How to Vet a Cybersecurity Vendor or Consultant

Start with what you need

Before you call anyone, write down why you are looking. Maybe a customer sent a security questionnaire, your cyber insurance renewal asked hard questions, a defense contract mentions NIST SP 800-171, or you just suspect your network has grown without a plan.

A clear reason helps you compare vendors on the same terms. It also makes it easier to spot a vendor who answers a different question than the one you asked.

Questions to ask any security vendor

• Who will do the work? The person on the sales call is not always the person doing the assessment. Ask for names and credentials.
• What exactly will you deliver? A written report, a prioritized list, a policy document, a training session? Ask to see a redacted sample.
• How do you decide what matters most? Good consultants rank findings by real risk to your business, not by how alarming they sound.
• What do you need from us? Access, documents, staff time. Surprises here cause delays.
• What happens after the engagement? Will you be able to act on the findings yourself or with your current IT provider?

Verify credentials yourself

Do not rely on logos on a website. Check them with the organization that issued them.

• CISSP and other ISC2 certifications: ISC2 offers an online member verification on its website. Ask the consultant for the exact name on their certification and look them up.
• CompTIA certifications (such as CySA+ or SecurityX): CompTIA lets certification holders share a verification code or record. Ask for it and confirm it on CompTIA's verification site.

Credentials show a baseline of knowledge, not judgment. Pair them with questions about relevant experience: "Have you worked with businesses our size? With our type of data?"

Get the scope in writing

A written scope protects both sides. It should state what is included, what is excluded, what the vendor will deliver, the timeline and the fee. If a vendor is vague about cost until the work is underway, treat that as a warning.

Watch for scope creep in the other direction too. A vendor who keeps adding paid items you did not ask for may be optimizing for their invoice rather than your risk.

Testing needs written authorization

Any scanning or testing of your systems should only happen with written authorization from someone who has the authority to grant it. That document should name the systems in scope, the dates, the methods allowed and who to contact if something goes wrong.

If you use cloud services or a hosting provider, check their rules too. Some providers have their own testing policies. A vendor who offers to "just run a quick scan" of your network without paperwork is showing you how they treat boundaries.

References: ask, then check

Ask for one or two references from businesses similar to yours, and actually call them. Ask what was delivered, whether it was on time and on budget, and whether the findings were useful. Understand that some security clients prefer not to be named, so a vendor may need to ask permission first.

Ask about the vendor's insurance

Ask what coverage the vendor carries, such as professional liability (errors and omissions) and cyber liability, and request a certificate if it matters for your contract or your own insurer. Your insurance agent can tell you what levels make sense for your situation.

If a vendor proposes construction-type physical work at your building, ask whether they hold the appropriate California contractor license, and check it at the Contractors State License Board. Advisory security work and physical building work are different things.

How will they handle your data?

A security vendor may see network diagrams, account lists, policies and details about weaknesses you have not fixed yet. Ask:

• Where will our information be stored, and who can see it?
• How long do you keep it, and how do you delete it?
• Will you ask for passwords? (A careful vendor avoids collecting them and prefers that you grant temporary, limited access.)
• Will you sign a nondisclosure agreement if we ask?

Conflicts of interest

Ask whether the vendor earns commissions on products or services they recommend. Recommending your own follow-up work is not wrong in itself, but it should be disclosed. An assessment that always concludes you need the vendor's preferred product is a sales tool, not an assessment.

For context, Keith Systems does not sell, supply or resell equipment or software, so recommendations are not tied to product margins.

Red flags

• Fear selling. Countdown deadlines, scary statistics with no source, or pressure to sign today.
• Guarantees. No honest vendor can promise you will never be breached.
• Compliance promises they cannot keep. For CMMC, only an authorized third-party assessor (a C3PAO) can perform a formal Level 2 certification assessment. A consultant offering readiness help should say exactly that.
• No written scope or fee.
• Testing without written authorization.
• Requests for your admin passwords on the first call.
• Vague answers about who does the work or what credentials they hold.

An honest note about Keith Systems

Keith Systems is a one-person firm. Jacob Keith (CISSP, CompTIA CySA+, CompTIA SecurityX) does the work himself, drawing on about six years of security compliance work on government systems.

What that means for you: you talk to the person doing the work, nothing is handed off to a junior staffer, and you get direct answers. It also means capacity is limited. Scheduling depends on current commitments, Keith Systems is not an around-the-clock response service, and a large or complex engagement may be better served by a bigger team. If that is the case, Jacob will say so.

To keep continuity in your hands, deliverables are written so your staff or IT provider can act on them without depending on Keith Systems.

If you want to see how this works in practice, read what to expect from a free security consult, browse our services, or book a free security consult. You can also call (805) 800-8163.