Engagement Status Tracker | McPhail Security

McPhail Security | Partner-Craft POV | Update after every session — same day

How to Use This Tracker

Update after every session, same day where possible
Share this file with the partner and vendor contacts at kickoff — it replaces status emails
Use the Phase and Milestones tab to drive the opening 10 minutes of every session
When something slips, log it here first. Keep the conversation focused on resolution, not blame
The Risk Log captures anything that could derail the engagement before it does
The Session Log is your running record — feed it into the engagement report at close

Tab 1 — Engagement Overview

Engagement Details

Field	Value
Engagement Name	[Field]
Vendor	[Field]
Partner	[Field]
Engagement Lead	Mike McPhail / McPhail Security
Archetype	[Field: select A1–A6]
Start Date	[Field]
Target Close Date	[Field]
Current Phase	[Field: 1 / 2 / 3]
Overall Status	[Field: On track / At risk / Blocked]
Last Updated	[Field]

Status Snapshot

Live counts pulled from the Phase and Milestones tab:

Total Milestones
Complete
In Progress
At Risk
Blocked
Not Started

Tab 2 — Phase and Milestones

Phase 1 — Discovery

Milestone	Owner	Status
Partner Discovery Questionnaire distributed	MM	Not started
Kickoff session scheduled and confirmed	MM	Not started
Kickoff session delivered	MM	Not started
Session 1 output summary circulated	MM	Not started
Vendor briefed on engagement structure and their role	MM	Not started
Session 2 date confirmed with all attendees	MM	Not started

Phase 2 — Methodology Build

Milestone	Owner	Status	Notes
Session 2 delivered	MM	Not started
Session 2 output summary circulated	MM	Not started
Gap Analysis Tracker v1 populated	MM	Not started
Gap Analysis Tracker shared with vendor (partner-approved)	MM	Not started
Session 3 date confirmed	MM	Not started
Session 3 delivered	MM	Not started
Session 3 output summary circulated	MM	Not started
Client-facing materials draft completed	MM	Not started
Facilitation guides draft completed	MM	Not started
Partner reviews draft methodology package	Partner	Not started
Session 4 date confirmed	MM	Not started
Session 4 delivered	MM	Not started
Session 4 output summary circulated	MM	Not started
Session 5 date confirmed (if required)	MM	Not started	Archetype-dependent
Session 5 delivered (if required)	MM	Not started	Archetype-dependent

Phase 3 — Enablement

Milestone	Owner	Status
Engagement report drafted	MM	Not started
Report reviewed with partner	Partner	Not started
White-label packaging applied	MM	Not started
Gap Analysis Tracker vendor summary populated	MM	Not started
Final delivery session scheduled	MM	Not started
Final delivery session delivered	MM	Not started
Engagement retrospective completed	MM	Not started
All deliverables filed and archived	MM	Not started

Status Options

Not started
In progress
Complete
At risk
Blocked

Tab 3 — Action Item Log

50 pre-formatted rows. Columns: #, Date Raised, Session, Action, Owner, Due Date, Status.

Owner Options

MM
Partner
Vendor
Joint

Status Options

Not started
In progress
Complete
At risk
Blocked

Tab 4 — Session Log

Running record of every session. Feeds directly into the engagement report at close.

Session	Date	Attendees	Focus	Output Document	Key Decisions	Open Items
Kickoff
Session 2
Session 3
Session 4
Session 5*

* Session 5 applies to archetypes A2, A3, and A6 only.

Tab 5 — Risk Log

Pre-Seeded Common Engagement Risks

#	Risk Description	Likelihood	Impact	Mitigation	Owner	Status
1	Decision-maker absent from sessions	High	High	Confirm attendee list 48 hours before each session. Reschedule rather than proceed without the right person	MM	Open
2	Partner passive or non-committal	Medium	High	Offer a vendor-absent session. Name the dynamic directly in a 1:1 with the partner lead	MM	Open
3	Vendor dominates session agenda	Medium	High	Address vendor role expectations explicitly in kickoff. Redirect in-session and follow up offline if repeated	MM	Open
4	Session schedule slips more than two weeks	Low	Medium	Agree a minimum session cadence at kickoff. Name slippage as a risk at the first missed date	MM	Open
5	Key vendor materials missing or inadequate	Medium	High	Log in Gap Analysis Tracker immediately. Assign vendor action with a deadline before next session	Vendor	Open
6	Japan regulatory sensitivity blocks vendor story	Medium	High	Engage compliance or legal early. Reframe the vendor narrative before any client-facing session	MM	Open

Likelihood and Impact Options

High
Medium
Low

Status Options

Open
Mitigated
Accepted
Closed

Archetype Variants

Tab 2 — Phase and Session Shape

The milestone list is identical across all archetypes. What changes is the number and focus of sessions in Phase 2.

A1 — Classic Enterprise Cyber

Typical engagement length: 6–8 weeks

Session 2: Market translation workshop — how does the vendor story land in this partner’s specific client conversations
Session 3: Methodology build — facilitation guides and client-facing materials drafted and reviewed
Session 4: Dry run — partner leads a simulated client session with MM observing and coaching

A2 — Industrial / OT / IIoT

Typical engagement length: 8–10 weeks

Session 2: OT environment mapping — understanding the partner’s client landscape and where IT/OT boundaries sit
Session 3: Buyer mapping — identifying the real decision-maker chain across IT, OT engineering, and procurement
Session 4: Methodology build — materials drafted around OT-credible language and reference architecture
Session 5: Dry run with OT-specific scenarios

A3 — Emerging / Sensitive AI

Typical engagement length: 8–10 weeks

Session 2: Regulatory and sensitivity mapping — understanding the specific compliance and cultural constraints in play
Session 3: Narrative development — building an AI story that is safe to tell in this market
Session 4: Methodology build — materials drafted with data residency and governance language embedded
Session 5: Stakeholder readiness review — who needs to be prepared internally before the partner takes this to clients

A4 — PKI / PQC / Crypto Lifecycle

Typical engagement length: 6–8 weeks

Session 2: Crypto literacy assessment — understanding where the partner and their clients currently sit on PQC awareness
Session 3: Discovery methodology build — how the partner leads a certificate and crypto inventory conversation
Session 4: Roadmap and narrative build — the quantum risk story for non-technical executives

A5 — Remediation / Hygiene at Scale

Typical engagement length: 6–8 weeks

Session 2: Current state mapping — understanding how the partner’s clients currently manage patching and vulnerability remediation
Session 3: Managed service design — building the recurring service model around the vendor’s capability
Session 4: Methodology build — client-facing materials and delivery framework for ongoing hygiene management

A6 — SOC Modernization / Agentic D&R

Typical engagement length: 8–10 weeks

Session 2: Current SOC state assessment — mapping what the client currently outsources, what they own, and where the gaps are
Session 3: Transition methodology build — how the partner leads a client from MSSP dependency toward internal capability
Session 4: Agentic capability framing — building the partner’s confidence in explaining autonomous detection and response
Session 5: Dry run with realistic SOC transition scenario