Key takeaway
Clarify coverage, responsibilities, alerts, data export and contract terms in writing.
Identify risks and assets
List business-critical devices, accounts, data and cloud services. Prioritize phishing, ransomware, weak passwords, lost devices and exposed remote access by business impact. Identify which gaps are covered by the current router, endpoint protection, email filtering and backups.
Select a provider against measurable criteria
Ask which systems and hours the service covers, how incident response times are defined and where escalation goes. Compare log retention, data jurisdiction, exit export, administrator privileges, integrations and termination terms. Verify claims about references, certifications and outcomes with evidence.
| Criterion | Evidence to request | Ownership to confirm |
|---|---|---|
| Covered assets and hours | Written scope | Provider and customer responsibilities |
| Incident response | Sample escalation and timing definition | Who approves actions |
| Data and control | Retention, export and access terms | Named owner |
| Exit | Removal, export and handover steps | Responsible parties |
Align firewall, cloud and monitoring
A small-business firewall can filter network access but does not replace cloud-account or endpoint policies. Verify the actual scope of monitoring, alerting and technical support instead of relying on phrases such as “real time” or “complete protection.” Pilot in a representative, controlled group with a recovery plan; expand once ownership and incident procedures are clear.