How to Choose a Cybersecurity Company in Columbus

“Cybersecurity company” covers a lot of very different businesses. Some are IT providers with security tools added to the plan. Some run a monitoring service and never touch your printers. Some only test, and some only write policies and help you pass audits. They all show up for the same Columbus searches, and their websites use the same words.

So the first job is figuring out which kind you need. The second is finding out what you would be getting, which takes questions the marketing doesn’t answer.

Decide what you are buying before you compare anyone

Most small and mid-sized businesses need some mix of four things:

• Protection that runs day to day. Endpoint protection, email filtering, patching, multi-factor authentication, backups. This is usually part of a managed IT agreement or sold next to one.
• Someone watching for trouble. A person or a team that reviews alerts and acts on them. This is often called managed detection and response, or a security operations center.
• Testing. Vulnerability assessments and penetration tests that check whether the protection holds.
• A program. Policies, risk assessments, vendor reviews and the evidence a customer, insurer or auditor will ask for. A virtual CISO usually owns this part.

You don’t have to buy all four from one company. You do need to know which ones you are asking each company to cover, because a firm that is excellent at one can be thin on another, and their proposals will not make that obvious.

Ask who does the work

A lot of security services are resold. That isn’t a problem on its own. Plenty of good providers use an outside monitoring team or an outside penetration tester. What matters is that you know it, because the company you sign with is not always the company that sees your alerts or holds admin access to your systems.

Worth asking directly:

• Which parts of this service are delivered by your own staff, and which by another company?
• If another company is involved, what is its name, and what can it access?
• Who holds administrator access to our systems, and how is that access protected and logged?

A provider that holds the keys to many clients is a target in its own right. Ask how it protects itself. Some providers have an independent CPA firm examine their controls and issue a SOC 2 report. A Type II report covers how those controls worked over a period of time, not on a single day. It is a fair thing to ask about. (TTS Cyber has completed its own SOC 2 Type II examination, for what it’s worth.)

Pin down what “monitoring” means

This is the word that hides the most. A tool that records events is monitoring. So is a person who reads an alert the next morning. So is a team that can isolate an infected laptop within minutes. Those are very different services, and all three get described the same way.

Get specific answers, in writing:

• Which systems are watched: laptops, servers, email, Microsoft 365 sign-ins, the firewall?
• When a serious alert fires, who sees it, and during what hours does a person look?
• What can they do without calling you first, such as disabling an account or cutting a machine off the network?
• What do they hand you afterward?

Ask to see the paperwork before you sign

A sample report tells you more than a sales deck. Ask for a redacted example of each document you would receive: a monthly or quarterly report, an assessment report, and an incident summary.

Then look at whether those documents would help you answer the questions other people ask you. A cyber insurance renewal wants proof of things like enforced multi-factor authentication, endpoint coverage counted against a real device list, and a dated restore test. A customer’s security questionnaire wants much the same. We covered the insurance side in what your cyber insurance renewal is actually asking for. A good security provider produces that evidence as part of the work, not as a scramble in the week the form is due.

Keep the tester separate from the fixer

When the company that set up your security also grades it, the grade is worth less. That isn’t an accusation. It is the same reason companies use outside auditors.

For a vulnerability assessment or a penetration test, ask who performs it and whether they are independent of the team that runs your systems. If one company does both, ask how they keep them apart. A clean report from the people who built the thing being tested should make you a little suspicious, not relieved.

Ask what framework they measure against

You don’t need to become an expert in frameworks. You do want a provider that measures your security against something written down, so progress means something. The NIST Cybersecurity Framework, from the federal standards agency, is the common reference, and it covers the leadership side too: who owns security decisions, and what the policies say.

If a provider can show you where you stand today against a framework like that, and where you will stand in six months, you can hold them to it. If the plan is “we’ll make you more secure,” you can’t.

Read the incident clauses closely

Most security contracts are clear about the routine work and vague about the bad day. Before you sign, find out:

• Is incident response included, or billed by the hour once something happens?
• Who leads the response: the provider, a firm your insurer assigns, or you?
• How and when will they tell you about an incident they find?
• When you leave, how is their access removed, and what records do you keep?

Your cyber insurance policy may also have a say in who handles an incident. Read that part of your policy alongside the provider’s contract, so the two don’t contradict each other in the middle of a crisis.

Where being local matters, and where it doesn’t

Most security work happens remotely. Monitoring, testing and policy work do not need anyone in your building. Being nearby still helps when something physical is involved: a compromised machine that needs to be collected, a network closet that needs a look, or a meeting with your leadership after an incident. If a Columbus provider and an out-of-state provider are otherwise equal, that is a fair tiebreaker. It shouldn’t be the main reason you choose.

Six questions, if you only ask six

1. Which parts of this service does your own staff deliver, and which does another company deliver?
2. What exactly is watched, and when does a person look at an alert?
3. What can you do on our systems without calling us first?
4. May we see a redacted sample of every report we would receive?
5. Who tests our security, and are they independent of the people who run it?
6. Is incident response included, and who leads it?

A provider worth hiring answers all six plainly. Hesitation on any of them tells you where to look harder.

If you want a starting point that isn’t a sales pitch, our Security Analysis is a fixed-scope review of where your business stands today, and the findings are yours to act on with any provider. If you’d rather talk through what you have now, tell us what you’re running and we’ll tell you plainly whether our cybersecurity services are the right fit.

Sources

• NIST Cybersecurity Framework 2.0 (published February 26, 2024)
• AICPA on SOC 2 examinations