Documents and Information Needed Before Hiring a Cybersecurity Provider

Before a cybersecurity provider can give an accurate quote or start work, they typically need an asset inventory, a description of your network and cloud services, your existing policies, relevant contracts and compliance requirements, insurance documents, and a named contact. Preparing these in advance shortens the sales cycle, produces more accurate pricing and speeds onboarding. If you do not have a document, that is normal for many small businesses; the provider can help create it, though it may add cost. This guide explains each item and why it matters.

1. Asset and system inventory

This is the most requested item. Include:

Spreadsheets work. Indicate which items are managed by someone else, such as a prior IT provider.

2. Network and data flow overview

A rough diagram is enough. Show offices, the internet connection, firewall, key servers and cloud services, and how remote employees connect. If you have no diagram, a provider's onboarding may include a discovery scan that maps devices, which is more accurate but also adds time and cost.

Describe where sensitive data is stored, who can access it and where it moves. For example: customer records in a cloud CRM, payment processing through a third-party gateway, payroll with an outside service, files on a shared drive.

3. Existing security documentation

Collect whatever you already have, even if incomplete:

• Information security policy, acceptable use policy and password policy
• Incident response plan and contact list
• Backup and disaster recovery documentation, including the last successful restore test
• Previous risk assessments, scan reports or penetration test reports
• Vendor or third-party risk reviews
• Employee security training records
• Business continuity plan

Providers use these to avoid duplicating work and to see how mature your program is.

4. Contractual and regulatory requirements

Gather the clauses and forms that impose security expectations:

• Customer contracts with security addenda or audit rights
• Security questionnaires you have received or answered
• Evidence of compliance obligations, such as HIPAA business associate agreements, PCI DSS merchant level, Safeguards Rule applicability or CMMC requirements in defense contracts
• Any past audit findings or reports such as SOC 2

If you are unsure which regulations apply, ask your attorney or industry association. See compliance requirements by industry.

5. Cyber insurance documents

Provide the policy, declarations page and application, and note the renewal date. Underwriters may require specific controls, and a provider can map their services to those requirements. Mismatches between what you told the insurer and what is actually in place are worth correcting before renewal. See cyber insurance requirements.

6. Access and authorization

Providers may need to deploy software, review configurations or scan systems. Before work begins, prepare:

• A written authorization or statement of work that names who can approve testing and changes
• Administrator access to cloud tenants and key systems, ideally through separate named accounts with MFA rather than shared passwords
• Contacts at third parties, such as your internet provider, domain registrar and software vendors
• A list of change windows and blackout periods, for example month-end processing

Do not hand out permanent global administrator credentials by email or chat. Use secure sharing and revoke access at the end of the project.

7. Business context

Share information that helps a provider prioritize:

• Critical business processes and acceptable downtime
• Peak seasons or busy periods
• Planned changes such as office moves, acquisitions or new software
• Past incidents and how they were handled
• Budget range and decision timeline

A short example of preparation in action (illustrative)

A 35-person accounting firm sends three providers a spreadsheet of 40 devices, a note that client tax data is stored in a cloud practice management system, its cyber insurance renewal date, and a statement that it must protect client information under the FTC Safeguards Rule as a tax preparer. All three providers can quote on the same scope within days. Another firm sends only "we need security" and receives vague, non-comparable quotes after several rounds of questions. The first firm saved weeks.

Mistakes to avoid when gathering documents

• Hiding past incidents. Providers and insurers expect honesty, and surprises later cost more.
• Sharing sensitive data unprotected. Send inventories through secure channels, and ask for a confidentiality agreement.
• Assuming the previous IT vendor kept good records. Verify who owns domain registrations, cloud accounts and admin credentials.
• Leaving out third parties. Vendor access is a common weak point.

Frequently asked questions

What if I have no documentation at all?

Say so. Many providers start with a discovery and assessment phase. Ask whether that phase is priced separately.

Do I need a nondisclosure agreement?

Often yes before sharing network diagrams or compliance findings. Have an attorney review contract language if the stakes are high.

How much of this will providers share with others?

Ask about confidentiality, data storage and subcontractors in writing.

Who should gather this?

Ideally one internal owner, with input from finance, operations and whoever manages your current IT.

Sources

• CISA — asset inventory and cyber hygiene guidance
• NIST — Cybersecurity Framework and small business resources
• Federal Trade Commission — Safeguards Rule guidance for businesses