotta 'sweat the details'. - BUT, you're clients don't!
Every NIST sub control (aka controls) of the security components you included in your services (and thus added to your security packages) are defined here as statements of work - what you will do as part of this service - together with the sub control ID in the NIST CSF Framework
Example
In your service, you answer Yes to this question:
Does this service provide Security Awareness Training (SAT), and are senior executives, privileged users, physical and cybersecurity personnel given specific training to understand their roles, responsibilities and increased likelihood of attack?
In your proposal, this will be shown as follows:
We will regularly test and train your employees, including senior executives, on security risks and threats through a regular testing and training programme.
So whether your client is a compliance stickler, is look for re-assurance or needs the details for a contract, we've got you covered. Nothing says professional like say Yes in meetings and backing it up with the documentation afterwards.
5.6 - Export to PDF – Let the Document Do the Talking
You know you're an MSP when, after you spend 2 hours in a security presentation with a client, they ask you to send it all over in an email or report!
Instead of spending late nights and weekends trying to fulfil these frustrating requests, just export it to a pdf and send it to them!
This creates a detailed, professional layout of what you’re offering, so they can review it on their own time.
You can even control exactly what you include in the report - that's right, no one size fits all reports that you can't send to clients without them picking holes in them. You can toggle off sections when exporting, ensuring they only see what you want them to see.
So next time your client or prospect asks for you to send it over in a report, you can turn your 'omfg' into 'with pleasure'! 🚀
Tip: You can include your recommended security package, an an 'alternative' security package, in your client reports. To learn more on this, read our How to create a client report article.
6.0 - Applying a proposal to a Client
You've done it - you've sold your client on your proposal and it's time to apply it to them in HighGround, as follows:
Open the client > proposals > Find the package > Click ... > Select 'Apply Package'.
When applying the package, you'll be prompted as follows:
Note: When applying a package to a client, governance and resilience security components are not applied.
This is because you need to actually perform these actions via our Governance & Resilience module, and continuously do this in line with best practices (i.e. performing reviews, audits and reviewing plans/policies etc.). Performing these actions will achieve the same security scoring as the package indicates when you build it.
When a proposal is applied to a client, you will see a 'Managed' label when looking at the clients CyberScore drilldown, as follows:
This is to prevent you from overriding this manually when a package is applied. To change these security components, you can either update the package or set the package as Inactive, i.e. un-apply it. You can do this the same way as applying a package, and selecting 'Set as Inactive'.
Warning: Changing a package will change it for all clients it is applied to, so be careful when selecting this option.