There's a lot of good stuff here. I'm surprised about their take on speaking engagements (they're OK as long as they don't involve multi-day travel obligations). I get that you don't want team members touring talks or becoming conference tourists. But a lot of companies want their employees doing speaking engagements; Matasano/NCC, my old employer, pays a pretty substantial cash bonus for every time you do that.
> pays a pretty substantial cash bonus for every time you do that Super smart move - probably the cheapest but most personal marketing effort a small firm can create. Did they have an upper cap on the speaking gigs or available time?
Part of the idea is, the good conferences do some of the vetting for the bonus for you. They discourage "touring" talks, and have a high bar for inclusion, so if you're speaking at e.g. Black Hat, CanSecWest, Recon, and Toorcon, there's probably a reason that's happening and NCC is probably very happy about that reason.