Look for relevant experience, appropriate certifications, transparency about their own security, clear service definitions, and people you trust. Avoid providers who overpromise, can't explain what they do, or treat security as a product sale rather than a partnership.
Quick answer: Look for relevant experience, appropriate certifications, transparency about their own security, clear service definitions, and people you trust. Avoid providers who overpromise, can't explain what they do, or treat security as a product sale rather than a partnership.
What to Look For
1. Relevant experience
Industry knowledge: Do they understand your sector? Defence, financial services, healthcare, manufacturing—each has specific requirements.
Size-appropriate: An enterprise-focused provider may not serve SMEs well. A small provider may not scale. Match their sweet spot to your size.
Similar clients: Ask for references in your industry and of similar size. Talk to them.
2. Certifications that matter
Provider certifications:
- ISO 27001: They practice what they preach
- Cyber Essentials Plus: Basic hygiene verified
- SOC 2: Audited security controls
- CISSP, CISM: Qualified security professionals
- Vendor certifications: Expertise in tools they use
- Specialist certs: Incident response, forensics, etc.
3. Transparency about their security
They should be willing to share:
- Their own security certifications
- How they protect your data
- Background checks on staff
- Incident response history
- Insurance coverage
4. Clear service definitions
You should understand:
- Exactly what's included
- What's extra
- Response time commitments
- Escalation procedures
- Reporting you'll receive
5. Technology agnosticism
Good providers:
- Recommend what's right for you
- Work with multiple vendors
- Aren't pushing one product for commission
- "You need to replace everything with [vendor]"
- Single-vendor solutions for everything
- Product focus rather than outcome focus
6. Incident response capability
When things go wrong:
- How do they respond?
- What are their SLAs?
- Do they have forensic capability?
- 24/7 availability?
Questions to Ask
About them
- What certifications do you hold as a company?
- Who would work on our account and what are their qualifications?
- What's your staff retention like?
- Can we speak to similar clients?
- What's your own security posture?
- Have you ever had a security incident? How did you handle it?
About services
- What exactly is included in the price?
- What would cost extra?
- How do you measure success?
- What reporting will we receive?
- How do you handle incidents outside business hours?
- What happens if we want to leave?
About approach
- How do you stay current with threats?
- How do you handle emerging issues (like AI security)?
- What's your approach to compliance requirements?
- How do you balance security with usability?
Red Flags
Fear selling: "You'll definitely be breached if you don't buy this." Security matters, but fear-based sales is manipulation.
Overpromising: "We guarantee you won't be breached." No one can guarantee this. Honest providers talk about risk reduction.
No visibility into their operations: Won't share their certifications, won't explain their processes. What are they hiding?
Product-first thinking: Immediately recommending expensive tools before understanding your needs.
Poor communication: If they're hard to reach during sales, imagine during an incident.
Vague about pricing: "It depends" without being able to give ranges. Prepare for surprise invoices.
No exit provisions: Making it hard to leave. Good providers retain clients through quality, not lock-in.
Due Diligence Checklist
Before signing:
- [ ] Verified certifications (check registers, not just claims)
- [ ] Spoken to reference clients
- [ ] Reviewed service agreement thoroughly
- [ ] Understood pricing and what's extra
- [ ] Met key team members
- [ ] Reviewed their security policies
- [ ] Understood data handling and residency
- [ ] Clear on exit terms
- [ ] Confirmed incident response capability
- [ ] Checked insurance coverage
Why Choose DSC
We're transparent about what makes us different:
- Security-first: We lead with security, not IT support with security bolted on
- Certified: ISO 27001, Cyber Essentials Plus, CISSP-certified leadership
- Sector experience: Defence supply chain, regulated industries, aviation fuel
- UK-focused: UK team, UK data centres, UK tools (Assuria SIEM)
- Clear pricing: You know what you're paying for
- No lock-in: We keep clients through quality, not contracts
---
- we're happy to explain our approach.
---