How to buy a cybersecurity assessment

A small business buying a cybersecurity assessment should know which systems will be tested and what decision the report will support. “Security audit” can describe very different work, from a questionnaire to technical testing. Begin with an asset list and one risk that would hurt operations, then ask suppliers to define methods, limits and remediation.

What belongs in the assessment brief?

For an illustrative 12-person service company, the priority assets might be email, customer files, a public website, laptops and the payment account. The company is fictional. List who owns each system, which supplier runs it, what data it holds and when testing can safely occur. Describe one plausible incident, such as a staff member losing access to email during a busy day. Ask the assessor whether its proposed work would reveal the relevant weakness and what the business could do with the result. Do not hand over production credentials before agreeing secure access, test boundaries and an emergency stop procedure.

PDPC's data-protection obligations give an official framework for protecting personal data handled by an organisation. IMDA's SMEs Go Digital route offers general support for digital adoption; inclusion in a programme is not proof that a particular assessment is right for the firm. Ask what standard or method the supplier will use, but do not accept a badge or template as a substitute for understanding the actual scope.

How should two proposals be compared?

Give both assessors the same list of systems, permitted testing times, data sensitivity and desired deliverables. Ask for a fixed scope, exclusions, staff interviews, technical tests, report format, severity definitions, evidence handling, retest and support to prioritise fixes. A fictional Supplier A might offer a lower-cost questionnaire and policy review; Supplier B might add limited hands-on configuration checks and one retest. These are different services. Compare what each will find and what work the firm can fund afterward, not only price.

If a supplier will see personal data, use PDPC's guide to data-processing clauses to frame contract questions about access, confidentiality, subcontractors, retention and deletion. Ask whether the report includes sensitive exploit details and who may receive it. Agree the safe transfer route before testing starts. The business-continuity plan provides a recovery exercise for the failures the assessment considers; the SOP guide helps turn a recommended control into a task staff can follow.

What makes a report usable?

Require an executive page that names the affected asset, evidence, likely business effect, suggested owner and next action. Technical detail should be available for the person fixing the issue, but a list of scores without a decision is not enough. Set a review meeting to rank actions by consequence and effort. For the fictional company, the first fix might be better email account recovery rather than a complex new tool. After changes, ask what will be retested and when. Our operations topic collects related ownership and handoff methods.

You can send Methodology an assessment-brief question for editorial help. We do not certify systems or claim a cybersecurity supplier partnership.

Include the cost of implementing findings in the buying decision; a cheap report can still create a large unplanned project.

Common questions