The 4 Questions to Ask Your Security Consultants

While it can be nerve-wracking letting someone into a portion of your organization, look at it as though you are actually taking back control. Enlisting the help of trained and experienced experts is nothing to be ashamed of – if anything, this could be the smartest thing you do for your company. However, before completely letting go of the reigns here are some questions to ask so that you know you can trust the team you have enlisted the help from.

Though you are bringing in external testers, there are still some fundamental aspects of security that you need to know in order to properly partner together. Ensuring you have some understanding of cyber-security terminology and are aware of recent attacks or cyber threats in the market can only further help you. Not only that, but you will have a better grasp on how exactly you can protect and act upon the findings of an assessment.

1. What security services do I need?

No matter if you are doing this on your own or with outsourced experts, you should start with an audit of your overall environment in order for all parties involved to be on the same page when it comes to the current security posture you are operating out of. Once this happens you can discuss this status and the recommendations of your security consultants.

Out of all of this, you really want to understand what you are actually asking for. Is a pen-test what you need? Or is the root cause of your problems from the users, not the technology? Before getting started with anyone, research what you may think you want or need so you can discuss the options and see what you’re thinking and determine if that is in line with your security goals.

2. What is my security response team’s incident response plan?

Your security consulting team should have an action plan for how to handle breaches, bugs in the system or just be able to answer questions when running into issues while exploring your environment. This could be a good trust exercise. When choosing a security consultant services team to work with your business, you want to make sure they will be able to handle chaos well. Asking about what they would do if things went awry as well as how they’ve handled problems in the past – without giving away sensitive information – could be what makes you choose that provider over another.

3. Who can help translate the technical jargon to my team?

It might not be the smartest to go completely blind into this space when bringing in external team members for your security efforts. If you are outsourcing because you and aren’t as well-versed in this space then take the time to learn some verbiage to get started. While it is recommended to entrust the experience of the ones you are bringing on board, it is also nice to have context. With your baseline understanding of what needs to happen and asking questions regarding the things you are a bit foggy on it will be easier for security consultants to help manage your expectation.

However, if it’s still something you don’t have time for, consider bringing on a security consultant of sorts to help have the tougher conversations and to make sure you are getting what you need for the security of your business at the end of the day.

4. How can I be sure the scope has been completed?

Following the completion of a scope, you can expect a report and run down of the actions taken by the security consultant team. Documentation of findings as well as completed tasks should be provided. After changes have been made to your environment, you can expect a test to ensure changes have been installed and that your company is more secure than it was before. You are bringing in a team for a reason and you want to be sure that you didn’t go to all the effort of partnering with the experts for there to not be any change in your current security strategies.

What’s next?

You’ve made it through your first time working alongside a security consultant. But what’s next? Security doesn’t just stop after an audit or an assessment. Maybe there are some things for you and your organization to do internally, to ensure you are doing what you can to protect your organization. This could involve security awareness training to make sure everyone knows how to handle potential attacks or threats creeping into your environment or rolling out new programs to your organization to make securing your company easier.