Five questions that sort cybersecurity providers in one call

Why ask every provider the same questions?

Proposals are written to look alike. Answers are not. When you ask two providers the same five questions and write down what each says, the differences show up in minutes. This is the method our provider guide recommends.

Which five questions?

• What exactly is included in your monthly service, and what is billed extra? This is the question that prevents the surprise invoice. A clear provider lists both.
• How do you handle a security incident, and how fast do you respond? Listen for a named process and a stated response time, not reassurance.
• Which compliance frameworks do you support, and who on your team does that work? For a defense contractor, the framework is CMMC and NIST SP 800-171. For a medical office, it is HIPAA.
• Who will actually work on my account? Staff credentials such as CISSP or CompTIA Security+ show that people on the team passed recognized exams. They do not guarantee results, so ask who your contact is.
• Can you share references from clients like us? Ask for a business of your size and industry, and call one.

What should worry me in the answers?

Be careful with the phrase "CMMC certified". CMMC is a Department of Defense program that assesses defense contractors, not a badge a consultant earns by advising them (DoD CIO: About CMMC). Ask a CMMC consultant to explain the current DoD requirements and how they have helped clients prepare.

Where do I find providers to ask?

Start from your city page, for example Ashburn, Virginia, or the provider directory. Listings are not ranked. Use the printable checklist to keep the answers in one place.

What if budget is the blocker?

Check the no-cost starting points first, then see whether an in-kind grant covers the work you need.