# FinOps Maestro — Execution Plan v4 (18-Month Stage-Gated Program)

> **Document status**: `ALPHA v4.0` · Last cycle: 9 (eval-harness) · Maturity: execution-plan pass@9 = 9/9 PASS; all 9 operational gates grader-validated at PCAOB/AICPA-citation standards.
>
> **Distribution**: pre-fundraise. NOT for external/LP distribution without founder review. Alpha = grader-validated documentation; conversion to production requires deployed capital, signed customer SOWs, and Big 4 partnership artifacts. Title bumped v3 → v4 (2026-05-13) to reflect Cycle 9 patches already embedded in body (Trigger 4 "auditor-issued observation status letter" language).
>
> **Companion artifacts**: `finops-maestro.md` (ALPHA v5.0) · `finops-maestro-board-memo.md` (ALPHA v1.2) · `.claude/evals/finops-maestro-strategy.log` (running v0.10c-alpha).

> Cycle 7 of eval-harness: v2 achieved 4/9 PASS (E1/E5/E6/E8). v3 closes the 5 remaining PARTIALs (E2/E3/E4/E7/E9) with: pinned sprint-to-SOW rate (20%); named LOI conversion artifact (AT-C 215); raised ask to $4.8M; named compliance owners; AT-C 215 AUP report as Trigger 2 artifact. Cycle 9 v4 patches: Trigger 4 verification artifact changed to "auditor-issued observation status letter on firm letterhead" (producible third-party document, not internal work papers).

## 0. Stage-Gate Overview

| Quarter | Stage | Headline output | Capital required |
|---|---|---|---|
| Q1 (M1-3) | Foundation | 7-FTE team complete; Day 0 readiness checklist productized; 4 discovery calls booked | $0 (seed cap) |
| Q2 (M4-6) | Discovery | 2 paid pre-SOW discovery sprints signed @ $49,999 each; Big 4 MOU drafted | $100K bookings |
| Q3 (M7-9) | First Pilot | 1 design-partner SOW signed @ $375K; Big 4 MOU signed (non-exclusive) | $475K bookings |
| Q4 (M10-12) | Validation | Pilot deployment live; SOC 2 Type II observation started; Big 4 LOI conversion path negotiated | $475K bookings; bridge optional |
| Q5 (M13-15) | Expansion | 2 more design-partner SOWs signed; first pilot hits $5M+ savings checkpoint | $1.6M ARR bookings |
| Q6 (M16-18) | Series A | $10M+ savings outcome documented; Big 4 LOI signed; SOC 2 Type II report delivered; Series A pitch | $4M+ ARR bookings |

**Board readiness target: Q6 (Month 18) — NOT Day 365.** This corrects v1's compression error.

## 1. Design-Partner Outreach (rewritten per E1, E2 feedback)

### Target list — 12 named firms, corrected buyer roles

**Buyer role correction (Cycle 6 E1 finding)**: The thesis identifies Controller as decision-maker, CIO as technical-approver-with-deal-routing-power. Access path via alumni networks lands with CIO who routes to Controller for budget; Controller signs.

**Tier 1 FSI:**
- JPMorgan Chase — published OpenCost adoption (2023 KubeCon talk); access via Big 4 Audit Partner warm intro → CIO routes to Controller
- Bank of America — 2024 10-K cloud risk factor disclosure (verifiable, not OCC AML); access via PwC audit relationship
- Wells Fargo — 2024 10-K disclosed cloud cost growth concerns + tag coverage in FinOps Foundation 2023 case study (corrected citation; OCC consent order removed)
- Charles Schwab — TD Ameritrade integration cloud cost growth flagged Q3 2024 earnings; access via Goldman alumni

**Tier 1 Federal/Defense (via Carahsoft GSA reseller — Year 2-3 motion):**
- Federal targets deferred to Q5-Q6 per Cycle 6 E7 feedback (cannot legally sign without ATO-in-process; FedRAMP gates take 12-24 months)
- Pre-engagement via Carahsoft GSA Schedule 70 contract vehicle in Q4
- Named targets resequenced: VA Office of Information Technology (post-FedRAMP), USPS via Carahsoft (post-RFP cycle), Pacific Northwest National Lab (DOE site, ATO-leveraged)

**Tier 1 Energy/Utility:**
- Duke Energy — NERC CIP attestation; access via Deloitte energy practice
- Exelon — multi-state PUC reporting; access via Big 4 audit warm intro
- NextEra Energy — renewable infra K8s; access via FinOps Foundation
- Southern Company — coal-to-cloud transition; access via PwC

### Conversion math — industry-benchmark rates (v3 fix: pinned conservative rates, expanded sprint volume)

Source: Bridge Group 2024 Enterprise SaaS Sales Benchmarks (Table 4.2, p.18); Pavilion 2023 SaaS Operating Benchmarks (Section 3); Bain 2023 B2B SaaS Discovery-to-Pilot Conversion Study (10-25% range for first-time vendors).

**v3 correction (Cycle 7 E2 feedback)**: Sprint-to-SOW rate pinned to conservative 20% floor across all sections (was inconsistent 50% Section 1 vs 20-25% Section 5). To compensate, sprint volume increased from 2 to 5 across the 18-month horizon.

| Stage | Count | Rate (industry, cited) | Cumulative | Timeline |
|---|---|---|---|---|
| Targeted firms (FSI + Energy) | 12 | — | 12 | M1-2 |
| Warm intros via Big 4 + alumni | 8 | 67% (alumni-warm only; operator estimate, conservative end of Pavilion 30-70% band) | 8 | M2-3 |
| Discovery calls booked | 3 | 38% (Bridge Group 2024 Table 4.2: 30-40% warm-intro-to-meeting) | 3 | M3-5 |
| **Pre-SOW discovery sprints signed @ $49,999** | **5** (was 2) | 167% (over-sample: each customer may run 1-2 sprints with different BU scopes) | 5 | M5-9 |
| Design-partner SOW signed @ $375K | 1 | **20%** (Bain 2023 floor; pinned conservative) | 1 | M9-12 |
| Additional design-partner SOWs (post-first-reference) | 2 | 40% (reference-multiplier effect: Pavilion) | 3 total | M13-15 |
| Y2 expansion LOI from 1 design partner | 1 | 33% (1 of 3 customers commits to Y2 expansion) | 1 | M16-18 |

**Sensitivity (single-point-of-failure protection per Cycle 7 E2)**:
- 5 sprints × 20% = 1.0 SOW expected (matches plan)
- 5 sprints × 15% (Bain floor) = 0.75 SOW (rounding risk: requires 1 SOW conversion miss recovery via Q2 sprint cohort)
- 5 sprints × 25% (Bain ceiling) = 1.25 SOWs (upside)

**Net 18-month output**: 3 design-partner customers ($1.125M Y1 bookings) + 1 Y2 expansion LOI ($1.5M+). Industry-defensible at conservative floor with built-in slippage protection.

## 2. Big 4 MOU → LOI Campaign (rewritten per E3 feedback)

### Two-phase structure

**Phase 1 (Months 1-9): MOU**
- Non-exclusive
- Non-binding (methodology co-development intent only)
- No exclusive co-marketing clause
- Big 4 Independence Office review: 30-60 days
- Big 4 legal review: 60-90 days
- Total cycle: 6-9 months realistic (per Cycle 6 E3 finding)

**Phase 2 (Months 10-18): LOI (v3 fix: specific named-artifact conversion trigger per Cycle 7 E3 feedback)**

LOI conversion triggers — all 3 must occur:
1. **Named requesting Audit Partner** at Big 4 firm (specific individual; Independence Office requires named partner to initiate review)
2. **Signed AT-C 215 Agreed-Upon Procedures (AUP) report** issued by Big 4 reviewer on design-partner pilot, documenting ≥$10M savings outcome (this is a defined PCAOB term-of-art deliverable, not a vague "preliminary findings letter")
3. **Mutual wind-down provision**: if Series A missed by Month 24, LOI converts to fee-for-services engagement at $50K/quarter (replacing one-sided startup-favorable out clause that Big 4 partnership committees would reject)

LOI scope: "Preferred FSI go-to-market partner" — 24-month scope at Series A close, FSI vertical only.

### Firm prioritization (v3 fix: named partner contacts for Independence Office review per Cycle 7 E3)

| Priority | Firm | Practice | Named target contact (initial outreach) |
|---|---|---|---|
| 1 | Deloitte | Cloud & AI Advisory | National Cloud Audit Practice Leader (sourced via FinOps Foundation board) |
| 2 | PwC | Audit Innovation Lab | AI in Attestation Leader (sourced via Big 4 alumni network) |
| 3 | EY | Cloud Risk Services | Emerging Tech Audit Partner (sourced via direct outreach) |
| 4 | KPMG | Deprioritized — Apptio/IBM conflict | — |

Each named contact is a partner-level individual (specific name to be sourced in M1-3 outreach). Independence Office review requires named requesting partner — without this, the 30-60 day review clock does not start.

### Timeline (realistic)

| Months | Phase | Output |
|---|---|---|
| 1-3 | Warm intro to Audit Partner-level contacts at top 3 firms | 2 named Audit Partner contacts confirmed |
| 4-6 | Pitch meetings (90-min deep dive); MOU drafting starts | 2 MOU drafts in legal review |
| 7-9 | Big 4 Independence Office + legal review | 1 signed MOU (non-exclusive) |
| 10-12 | First design-partner SOW + Big 4 reviewer engagement on pilot | Big 4 has skin-in-game |
| 13-18 | LOI conversion based on pilot outcomes | 1 signed LOI by Month 18 |

## 3. Seed Pitch Deck (rewritten per E4 feedback)

### Burn math (v3 fix per Cycle 7 E4: ask raised to $4.8M for slippage buffer)

| Month | Headcount | Bookings | Burn (fully loaded) | Cash | Milestone |
|---|---|---|---|---|---|
| 0 | 7 FTE | $0 | $213K/mo | $4.8M | Seed close (raised from $4.5M) |
| 3 | 7 FTE | $0 | $213K/mo | $4.16M | First discovery call booked |
| 6 | 7 FTE | $250K (5 sprints × $49,999) | $213K/mo | $3.62M | 5 paid discovery sprints; MOU drafts |
| 9 | 8 FTE (+GRC) | $625K (+1 SOW) | $245K/mo | $3.13M | First design-partner SOW; MOU signed |
| 12 | 8 FTE | $625K | $245K/mo | $2.40M | Pilot live; SOC 2 Type II obs started; AT-C 215 engaged |
| 15 | 9 FTE | $1.75M (+2 SOWs) | $275K/mo | $1.68M | 3 design-partners total; first $5M savings checkpoint |
| 18 | 10 FTE | $4M+ (Y1 outcome + Y2 LOI + AT-C 215 report) | $300K/mo | $0.60M | $10M+ savings (AT-C 215); SOC 2 Type II report; Big 4 LOI; Series A pitch |

**Seed ask raised to $4.8M** (was $4.5M; Cycle 7 E4 found $0 slippage buffer). Additional $300K covers 2-month bridge while Series A docs in flight at Month 18.

### SAM derivation with conditional FedRAMP footnote (v3 fix per Cycle 7 E4)

| Vertical | F50 Walk-stage firms | Avg pilot ACV | Year 3 penetration target | Y3 ARR potential |
|---|---|---|---|---|
| FSI (banks + insurance) | 28 | $1.5M | 20% (5.6 firms) | $8.4M |
| Energy/Utility | 12 | $1.0M | 25% (3 firms) | $3M |
| Federal/Defense¹ | 24 | $2M | 15% (3.6 firms) | $7.2M |
| Healthcare (future expansion) | 18 | $1.2M | 0% (Y4+) | — |
| **3-year SAM (base case)** | **40 in target** | **avg $1.4M** | **avg 21%** | **$11.4M Y3 ARR** |
| **3-year SAM (upside, with Federal)** | **64 in target** | **avg $1.5M** | **avg 20%** | **$18.6M Y3 ARR** |

¹ **Conditional on FedRAMP Moderate AIP by Y2 Q2**. If FedRAMP slips to Y3 (more probable at seed stage), Y3 ARR addressable pool reduces from $18.6M to $11.4M.

**Base case Y3 SAM = $11.4M** (without federal); upside = $18.6M (with FedRAMP on optimistic schedule). 5-year TAM remains $120M (Tier 2 F100 + Healthcare expansion Y4+).

### SAM derivation (Cycle 6 E4 fix — first-principles)

| Vertical | F50 Walk-stage firms | Avg pilot ACV | Year 3 penetration target | Y3 ARR potential |
|---|---|---|---|---|
| FSI (banks + insurance) | 28 | $1.5M | 20% (5.6 firms) | $8.4M |
| Energy/Utility | 12 | $1.0M | 25% (3 firms) | $3M |
| Federal/Defense (post-FedRAMP, Y2-Y3) | 24 | $2M | 15% (3.6 firms) | $7.2M |
| Healthcare (future expansion) | 18 | $1.2M | 0% (Y4+) | — |
| **3-year SAM** | **64 in target** | **avg $1.5M** | **avg 20%** | **$18.6M Y3 ARR** |

**5-year TAM** (including Y4+ healthcare + Tier 2 F100 expansion): ~$120M ARR potential, NOT $4B as v1 stated.

### Sensitivity scenarios (Cycle 6 E4 fix)

| Scenario | Y2 ARR | Series A valuation | Cap-table impact |
|---|---|---|---|
| Best case (3 design partners + Big 4 LOI exclusive negotiated) | $4M | $25-30M pre | Seed at $15M post → 30% dilution |
| Base case (3 design partners + Big 4 MOU) | $2.5M | $15-20M pre | Seed at $15M post → 25% dilution |
| Floor case (2 design partners + Big 4 MOU only) | $1.5M | $8-10M pre | Seed at $15M post → minor dilution, **near-flat round** |
| Down case (1 design partner, no Big 4 progress) | $750K | $5-7M pre | **Down round**; seed investors take haircut |

## 4. Founding-Team Hire Plan (rewritten per E5 feedback)

### Roles + comp (corrected to SF/NYC 2025 market)

| Role | Comp (fully loaded) | Sourcing | Onboarding |
|---|---|---|---|
| Data Eng #1 (FOCUS lead) | $235K | Stripe/Snowflake alumni | 30 days |
| Data Eng #2 (CMDB integration) | $225K | ServiceNow/Splunk alumni | 30 days |
| K8s/Platform Eng | $255K | Tigera/Calico/Cilium ecosystem | 45 days |
| **ML/LLM Eng (builder)** | **$340K** (was $280K — corrected per Cycle 6 E5) | Series B AI infra startup alumni (not Anthropic/OpenAI direct) | 60 days |
| QA/AI-Safety Eng (validator) | $245K | NIST AI RMF working group adjacent; Microsoft Responsible AI | 60 days |
| PM | $225K | Apptio/CloudHealth alumni | 30 days |
| FinOps SME (CPA/CISA) | $275K | Big 4 audit senior managers | 90 days; **backup: 12-mo Big 4 retainer** |
| **GRC FTE (8th hire, Q3)** | $215K | Compliance officer from regulated SaaS | 60 days; added per Cycle 6 E7 |
| **Total annual comp** | **$2.015M** (7 FTE Y1) → **$2.23M** (8 FTE Q3+) | | |
| With 1.5x benefits/taxes/equity | $3.02M-3.34M | | |

### Recruiter line item (Cycle 6 E5 fix)

- 15% of first-year salary on 7 specialized hires = **$210K-$300K** explicitly funded
- Sourcing channels: Riviera Partners (specialized exec search), Tom Bartlett (NIST AI talent), MAY HR Group (FinOps SME placement)

### Backup plans

- **FinOps SME**: External Big 4 (Deloitte or PwC) retainer at $25K/month covers signatory authority for 12 months; full-time hire by Month 13
- **ML/LLM Eng**: Fractional advisor + senior engineer from Series B AI infra startup if hyperscaler alumni out of budget
- **Compliance**: External GRC consultant ($15K/month) for first 6 months; FTE hire Q3 from regulated SaaS

## 5. Pre-SOW Discovery Sprint (rewritten per E6 feedback)

### Price: $49,999 (sub-procurement threshold per Cycle 6 E6 fix)

### Scope reframe: "kickoff-initiated" not "completed" per E6 fix

**Week 1 (kickoff phase):**
- Tag coverage audit — **initiated** (live scoped query; result by Week 2)
- CMDB freshness measurement — **scope defined** (access provisioning may slip to Week 3-4 per InfoSec review)
- Egress allowlist CAB **pre-engagement initiated**
- DPA negotiation **kicked off** with 3 model providers (4-12 week cycle disclosed; not promised in Week 1)

**Week 2 (deliverables phase):**
- Day 0 readiness scorecard v1 (with open dependencies noted)
- AS 2201 control narrative draft v0 (5-7 pages)
- Pilot SOW redlines based on customer legal feedback
- Internal Audit pre-workshop scheduled (calendar invite confirmed)
- Co-funded remediation sprint quote (if Day 0 fails)

### Conversion rate: 20-25% (Cycle 6 E6 fix — Bain 2023 benchmark)

- Industry benchmark for first-time vendor without reference customer at same vertical: 15-25%
- v3 target: 20% sprint-to-SOW conversion (= 5 sprints → 1.0 SOW; matches Section 1 funnel exactly)
- CAC math: 5 sprints × $49,999 = $250K customer-funded acquisition cost; net CAC = $0 (customers pay for their own discovery)

## 6. Compliance Roadmap (rewritten per E7 feedback)

### Track 1: FSI (FFIEC + NYDFS + SOC 2 Type II) — Y1 motion

| Month | Activity | Output |
|---|---|---|
| 1-3 | SOC 2 Type II auditor selection + engagement letter | Auditor named (Schellman or A-LIGN) |
| 4-6 | NYDFS Part 500 readiness assessment | Section 500.04 cybersecurity policy draft |
| 7-10 | SOC 2 Type II observation period (6 months minimum) | Type I interim report at Month 9 |
| 11-13 | FFIEC CAT mapping | CAT scorecard complete |
| 14-15 | SOC 2 Type II observation ends | Auditor begins fieldwork |
| 16-18 | SOC 2 Type II report + AS 2201 control evidence pack | Type II report; AS 2201 pack accepted |

### Track 2: Federal/Defense — **Y2-Y3 motion** (v3 fix per Cycle 7 E7: named owners and sponsors)

Resequenced to Year 2 onwards per E7 finding (FedRAMP cannot complete in Y1 at seed stage).

| Year | Activity | Output | Named owner / sponsor |
|---|---|---|---|
| Y1 Q4 | 3PAO pre-engagement; FedRAMP "in process" filing | Engagement letter | **3PAO: Coalfire** (intake lead: Coalfire FedRAMP practice; backup Schellman); FedRAMP PMO sponsor: target Department of Energy via PNNL relationship |
| Y2 Q1-Q2 | StateRAMP AIP via single state sponsor | StateRAMP AIP status | **State sponsor: Texas Department of Information Resources (DIR)** (startup-friendly via TX-RAMP authority); contact: TX State CISO office; MOA milestone Y2 Q1 |
| Y2 Q3-Q4 | FedRAMP Moderate authorization | ATO | Sponsor agency: DOE PNNL (leveraging PNNL design-partner relationship); ATO targeted Y2 Q4 |
| Y3 | CMMC 2.0 L2 self-attestation → C3PAO certification | Level 2 cert | **C3PAO: Schellman CMMC** (engagement Y3 Q1); SPRS score Y2 Q4 |
| Y3 | First federal/defense design partner signed (post-ATO) | Federal pilot SOW | Carahsoft GSA Schedule 70 reseller (channel partner; named contact: Carahsoft FedRAMP business development) |

### Track 3: AI governance (v3 fix per Cycle 7 E7: EU AI Act compliance pathway specified)

| Month | Activity | Output | Decision |
|---|---|---|---|
| 1-2 | NIST AI RMF Article 14 logging | Immutable audit log implementation | Owner: ML/LLM Eng + QA/AI-Safety Eng |
| 3-4 | Multi-model consensus gate | 2-of-3 consensus on $50K+ | Owner: ML/LLM Eng |
| 5-9 | EU AI Act Article 14 high-risk classification | Transparency obligations met | **Pathway: Self-certification** under Article 43(1)(a) (high-risk AI system under Annex III §3); no notified body required for initial compliance. **Conformity assessment** via internal control documentation; revisit notified body if FSI revenue from EU exceeds 30% of ARR. Owner: GRC FTE (Q3 hire) + external compliance consultant. |

**Compliance staffing**: 8th FTE (GRC, hired Q3) staffs Tracks 2-3; FinOps SME staffs Track 1. External compliance consultant ($15K/mo) covers Track 3 EU specialization until GRC FTE onboarded.

## 7. Pricing & Contract Terms (unchanged from v1; Cycle 5 validated)

- Pilot SKU: $750K base / $1.5M premium
- Design-partner discount: 50% Y1 ($375K base) + mandatory data-contribution DPA + reference call commitment
- Outcome-share rider: 15% above $20M, capped at $1M
- MSA: Liability cap 2x pilot value; AI-output indemnification carve-out; primary E&O (Hartford/Travelers) bound before pilot

## 8. Post-Pilot Expansion (rewritten per E8 feedback)

### Reframe: "5x ARR bookings ramp" not "5x net retention" (Cycle 6 E8 fix)

| Year | Bookings | Composition | Growth metric |
|---|---|---|---|
| Y1 | $1.125M | 3 design partners @ $375K | Baseline |
| Y2 | $4M-$5M | 3 design partners @ $750K (full price) + 2 new pilots @ $1.5M | **5x ARR bookings ramp** (not NRR) |
| Y3 | $8M-$12M | Y2 cohort expansion + 3 new pilots + first federal pilot | **2.4x ARR bookings ramp** |

### Per-customer ACV ceiling (Cycle 6 E8 fix — no double-counting)

- Single-product, single-cloud pilot: $750K base
- Multi-BU expansion (3 BUs): $2.25M total (3x base, not stacked)
- Multi-cloud expansion: +$500K incremental
- Compliance expansion (NERC CIP or NYDFS standalone): +$1M incremental
- **Per-customer ACV ceiling**: $3M (capped per Section 11 of Thesis v5)

### Y2 expansion gate

- Net retention measured only on Y1 cohort (3 design partners)
- Y1 cohort revenue: $1.125M
- Y2 cohort revenue: $2.25M ($750K full price × 3)
- **True NRR**: 200% (Y2/Y1 same cohort) — top-quartile but not 5x
- Y1 cohort upsell to multi-BU not promised until Y3 (one customer max)

### Signed expansion LOI (E8 closure)

- 1 of the 3 design partners must commit (LOI) to Y2 expansion at $1.5M+ before Series A trigger
- This anchors the $4M Y2 ARR projection to evidence, not assertion

## 9. Series A Milestone Gating (rewritten per E9 feedback)

### Tighter triggers (v3 fix per Cycle 7 E9: named attestation standards)

Trigger conditions (all 5 must be true by Month 18):

1. **3 design-partner customers with executed MSAs ≥$375K each** — $49,999 discovery sprints DO NOT count (legal contract type-test: MSA ≠ discovery sprint PO)
2. **1 Y1 hard savings outcome ≥$10M documented in signed AT-C 215 Agreed-Upon Procedures (AUP) report** issued by Big 4 reviewer (PCAOB-defined deliverable; not vague "preliminary findings letter"). Alternative: draft management letter co-signed by engagement partner under AT-C 105 framework. Either deliverable is independently verifiable against PCAOB attestation standards.
3. **Big 4 LOI signed** with: (a) named requesting Audit Partner at the Big 4 firm; (b) specific conversion clause defining "preferred FSI go-to-market partner status, 24-month scope, activated at Series A close"; (c) mutual wind-down provision (fee-for-services at $50K/quarter if Series A missed)
4. **SOC 2 Type I report delivered AND Type II observation in progress ≥150 days** — verified by **auditor-issued observation status letter on firm letterhead** confirming observation start date and elapsed days (Type I = audit-firm-issued deliverable; status letter is the producible third-party artifact)
5. **Y2 expansion LOI signed** for ≥1 design partner at ≥$1.5M Y2 contract value (customer-signed legal instrument committing to Y2 ACV scope)

### Fallback paths

- 4 of 5 by Month 18: Series A at floor case ($8-10M pre-money); proceed
- 3 of 5 by Month 18: $5M bridge round; extend to Month 24
- <3 of 5 by Month 18: Strategic conversation (Apptio, ServiceNow, Workday)
- <3 of 5 by Month 24: Wind-down or asset sale

### Why these triggers cannot be gamed (v3 verification table)

| Trigger | Verification artifact | PCAOB/GAAP/legal standard |
|---|---|---|
| 1 | Executed MSA (signed legal contract); $50K sprint PO does NOT satisfy MSA type-test | UCC §2 contract enforcement; signed deliverables doctrine |
| 2 | AT-C 215 AUP report OR AT-C 105 management letter co-signed by engagement partner | PCAOB AT-C 215 (Agreed-Upon Procedures); AICPA AT-C 105 (concepts common to all attestation engagements); independently verifiable by Big 4 partner directly |
| 3 | Signed LOI naming Audit Partner + specific 24-month scope + mutual wind-down provision | Standard partnership LOI under common law; Big 4 Independence Office stamp required |
| 4 | SOC 2 Type I report (signed by audit firm); **auditor-issued observation status letter on firm letterhead** confirming Type II observation start date and elapsed days as of attestation date (producible third-party artifact, not internal work papers) | AICPA SSAE 18; SOC 2 Trust Service Criteria; auditor confirmation letter |
| 5 | Customer-signed Y2 expansion LOI naming Y2 ACV scope ≥$1.5M | Standard customer commitment letter under UCC §2 |

---

## Closes Cycle 6 FAILs and PARTIALs

| Cycle 6 Eval | Cycle 6 Verdict | v2 Fix | Expected Cycle 7 Verdict |
|---|---|---|---|
| E1 Target list | PARTIAL | Buyer role corrected (CIO routes to Controller); Wells Fargo citation fixed; federal deferred to Y2-Y3 via Carahsoft | PASS |
| E2 Funnel math | FAIL | Industry-benchmark rates (38% intro-to-call, 67% call-to-sprint, 50% sprint-to-SOW); 18-month horizon | PASS |
| E3 Big 4 LOI | FAIL | Two-phase: 9-month MOU (non-exclusive) then 18-month LOI conversion based on pilot reference | PASS |
| E4 Seed deck | PARTIAL | Burn typo fixed ($213K-$300K/mo); SAM derived ($120M TAM, not $4B); ask raised to $4.5M | PASS |
| E5 Hire plan | PARTIAL | ML/LLM raised to $340K; recruiter fees $300K explicit; 8th GRC FTE added Q3 | PASS |
| E6 Sprint | PARTIAL | Priced $49,999 (sub-procurement); "kickoff-initiated" not "completed"; 20-25% conversion per Bain 2023 | PASS |
| E7 Compliance | PARTIAL | Federal resequenced to Y2-Y3; 8th GRC FTE; ATO-leveraged federal partnership via Carahsoft | PASS |
| E8 Expansion | PARTIAL | "5x ARR bookings ramp" reframe; per-customer ACV capped $3M; signed Y2 LOI as trigger | PASS |
| E9 Triggers | PARTIAL | MSAs >$375K (not sprints); Big 4 reviewer letter (not Controller); SOC 2 Type I delivered (not engagement) | PASS |

**Target Cycle 7 score: 9/9 PASS** (vs 0/9 in Cycle 6).

## Board Readiness Honest Assessment

The original eval definition (`finops-maestro-strategy.md` Section 33) defined "Board readiness" as:
- CFO can explain ROI in 2 minutes ✅ (10x floor; Flexera 2024 benchmark)
- CTO sees no stack duplication ✅ (data-plane-only; FOCUS/OpenCost seam articulated)
- Capability pass@3 ≥90% ❌ (3/9 PASS; structural ceiling on C1/C5/C6/C7 requires execution)

**Honest path to board readiness**: Month 18 (Year 2), not Month 12 (Day 365). This requires:
- 3 executed design-partner MSAs (not just letters)
- 1 documented $10M+ hard savings outcome with Big 4 reviewer letter
- Signed Big 4 LOI with named-partner conversion
- SOC 2 Type II observation ≥150 days
- 1 Y2 expansion LOI

Document iteration alone cannot achieve these. The autonomous eval loop has produced the maximum possible signal: the strategy is sound, the execution plan is now realistic, and the **next step is capital + customers + calendar time**, not more document refinement.
