Confirm you have scoped your needs and gathered what providers will ask before you sign.
0 / 13 completed
Use this checklist before you sign any cybersecurity services contract. It is arranged in the order most selection projects follow: understanding your own environment, identifying your legal and contractual obligations, defining the outcome you want, comparing providers fairly, and preparing for onboarding.
Tick items as you complete them. Your progress is saved in your browser only and is never sent anywhere. If you cannot check an item, that is useful information: it is a question to raise with providers or an internal task to finish first.
A short note on how to use the results. If you cannot check most items in the first two groups, a provider-led assessment is probably a better first purchase than a long managed contract, because you will need help defining scope. If you can check nearly everything, you are ready to compare proposals line by line. The checklist is a general planning aid, not legal or compliance advice, and it does not cover every requirement that may apply to your industry.
Getting Started and Choosing a Provider
Evaluation criteria, questions, reference checks and contract terms to compare cybersecurity providers fairly, plus a scoring method you can use with three or more proposals.
Mistakes, Red Flags and FAQ
The most frequent and costly errors businesses make when buying cybersecurity services, from skipping scope and MFA to trusting guarantees, with practical fixes for each.
Getting Started and Choosing a Provider
A plain-English overview of the main US cybersecurity rules and frameworks that affect businesses, who each applies to, what they require and when to bring in a professional.
Getting Started and Choosing a Provider
A practical list of the documents, access, diagrams and policies a cybersecurity provider will ask for, and how preparing them in advance speeds up quotes and onboarding.
Getting Started and Choosing a Provider
A practical eight-step process for small and mid-sized US businesses to assess risk, define scope, request proposals, choose a provider and begin onboarding without overspending.
Mistakes, Red Flags and FAQ
A practical first-day checklist for a suspected breach or ransomware attack, covering containment, evidence, who to call, legal notification duties and what not to do.
