Choose a cyber security service provider on five things. Do they assess your business before they quote? Does their compliance experience match your obligations? What do their response times actually commit to? How do pricing and exit terms work? And who does the day to day work? Ask for each in writing. A provider that will not put it in writing is telling you something.
Key Takeaways
- Assess before you shortlist. Work out what you need to protect and what rules apply to you. Then compare providers against that, not against each other.
- Australian obligations are the ones that matter. Essential Eight, the Privacy Act and the Notifiable Data Breaches scheme apply here. HIPAA and similar overseas rules usually do not.
- Response time is the clause people skip. Ask what happens at 2am on a Sunday, and ask for the commitment in the contract rather than on a web page.
- Check the exit before you check the price. Notice periods, data handover and who owns the documentation matter more than the monthly figure.
- Ask who actually does the work. The people in the sales meeting are often not the people in your systems. Ask, and ask what is subcontracted.
What Does a Cyber Security Service Provider Do?
A cyber security service provider runs the security of your systems on your behalf. That covers three things: setting up the right controls, watching for problems, and responding when something happens.
In practice the work usually includes:
- Identity and access: who can log in, and what they can reach
- Email security: phishing, impersonation and malicious attachments
- Device and endpoint protection across laptops, phones and servers
- Monitoring and alerting, so a problem is spotted rather than discovered later
- Incident response when something does go wrong
- Compliance support, including evidence for audits and tenders
- Staff awareness training
Providers differ in where they are strong. Some are built around a platform such as Microsoft 365. Some specialise by industry. Some only monitor and hand incidents back to you. The category name tells you very little, so compare the actual scope.
There is also a cost argument worth stating plainly. Building an in-house security team is expensive, and for most Australian small and medium businesses it is not realistic. Managed cybersecurity services exist because buying a share of a team is cheaper than hiring one.
For an overview of Kloudify’s scope, see our cyber security services.
How Do I Choose a Cyber Security Service Provider?
Seven criteria separate providers that look identical on paper. Work through them in order. The first one changes the answer to all the others.
1. Assess What You Actually Need First
Before you talk to anyone, write down what matters. Which systems would stop the business if they went down? Where does your sensitive data sit? What rules apply to your industry? What do you already run, and what does your team already handle?
This single step filters most of the market. A provider who cannot speak to your systems and your obligations is not a fit, however good the proposal looks.
2. Check Their Compliance Experience Against Your Obligations
Compliance is where mismatches hurt most. An NDIS provider, a government contractor and a professional services firm all face different obligations. A provider strong in one may never have worked in another.
Ask which Australian frameworks they work to, and ask for a recent example. General claims of compliance expertise are worth little without one.
For sector-specific context, see our guide to cyber security for NDIS providers.
3. Verify the Scope, the Plan and the Pricing Model
Get the scope in writing, item by item. Then ask how it is priced: per user, per device, monthly, annual, or a mix. Ask what sits outside the plan and gets billed separately.
Two things people forget to ask. What happens if your headcount changes mid-term? And what is the process when you need something the plan does not cover?
4. Pin Down Response Times and Support
This is the clause most buyers skim, and the one that matters most on the worst day.
- Is there 24 hour emergency response, and is it committed in the contract?
- What happens in the first hour of a suspected breach, and who calls whom?
- Do you get a named contact, or a general queue?
- Which channels can you reach them on, and are those staffed outside business hours?
Ask for the commitment in the agreement. A response time on a marketing page is not a commitment.
5. Confirm the Service Can Grow With You
Security needs change when you add staff, open a site, adopt a new system or win a contract with tighter requirements. Ask how the service handles each of those, and what it costs when it happens.
6. Look at the Technology and How It Fits Yours
Ask what tools they use and how those work with what you already run. If your business is on Microsoft 365, a provider deep in a different stack will add cost and complexity rather than remove it.
A Microsoft 365 security assessment can help establish what needs attention in your current environment.
Also ask about coverage. Does it include remote workers and mobile devices? Does it include your cloud systems, or only the office network? Our guide to cloud security services explains what cloud coverage involves.
7. Ask Who Does the Work, and How They Report
Find out whether the people in the sales meeting are the people who will be in your systems. Ask what is subcontracted and to whom.
Then ask what you see month to month. A useful provider gives you plain reporting you can take to a board or an auditor. If the only output is a dashboard you never look at, you cannot tell whether the service is working.
Questions to Ask Before You Appoint a Provider
Most advice on how to choose a cyber security provider stops at the criteria. The questions below are the practical version. Take them into the meeting, because the answers are more revealing than the proposal.
- What would you look at first in a business like ours, and why?
- Which Australian frameworks do you work to, and where have you done it recently?
- What exactly is in scope, and what gets billed on top?
- What is your committed response time, and is it in the agreement?
- Who will actually do the work, and is any of it subcontracted?
- What do we receive each month, and can we show it to an auditor?
- If we leave, what is the notice period and what do we take with us?
- What certifications or accreditations do you hold, and can you send evidence?
That last one applies to us as well. Ask it.
If testing is part of what you are buying, the selection criteria differ again. We have set out how to choose a penetration testing provider separately.
What Does a Cyber Security Service Provider Cost?
Providers price in a few standard ways. Per user per month, per device, a flat monthly fee for a defined scope, or a project fee for one-off work such as an audit. Many combine them.
The monthly figure is rarely where the surprises are. Check these instead:
- Contract length and notice period. A long lock-in with a short notice window is a poor trade.
- What is excluded. Incident response is sometimes outside the retainer. That is the worst time to discover a separate rate.
- Onboarding and setup fees. Ask whether the first round of remediation is included or quoted separately.
- Renewal terms. Ask how price changes are handled, and how much notice you get.
- Exit and data handover. Ask what you take with you, in what format, and at what cost. Documentation you cannot use elsewhere is a form of lock-in.
Be cautious of a quote given before anyone has looked at your systems. A number produced without an assessment is a price for a guess.
Managed Cybersecurity Services for Small and Medium Businesses
Small and medium businesses buy security differently from large ones. The constraint is rarely budget alone. It is that nobody internally owns security as their actual job.
That changes what good looks like. For a smaller organisation, the useful provider does four things:
- Starts with what you already own, because most businesses on Microsoft 365 pay for security features they have never switched on
- Fixes things in a sensible order, rather than handing over a list of forty findings
- Explains decisions in language a non-technical owner can act on
- Handles the ongoing work, so it does not fall to whoever is best with computers
Small business cyber security consulting is often sold as a one-off review. A review with nobody to act on it does not reduce risk. If you buy the assessment, agree who does the fixes at the same time.
Essential Eight and Providers for Government and Contractor Work
If you sell to government, or to a business that does, security requirements arrive through the contract rather than through the law. The Essential Eight is usually the framework named.
The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre. Each has maturity levels describing how thoroughly it is implemented. Tenders commonly ask for a stated maturity level, plus evidence to support it. Our Essential 8 compliance page explains this work in more detail.
Two things to understand before you appoint anyone for this work.
- Nobody certifies you against the Essential Eight. There is no certificate. A provider helps you improve your maturity and produce evidence of it. Treat any promise of Essential Eight certification as a warning sign.
- Evidence is the deliverable. Winning the tender depends on being able to show your position, not just on holding it. Ask what documentation you receive and whether it is written for an assessor.
For more on tender-related requirements, see our guide to cyber security for government contracts.
Australian obligations worth knowing before you compare providers:
| Framework | What it covers |
|---|---|
| Essential Eight | Australian Cyber Security Centre mitigation strategies with maturity levels. Commonly named in government and contractor tenders |
| ISO 27001 | International standard for information security management. Genuinely certifiable, unlike the Essential Eight, and often requested in larger tenders |
| Privacy Act 1988 and the Australian Privacy Principles | Governs how personal information is handled. Coverage and thresholds are under active reform, so confirm your current position rather than assuming |
| Notifiable Data Breaches scheme | Requires eligible breaches to be reported to the OAIC and to affected individuals |
| SOCI Act | Obligations for operators of critical infrastructure assets |
| IRAP | Assessment process used where systems handle Australian government information |
| NDIS Practice Standards | Apply to registered NDIS providers, including obligations around records and information handling |
Overseas frameworks such as HIPAA and CJIS are sometimes listed by providers. Unless you operate in those jurisdictions, they are not your obligations, and a provider leading with them may be working from an overseas template.
The Bottom Line
The bottom line: pick the provider that assesses your business before quoting, commits to response times in writing, and matches your actual compliance obligations. That beats the one with the longest capability list.
Kloudify provides cyber security services Australia wide, focused on Microsoft environments. That means Microsoft 365, Azure, identity, devices and Essential Eight alignment. Work is delivered remotely, with onsite support when a job needs it. If your requirement sits outside that, say so early and we will tell you.
For a published example of our work, read the Microsoft 365 cyber security case study.
A sensible first step is an assessment, so you know your position before committing to anyone. Book a consultation, or start with the free Essential 8 audit if a tender or compliance deadline is driving this.
Frequently Asked Questions
Judge reliability on four things rather than on reputation. Do they assess your environment before quoting? Do they commit to response times in the agreement rather than on a web page? Can they show recent work under the Australian frameworks that apply to you? And will they tell you what they are not the right fit for? Kloudify works with Australian businesses on Microsoft-based security and Essential Eight alignment, and will say so when a requirement sits outside that.
Be careful with the word comprehensive, because providers use it to mean very different scopes. Ask for the scope item by item, and ask specifically whether incident response, remediation work and compliance evidence are inside the fee or billed separately. A shorter scope you fully understand is better than a broad one you do not.
Start by writing down what would stop your business if it failed, where your sensitive data sits, and which rules apply to your industry. Compare providers against that list rather than against each other. Then check three practical things: the committed response time, what is excluded from the fee, and who actually does the work.
Match the level to your risk and your obligations, not to a provider’s tier names. Two questions set the floor. What would a day of downtime or a data breach cost you? And does a contract, tender or regulation already require a specific standard? If a framework such as the Essential Eight is named in your contracts, that sets your minimum and the conversation gets much simpler.
Seven. Do they assess before they quote? What is their experience with your compliance obligations? What is the written scope and pricing model? What response times are committed? How does the service scale as you grow? How does their technology fit what you already run? And who does the work day to day? Ask for evidence on each. Anything a vendor will not put in writing should be treated as not included.
Apply the same criteria, with two Australian additions. Check that they work to Australian frameworks such as the Essential Eight and the Privacy Act rather than overseas equivalents. And check how support works across time zones and after hours, particularly if the provider or any subcontractor is offshore.
