What should small businesses check before choosing cyber security services?

Before choosing cyber security services, a small business should verify exactly what it is buying, how the service will fit its operating model, how information will be handled, and how the provider’s work will be measured. A credible assessment should cover the provider’s service model, contract terms, data protection arrangements, technical compatibility, testing methods, governance and long-term suitability—not just the security tools included.

Check whether the service model matches the business

Cyber security services can range from one-off consultancy and assessments to ongoing managed protection or a co-managed arrangement alongside an internal IT team. Establish which model is being proposed and what level of involvement it requires from the business.

• Identify whether the service is preventive, detective, responsive, advisory or a combination of these.
• Confirm which activities are performed by the provider and which remain with the business or another IT supplier.
• Check whether the service is suitable for the organisation’s size, structure, locations and reliance on cloud or on-premises systems.
• Ask how the arrangement would change if the business grows, adds sites, adopts new systems or hires more staff.

A service can appear comprehensive while leaving important tasks outside its remit. The proposal should therefore be read as an operating model rather than as a list of security products.

Examine the contract and commercial terms

The written agreement should make the service measurable and avoid uncertainty about what is included. Review the definitions, exclusions and conditions rather than relying solely on a sales summary.

• Check the services covered, the systems and users included, and any limits on devices, sites or data.
• Look for separate charges for onboarding, configuration changes, investigation, consultancy, remediation or emergency work.
• Understand contract length, renewal arrangements, price reviews, termination rights and any minimum commitments.
• Check what happens to configurations, records and security data when the contract ends.
• Review liability provisions, insurance requirements and any exclusions that could affect the business after a security event.

These checks are particularly important for a small business because an apparently low initial price may not represent the total cost of operating the service.

Ask how personal and business data will be protected

A cyber security provider may need access to employee details, system logs, email data, device information, credentials or business documents. The provider should explain what information it processes, why it needs it, where it is stored and who can access it.

• Establish whether the provider acts as a data processor or has another relevant role under the UK data protection framework.
• Check that a suitable data processing agreement and confidentiality provisions are available where required.
• Ask how access is restricted, recorded and reviewed, including access by support staff and subcontractors.
• Confirm how data is encrypted, retained, backed up and securely deleted.
• Identify whether data is transferred or stored outside the UK and what safeguards apply.

The provider should also be able to explain how it would support the business if a data protection issue occurred. Responsibility for legal compliance remains a matter for the business and its advisers, so contractual wording should not be treated as a substitute for reviewing the organisation’s own obligations.

Verify access controls and privileged activity

Providers often require elevated permissions to configure systems or investigate suspicious activity. Those permissions create their own risk and should be controlled deliberately.

• Ask whether individual named accounts are used instead of shared administrator accounts.
• Check whether multi-factor authentication is required for privileged access.
• Establish whether provider activity is logged and whether the business can review those records.
• Confirm how administrator access is approved, limited and removed when it is no longer needed.
• Ask how credentials, keys and service accounts are stored and rotated.

These controls help the business distinguish legitimate provider activity from misuse of an administrative account.

Assess compatibility with existing technology

Before selecting a service, confirm that it can work with the organisation’s current operating systems, cloud platforms, networks, endpoints, applications and identity arrangements. Compatibility problems can create blind spots or disrupt normal work.

• Ask whether all relevant devices and operating environments are supported.
• Check for known conflicts with line-of-business applications, remote access tools and existing security controls.
• Establish how the service will handle unsupported or obsolete equipment.
• Clarify whether installation requires system changes, reboots, network alterations or user permissions.
• Confirm how changes will be tested and reversed if they cause an operational problem.

The provider should document assumptions made during the assessment. A service designed around an incomplete asset list may leave important systems unprotected.

Look for evidence of testing and improvement

Security controls should not be accepted solely because they have been installed. Ask how the provider checks that controls continue to work and how weaknesses are addressed.

• Find out whether vulnerability assessments, configuration reviews, phishing exercises or penetration testing are appropriate for the business.
• Ask how findings are prioritised and tracked through to closure.
• Check whether testing is authorised, scoped and scheduled to avoid unnecessary disruption.
• Establish how false positives, missed detections and recurring weaknesses are reviewed.
• Ask whether recommendations are explained in terms of business risk and practical remediation.

Testing should be proportionate to the organisation’s systems and risk profile. A small business does not necessarily need every available security assessment, but it should understand why particular checks have been selected and what their limitations are.

Review the provider’s governance and assurance

Due diligence should cover how the provider manages its own security, not only how it intends to protect its customers. Request relevant evidence that is proportionate to the service, such as security policies, independent assurance, staff screening arrangements or documented access procedures.

Consider whether the provider has clear ownership for customer security, a formal method for managing changes, and a process for dealing with subcontractors. It is also useful to ask how the provider keeps its personnel technically competent and how it handles conflicts of interest. Evidence should be current and relevant to the service being purchased; a certificate or badge on its own does not prove that the proposed service is suitable.

Understand the reporting and review arrangement

Security information is only useful when the business can understand it and act on it. Agree what information will be supplied, who will receive it and how often the service will be reviewed.

• Ask whether reports distinguish unresolved risks from routine activity.
• Check whether technical findings are translated into business impact and recommended actions.
• Establish whether the business can request supporting evidence or audit information.
• Agree how service performance, outstanding actions and changes in business risk will be discussed.
• Confirm who owns the reports and whether they can be retained for internal governance or regulatory needs.

Reporting should support decisions rather than produce large volumes of unexplained alerts or technical data.

Check incident coordination without assuming every event is the same

The agreement should explain how the provider works with the business, internal IT staff, legal advisers, insurers and other relevant parties when suspicious activity is identified. Ask what information is needed from the business, how evidence is preserved and who has authority to approve containment or system changes.

Also establish how the provider records decisions and lessons learned after an incident. This is separate from simply receiving an alert: effective coordination requires clear ownership, suitable evidence handling and an agreed route for restoring affected services.

Test the service against realistic business scenarios

Before committing, ask the provider to explain how the proposed arrangement would address situations relevant to the organisation. Examples might include a compromised user account, a lost laptop, a malicious email attachment, a supplier account being misused or a cloud application becoming unavailable.

The purpose is not to request a guarantee of a particular outcome. It is to expose assumptions, identify dependencies and confirm whether the service covers the systems and decisions that matter most to the business.

Use a documented comparison process

Finally, compare providers against the same written criteria. Record the service boundaries, access requirements, data handling arrangements, testing approach, contract terms, dependencies and expected business involvement. Separate essential requirements from desirable features, and note any unanswered questions before signing.

S2 Technology Group can help small and medium-sized organisations review their cyber security requirements as part of a broader managed IT and cyber security service. The appropriate choice should remain based on documented risks, clear responsibilities and evidence that the proposed arrangement can be governed effectively.