When comparing cyber security packages for a small business, ask each supplier to explain what happens after an alert. Agree which accounts and devices it covers, who investigates, what action they can take and when someone contacts you. A software list and a monthly price leave those responsibilities unanswered.
Use the same incident scenario with every supplier: a suspicious sign-in affects your main business mailbox on a Friday evening. Ask them to walk through the response, including the point where your approval is needed. Compare their written answers before choosing a package, rather than assuming that “managed security” includes everything you need.
Start with the systems the package covers
Give the supplier a current inventory of work laptops, shared computers, email accounts and important applications. Include remote workers and any equipment managed by another company. Ask it to mark what is included, what needs separate protection and what remains your responsibility. Record how new starters and replacement devices enter the service.
Use the NCSC’s small organisations guide as a starting point: it covers email, online accounts, devices, backups and spotting attacks.[1] Ask the supplier to map its proposal against those areas. If a component is excluded, request a plain explanation of who will look after it. Do not leave an empty box because another supplier might cover it.
Separate an alert from an investigation
Ask who receives alerts and who decides whether they need attention. Request an explanation of the difference between an automated notification, an analyst reviewing evidence and someone taking action. Make the supplier describe the actual service you are buying, including anything that requires an additional subscription or a separate support agreement.
Return to the mailbox scenario. Ask which signals the package examines, whether someone investigates outside office hours and how they establish the likely scope. Request the agreed service hours and escalation targets in writing. Do not read a monitoring-hours statement as a promise that an engineer will investigate and resolve every incident within that period.
Agree who can interrupt work
Ask what the response team is authorised to do without waiting for you. Discuss actions such as restricting an account or isolating a workstation, and identify who approves disruption to essential work. Include a deputy who can make decisions when the usual business contact is unavailable. Keep those arrangements proportionate to the systems involved.
The NCSC’s incident planning guidance recommends documenting escalation contacts, decision-making authority and deputies.[2] Apply that principle to the package: name the supplier’s coordinating role and your own business contact. Ask how they communicate if the affected mailbox cannot be trusted, and keep an alternative contact method available outside the usual email system.
Check where recovery and extra charges begin
Request a written boundary between initial containment, further investigation and restoring normal work. Ask whether rebuilding a laptop, recovering documents or coordinating with an application vendor falls within the monthly service. Establish how additional work is approved, who can authorise it and how costs are explained before billable work starts.
Discuss recovery evidence separately from monitoring reports. Ask for an agreed demonstration using non-sensitive test material, with someone from your business checking the restored result. Record which systems the demonstration covers and which still need testing. If another company manages backups, agree who coordinates the handover during an incident instead of leaving staff to connect the suppliers.
Request evidence you can understand
Ask to see an anonymised example of the regular service report. Look for covered systems, unresolved issues and actions assigned to named owners. Request an explanation of how the supplier checks that protection is still operating after equipment changes. Avoid choosing a package solely because its sample dashboard has more green indicators.
Agree how staff report suspicious activity and what happens after they report it. Ask for a short rehearsal using the Friday mailbox scenario, with clear instructions that nobody should make live account changes during the exercise. Note any unanswered questions, assign owners and repeat the unclear parts once the supplier has clarified its process.
Bring the boundaries to your next review
Keep the coverage inventory, response arrangements and charging boundaries together. Review them when you add a site, change important software or extend working hours. Ask your existing IT provider which protections are already included before buying another package, then resolve any overlap or gap explicitly.
BMT’s cyber security for small businesses page is a starting point for discussing your requirements. Send us your current setup and the responsibilities you want clarified. Bring an existing proposal if you have one, and use the conversation to agree what should happen when someone needs help.
Sources
[1] https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security
[2] https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes