Checklist
Provider Questions Checklist: Compare Two Cybersecurity Providers on One Page
A one-page checklist of the five questions to ask every cybersecurity provider, what a clear answer sounds like, and where to write each answer so you can compare two providers side by side.
Use this checklist on your first call with each provider. Ask the same five questions in the same order, write each answer next to the question, and compare the two sheets when you are done. Print this page, or copy the questions into a document with one column per provider.
Question 1: What exactly is included in your monthly service, and what is billed extra?
A clear answer lists what is included (for example monitoring, patching, a help desk, backups) and what costs extra (for example onsite visits, projects, incident response hours). If the answer is "everything", ask for it in writing.
- Provider A wrote:
- Provider B wrote:
Question 2: How do you handle a security incident, and how fast do you respond?
A clear answer names a process and a response time, and says who you call. Reassurance without a process is not an answer.
- Provider A wrote:
- Provider B wrote:
Question 3: Which compliance frameworks do you support, and who on your team does that work?
Match the framework to your business. A defense contractor needs CMMC and NIST SP 800-171 experience. A medical office needs HIPAA. Ask for a person, not a department. Be careful with the phrase "CMMC certified": CMMC is a Department of Defense program that assesses defense contractors, not a badge a consultant earns by advising them (DoD CIO: About CMMC).
- Provider A wrote:
- Provider B wrote:
Question 4: Who will actually work on my account?
Staff credentials such as CISSP or CompTIA Security+ show that people on the team passed recognized exams. They do not guarantee results. Ask for the name of your day to day contact and how long they have worked there.
- Provider A wrote:
- Provider B wrote:
Question 5: Can you share references from clients like us?
Ask for a business of your size and industry, and call one. Ask what went wrong and how the provider handled it.
- Provider A wrote:
- Provider B wrote:
What should you do with the two sheets?
Put them side by side. The provider whose answers were specific, in writing and from a named person is usually the one to talk to again. If neither is a fit, browse more providers. If budget is the blocker, see whether an in-kind grant can cover the work. Our guide on how to choose a cybersecurity provider explains the reasoning behind each question.
Last reviewed:
Ready to close your cybersecurity gap?
Start with a grant application if budget is the blocker, or talk to a specialist if you are ready to buy.
Or email info@cybersecuritynearme.ai