How to choose a security provider: questions to ask
Choose a provider by testing how they would help you meet specific duties under the Cyber Security and Resilience Bill (CSRB), especially 24-hour reporting and evidence. No certificate proves compliance, and using a provider does not transfer your legal duties.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
A note on our interest
This site is run by Precursor Security, which sells security services including penetration testing and a managed security operations centre. We have an interest in this topic. That is why this is a checklist you can use with any provider, Precursor included, and not a ranking.
Start with what you are buying
The Cyber Security and Resilience Bill (CSRB) does not list approved providers, and no certificate proves that a provider or customer complies with it. Buying a service also does not move your legal duties to someone else. If you are regulated, you remain responsible for meeting them.
So before you compare providers, write down which duty each service is meant to support: monitoring, incident response, testing, assessment or advice.
Questions on their own regulatory position
- Will you be a relevant managed service provider under the Bill? If they manage your systems and meet the size test, they probably will. See the MSP checklist.
- How far along is your own preparation? Ask about registration plans, their incident process and who owns the work.
- If you are compromised, how and when will you tell us? A regulated provider must identify and notify likely affected UK customers as soon as reasonably practicable after its full report. You may need a faster, contract-based alert than that.
- Which subcontractors touch our environment? Ask for names, locations and what access they have.
Questions on 24-hour reporting
If you are regulated, the deadline is yours, so your provider needs to help you meet it.
- Who is awake at 3am on a Sunday? Ask whether cover is staffed or on call, and what the escalation path is.
- How quickly will you tell us about something that may be reportable? Get a time in the contract, not a target on a slide.
- Who decides whether an incident is reportable? That should normally be you, using facts they provide. Be wary of vague answers.
- What will you hand us for the notification? Ask for a sample. It should cover what happened, when, which systems and what is unknown.
- Can we see a real, anonymised incident timeline? It tells you more than a brochure will.
Questions on evidence
- What evidence will we get for a regulator? Monthly reports, test results, exercise records and audit logs should be retained in a form you can use.
- How long do you keep logs, and can we get them if we leave? Your investigation could depend on this.
- How does your service map to the Cyber Assessment Framework? Ask for the mapping by outcome, along with what remains your responsibility. See our CAF guide.
Questions on access and contract
- What access do you need, and is it least privilege? Ask about admin rights, multi-factor authentication and how access is logged.
- Do you have written authority for testing? Any test should have clear scope and permission. See is penetration testing legal?
- What rights do we have to audit you? Check audit, information and regulator-access terms.
- What happens when the law changes? The Bill allows later regulations, so include a change process.
- How do we leave? Agree exit help, data return and access removal.
What accreditations can and cannot tell you
Accreditations are useful for filtering, but they answer narrow questions. Check that the scheme covers the exact service you are buying and the team who would deliver it.
| Scheme | What it can indicate |
|---|---|
| Cyber Essentials and Cyber Essentials Plus | The provider's own basic controls |
| ISO/IEC 27001 | A managed security system. Check the certificate's scope |
| CREST | Assessed companies and individuals for services such as testing |
| NCSC assured schemes | Assurance for specific services. Check the current NCSC listings |
Warning signs
- A promise of "Bill compliance" or "certified compliant". No such certification exists in the Bill.
- Claims about exact requirements that depend on secondary legislation not yet made.
- No clear answer on who would do the work.
- A contract with reporting targets but no remedy if they are missed.
- Fear-based selling around personal liability. The Bill as drafted aims penalties at the regulated organisation.
A simple way to compare
Score each provider from 0 to 3 on the questions above that matter to you, and ask for evidence to back each answer. Weight the 24-hour reporting and evidence questions most heavily if you are regulated. Run a short tabletop exercise with your shortlisted provider before you sign. It will show how they actually work with you under pressure.
Sources
Frequently asked questions
Not in the Bill. Check accreditations for the specific service you are buying, and test the provider’s evidence yourself.
No. A provider can help you meet duties, but a regulated organisation remains responsible for its own compliance.
It depends on the service. Cyber Essentials, ISO/IEC 27001, CREST and NCSC assured schemes can all be useful, but check each scope.
Precursor Security, which runs this site, sells security services, so a ranking would not be independent. A checklist lets you assess any provider, including us.