R1-05 ICP and jobs to be done

Supports slide 8.

STIGViewer is the one bet where the user, the buyer and the seller are three different people. This sheet says who each one is, what job they hire us for, and the evidence that they exist.

Three people, three jobs

	The practitioner	The compliance lead	The partner
Role	Sysadmin, ISSO, auditor	Program manager or compliance officer at a contractor, an RPO or a C3PAO	GRC platform or content partner
What they do with us	Uses it, free	Signs	Resells
Job to be done	Find the right rule, fast, with the source	Prove which requirements are covered and which aren’t, to an assessor	Ship content their customers already ask for, without building it
Pays?	No, and shouldn’t	Yes, if we prove absence as well as presence	Through revenue share

Evidence each one is real

The practitioner. About 37,000 visitors a month, Jul to Sep 2026 (R1-01). Upgrade clicks fire from real STIG detail pages: Windows Server 2022, Kubernetes, RHEL 10, Cisco ASA, IBM z/OS RACF, Oracle 19c (check-in, 5 Aug).

The compliance lead. The people who reached the pricing page in the week of 9 Sep came from the Department of Homeland Security, a satellite imaging company, a safety-critical software house, a state public health department and an ISSM shop. None of them can put a quarterly subscription on a personal card. That’s why the self-serve page didn’t close, and why the quote path exists (check-in, 9 Sep).

The partner. Strike Graph, DTA, Policycode and Sentient carry or resell our content. Policycode and Sentient reach 528 accounts between them; Strike Graph has 357 organisations. Detail in R2-03.

The supply side

Publishers feed the crosswalk: DISA (the STIGs), NIST, SCF, CIS and CSA. Every mapping carries who said it and when. The product is the provenance.

How the picture changed

My Sprint 2 write-up named two ICPs: STIG operations professionals, and cybersecurity vendors who wanted to reach them. I treated the practitioner as the buyer. Eighteen months of evidence split that into three people. The practitioner never pays. The compliance lead pays. The partner carries us to the compliance lead.

Sources

• Weekly check-ins, 5 Aug and 9 Sep 2026 (project docs).
• R1-01 PostHog traffic export; R2-03 partner bench register.
• From Hunch to Lean Canvas: How STIGViewer Evolved from Insight to Execution.md, Sprint 2: 11 - Project Knowledge/2505.C01. Inspiration and Product Creation/Sprint 2 Formula of a Great Business Idea/
• Founder Operating System, 17 Aug 2026: Policycode 148 and Sentient 380 reachable accounts.