As we mentioned in the last article, cybersecurity consulting is on the rise because cyberattacks are rapidly increasing.

The threats you hear about in the news may have your organization’s management deciding to set aside resources for security-related projects. C-level executives feel pressure to make sure they can identify cybersecurity risks before a small issue turns into a companywide problem. The pressure is real for good reason: senior leaders can lose their jobs over this. For example, the CEO, CIO, and CISO of Target Corporation were all forced to leave their positions just months following Target’s massive data breach. Other CEOs to leave in the wake of cybersecurity incidents include Sony’s Amy Pascal and Equifax’s Richard Smith.

So, having allocated resources for mitigating cybersecurity issues, how do you go about selecting a firm to help you with your projects?

Don’t just Google. Deciding who you are going to partner with on cybersecurity projects is a big decision. Don’t simply rely on search engine optimization to magically reveal to you the best, most qualified people to work with. It is far more important to find a company that best fits the project than to find just any “cybersecurity consulting company” that search results might yield.

Consider your budget. If your budget for cybersecurity consulting services is limited, then you, of course, want to employ someone that gives you the best “bang for your buck.” There’s no reason to pick a “Big Four” consulting company just because those are the only names you recognize. There are plenty of qualified cybersecurity consulting companies, and they range from local service providers to international corporations.

Check with your insurance to see if you have a partner that gives a discount. Many insurers have relationships with consulting partners for negotiated rates.

Ask around. Your industry association or group might have experience with consultants that are a great match for your needs. You might be surprised how many of your business contacts have gone through this same search for a cybersecurity consulting group. Just ask!

Get on the phone. It’s important to meet the actual individuals who will be conducting your cybersecurity services. While you may first encounter business development representatives, ask to speak directly to the people that are actually going to be working with you on the project. Ensure that these professionals are adequately qualified and experienced. Make the effort to research their credentials and understand what they mean.

Ask for references. Surely the organizations that you are looking at have worked with at least some companies similar to yours. Happy customers rarely turn down a request to be a reference, and it’s an added bit of effort that forces the consulting company to think about what examples they want to share. It’s also a great chance to ask references more practical questions, such as:

1) How long did the project take to complete?

2) How clear and actionable was the consulting report?

3) How helpful was the consulting company in remedying the issues found?

Once you have narrowed your choices down to a couple of options, it’s important that you set up time to properly scope out the project. You won’t fully know whether each consulting group can fulfill the project until they understand what your requirements are. In my next article, I will explore how to align with your cybersecurity consultant on the scope of the project.