How to Find a Managed Security Provider in Washington, DC for a Small Company

To find a managed security provider in Washington, DC for a small company, shortlist two or three providers that serve the District from the provider directory and the Washington, DC page, then pick the one that will write its security duties into the contract. A joint advisory from CISA, NSA, FBI and allied agencies tells customers of managed service providers to require multifactor authentication on every provider account, monitoring and logging they can see, and a clear split of who owns which security job (CISA, NSA, FBI and partners: advisory AA22-131A). In DC, also get the provider's breach notice duty in writing, because DC law makes the business that owns residents' personal information notify them (DC Code, section 28-3852).

Where can a small company in DC find a managed security provider?

Start with the provider directory and the Washington, DC page, which list providers that serve the District with their services and contact details. Ask each one the questions below in writing, and treat any certification on any website as a claim to check: ask who on the team holds it. If you are a defense contractor, also read how to choose a CMMC consultant, because preparing for CMMC and managing your IT are different jobs.

What should a DC small company require in a managed security contract?

The agencies tell customers to make sure their contract requires the provider to (CISA advisory AA22-131A):

• Use multifactor authentication on the services you receive and on every provider account that reaches your environment.
• Monitor and log the systems it manages, and give you visibility of its presence, activities and connections to your network.
• Never reuse administrator credentials across customers.
• State clearly who owns each security role and responsibility, you or the provider.

The same advisory recommends keeping your most important logs for at least six months, because it can be months before an incident is detected (CISA advisory AA22-131A). For the full list of terms, read how to choose a managed security provider.

What does DC breach law mean for my managed security provider?

Two duties matter. A business in DC that owns or licenses personal information and discovers a breach must notify every affected DC resident in the most expedient time possible and without unreasonable delay, and must also give written notice to the Office of the Attorney General for the District of Columbia if the breach affects 50 or more District residents (DC Code, section 28-3852). A business that handles personal information it does not own must notify the owner of a breach in the most expedient time possible following discovery (DC Code, section 28-3852). If your provider holds or manages your customer records, your clock depends on how fast it tells you, so put that notice duty, the contact person and the timing in the contract.

What should I ask a DC managed security provider before I sign?

Ask each provider to answer in writing: how and how fast will you tell us about a suspected breach of our data? Which of your accounts can reach our systems, and is multifactor authentication enforced on every one? How long do you keep our logs, and can we see them? Do you ever reuse administrator credentials across customers? Which security tasks are yours and which are ours? Our provider questions checklist puts the answers from two providers side by side.

What should I do when a managed security contract ends?

Disable the provider's accounts in your systems. The advisory tells customers to disable MSP accounts that no longer manage their infrastructure, and notes that this can be overlooked when a contract terminates (CISA advisory AA22-131A).

Where can a DC small business get no cost help with cybersecurity?

Three places. The DC Small Business Development Center, at Howard University, is the only Districtwide, nationally accredited program offering one on one consulting, and it lists cybersecurity readiness among its areas of expertise (DC Small Business Development Center). The DC APEX Accelerator, backed by the DC Department of Small and Local Business Development, gives one on one counseling for companies pursuing federal, state and local contracts (DC APEX Accelerator). And CISA Region 3, which covers the District of Columbia, provides risk mitigation advice, assessments and trainings to its partners (CISA Region 3).

What if budget is the blocker?

See whether an in-kind grant fits. Cyber Grants Alliance grants are in-kind: an approved provider delivers the cybersecurity service at no cost to the recipient. Read the grant programs overview, and nonprofits can also read where nonprofits can get help paying for cybersecurity.