How to Choose a Cybersecurity Service Provider: 7 Questions to Ask

When you recognize the signs that your internal IT team or small IT support company can’t handle everything that needs to be done with security, it’s time to outsource cybersecurity services. These signs could be anything from experiencing a cyber-attack to your inability to qualify for cyber insurance. Even if you don’t know what to look for, a gut feeling that your business isn’t as protected as it should be is something that you shouldn’t ignore.

Managed IT and cyber defense companies like Bellwether are here to bring you the security capability that you don’t have in-house. Not only can you get all the cybersecurity services that you need, but you can ramp up your security posture faster than if you’re trying to recruit, hire and train these professionals yourself. What’s more, having a full-blown internal security team would be expensive and outsourcing is a much more cost-effective way to get access to the expertise you need.

Once you’ve decided that you need help, the decision to outsource just security or all of your IT and cybersecurity management depends on the size of your company, how many people you have on your internal IT team, and what their skillsets are.

Augmenting Your Internal Team with Managed Cyber Defense

Outsourcing cybersecurity alone is a good option for companies that have a small IT department with three to five people. One person might be the IT manager and the rest are busy with support requests from employees and take care of IT management, but there is no one who has eyes on security 100%.

In this situation, bringing in managed cyber defense services will likely be welcomed by your team. They may, in fact, suggest this course of action because they realize that there are gaps in security.

As you get started, your team might have to let go of some things that they had been doing but they’ll be able to focus on what they’re best at, like take care of support requests. Your IT manager, on the other hand, can prioritize work on higher level projects that previously were always on the back burner.

Outsourcing Managed IT and Cybersecurity Services

The other option to get the security capability you need is to completely outsource all of your IT and cybersecurity management. This works for companies that don’t have any internal IT staff at all, or who have an IT manager who is responsible for overseeing the IT function of your business.

When you work with a managed service provider, you get access to a whole IT department of capability. You let them worry about recruiting, hiring and training people. They’ll take care of choosing the technologies that will be used on your behalf and guide you as to how you can use IT to enable your business goals and manage risk.

Choosing the Right Cybersecurity Services Provider

When you have an idea of which direction you want to go – fully managed IT and security or managed cyber defense alone – it’s time to talk to providers and find the one that can do what you need them to do. Use the following questions in your conversations as you’re vetting companies.

1. How many people in the company are 100% dedicated to security?

You’re looking for roles that have titles like security engineers, analysts and automation engineers. Part of security is keeping up with trends and the latest cyber threats so you can also ask the provider if they allow security professionals time to research and study.

2. Do they offer the services of a vCISO?

A Virtual Chief Information Security Officer (vCISO) works with you to create a security strategy that matches up with your risk profile, risk tolerance, and needs for compliance or security accountability to your customers or vendors.

3. Do they hold any third-party security certifications?

Here at Bellwether, we’re SOC 2 Type 2 accredited. That means that our security processes and practices have been verified by an independent party. Many certifications are industry specific. For example, SOC 2 Type 2 is from the accounting industry and CMMC is for the Department of Defense supply chain. You don’t have to be in that specific industry to benefit if they apply the same security standards to all clients.

4. Do they have experience in your industry?

It’s good to know if the provider has other clients in your industry and experience with the types of applications that you use. If you need to meet regulatory compliance requirements, it’s especially helpful if the company is familiar with the framework that you need to follow, and can provide the guidance necessary to meet and maintain compliance.

5. What do their current clients think of them?

Client retention is a great indicator that the cybersecurity provider you’re considering can do what they say they can do. Ask for their average client retention rate. You can also ask for case studies or better yet, names of people who they can call to talk about their experiences.

6. What would the first 90 days look like?

Get a feel for the provider’s onboarding process and how they’ll handle potentially disruptive steps like pushing out multi-factor authentication (MFA) if that’s needed. Ask about employee training. Find out if there will be any upfront investments above and beyond their setup fee that will be required.

7. What technologies do they use?

If you have a technical background, you’ll likely want to know what security tools the provider prefers. You also should be listening for software like Managed Detection and Response (MDR). However, technology shouldn’t be the only thing to talk about. That’s why we’re giving you these questions.

Expectations for How You’ll Work Together

As you go through these questions with different security service providers, what you’re ultimately doing is building expectations for both outcomes and for the kind of relationship that you’ll establish. When you pick the right company, you forget that they’re actually a vendor. The relationship will feel more like a partnership and they will consider your success, their success.

Managed Cyber Defense Services

Here at Bellwether, we support organizations’ needs for cybersecurity as part of a managed IT relationship or as a supplement to internal IT. Get in touch to schedule a consultation and explore what arrangement is best for you.