By following these best practices, organizations can enjoy the benefits of outsourcing their enterprise cyber security, minimize the risks, and build fruitful, long-term relationships with trusted providers.
With the cyber security skills gap making it extremely difficult or even impossible for companies to find the security talent they need – and they need it yesterday – more and more firms are outsourcing their enterprise cyber security.
Outsourcing is a great way to save money and gain immediate access to security expertise that you do not have in-house. However, it’s also a very serious decision. Your cyber security outsourcing provider will have access to your entire network and all of your sensitive data. How can you ensure that you are partnering with a provider who is not only legitimate but is also the right fit for your particular organization and data environment? Following are five best practices to follow when choosing a cyber security provider.
If Something Seems “Off” About a Company, It Probably Is
At a minimum, steer clear of providers who:
These are immediate red flags that indicate you are dealing with an amateur – or possibly a fly-by-night operation.
Get References
Even if a provider seems perfectly legitimate and professional, always ask for references, and make sure to call them. Professional cyber security firms are always happy to provide verifiable references. You should also Google the name of the company and its principal(s) and look for reviews – or complaints.
Make Sure that the Provider Can Handle all of Your Compliance Requirements
Lazarus Alliance’s audit and assessment services include HIPAA and HITECH, PCI DSS QSA, SSAE 16 and SOC reports, FedRAMP, FISMA, NIST, CJIS, DFARS, ISO, NERC CIP, SOX, ISO, and EU-US Privacy Shield certification; we are the only Arizona-based company that provides this depth of coverage.
However, many cyber security outsourcing companies – including some that are very large – handle certain IT compliance requirements but not others. Make sure that your provider not only offers all of the compliance services you need but also has experience performing those specific audits; ask about your specific compliance requirements while you are checking the provider’s references.
Ask the Cyber Security Outsourcing Provider About Their Audit & Compliance Processes
Believe it or not, some IT auditors are still using Excel or other spreadsheet programs to perform IT compliance reporting and audits, despite the fact that spreadsheet programs were never meant to be used with the very large data sets produced in today’s complex data environments. An auditor that is still fumbling around with spreadsheets is going to plunge your company into audit anarchy and cost you a lot of time, money, and headaches.
Make sure your provider uses modern RegTech software to perform compliance reporting and audits, such as the Continuum GRC IT Audit Machine (ITAM). ITAM utilizes big data capabilities and rapid report creation to automate data management and reporting. Instead of dozens of different spreadsheets and ledgers, ITAM creates a centralized repository of all IT compliance requirements with associated controls and automated information flows for audits, assessments, and testing. This saves you time, money, and stress and provides you with a big picture of your data environment and its risks and vulnerabilities.
Get Everything in Writing
Finally, make sure that the provider signs a written contract that specifies exactly what is expected of them and ensures that they are willing to guarantee any promises they make.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.