Two proposals. Similar tier names, similar logos, a price difference you could argue either way. What separates them is almost never written in either document. Here are eight questions that get at it, and what a good answer sounds like.
By the time a firm is down to a shortlist, every provider on it has passed the easy tests. Both have case studies. Both list the same security products. Both promise fast response. The proposals are written to survive comparison, so comparing them tells you very little.
The eight questions below are the ones a proposal cannot answer, because each has a factual answer that either exists or does not. Three of them come straight out of a joint advisory that six national cyber agencies wrote for buyers. Two come from federal guidance on managing suppliers. One asks a provider to show its work against a published control set. None of them require you to know anything technical, and every one of them can be asked in a meeting.
Ask every provider on the shortlist all eight. Then ask whoever you are already working with.
Who answers at 2:00 AM, and do they work for the provider?
Overnight monitoring is normal and most providers have it. Who responds to what the monitoring finds is a separate question, and the answers differ enormously. Some providers staff their own overnight coverage. Many buy it from a specialist security operations center and pass it through, which is a reasonable way to run a small firm but changes who is on the other end of an alert at 2:00 AM.
Ask three things. Whose payroll is the overnight responder on. What are they authorized to do on their own, meaning can they isolate an infected machine, or can they only open a ticket and wait for business hours. Third, who do they escalate to by name.
A provider that subcontracts overnight coverage and says so plainly is fine. A provider that will not be drawn on the distinction is telling you something.
What does the response-time promise cover, and what does it exclude?
Almost every proposal quotes a response time. Almost none of them say what is being responded to, or what happens when the number is missed.
Pin down four details. What hours the commitment covers. Which event starts the clock, your email arriving or a person triaging it. Whether the number is first response or resolution, because those are different promises and the second one is rarely made. Last, what the remedy is when it is missed, which for most agreements is nothing at all.
Then ask about the incident you are more likely to have. Coalition’s 2026 Cyber Claims Report, drawn from more than 100,000 policyholders over calendar 2025, found that business email compromise and funds transfer fraud together accounted for 58% of all claims. Those events do not begin with a server going down. They begin with a convincing email, and the useful question is who can disable a compromised mailbox at 6:00 PM on a Friday without a meeting first.
Which clause says who owns detection and incident response?
In May 2022 the US Cybersecurity and Infrastructure Security Agency, the NSA and the FBI, together with their counterparts in the UK, Australia and Canada, published joint advisory AA22-131A. Part of it is addressed to providers. The part worth reading is addressed to their customers.
Its instruction is direct: customers should make sure they have a thorough understanding of the security services their provider is delivering through the contractual arrangement. The advisory asks that contracts specify who owns hardening, who owns detection, who owns incident response, and what the notification procedure is when something happens.
Federal supplier guidance says the same from the opposite side. NIST Special Publication 1305, published October 2024, puts cybersecurity requirements into supplier contracts under GV.SC-05 and expects critical suppliers to be assessed before acquisition under ID.RA-10, meaning before you sign, and not after the first bad week.
So ask each provider to point at the clause. If neither proposal has one, that is your first negotiation, and how each side reacts to being asked is itself information.
Can you read your own logs?
AA22-131A asks customers to require their provider to implement comprehensive security event management that enables appropriate monitoring and logging of provider-managed customer systems, and to give the customer visibility into provider activity and network connections.
In practice that is four questions. Where do the logs live. How long are they kept. Can you export them yourself. Do you keep access to the history if the relationship ends.
Firms tend to discover the fourth one late. Monitoring you cannot see is a promise. Monitoring you can read is a control, and log history you cannot take with you is history you lose on the day you change providers.
How many provider accounts will exist in your systems, and who reviews them?
A provider needs access. The advisory is specific about its shape: restrict provider accounts to the systems the provider actually manages, grant access and administrative permissions on a need-to-know basis, audit provider account usage regularly, and disable inactive accounts promptly.
Turn that into a request for a number. How many accounts will they hold in your environment. Are they individually named or shared. Is every one of them behind multi-factor authentication. Who reviews the list, and how often. What is the removal process on the first day after a relationship ends, and who checks it was done.
A provider who has never been asked this may take a week to come back with a real answer. That is a reasonable week to wait.
When did they last restore a customer’s backup, and how long did it take?
Every provider sells backup. Far fewer can describe a restore they performed on a customer’s live environment, with a clock attached.
The advisory asks customers to require a backup solution that automatically and continuously backs up critical data and system configurations, held somewhere reachable such as cloud services or air-gapped infrastructure, and to write into the contract that incident response and recovery plans are tested at regular intervals. Tested is the operative word.
There is a reason to push on the recovery half specifically. The FBI’s Internet Crime Complaint Center logged 3,611 ransomware complaints in its 2025 Internet Crime Report, carrying $32,320,105 in reported losses, against 24,768 business email compromise complaints carrying $3,046,598,558. Read quickly, that makes ransomware look like the smaller problem. A complaint form captures money that moved. It does not capture the days a firm spends rebuilding, the project deadlines that slip, or the staff sitting idle. None of that appears in any national figure, which is why the only number that helps you is a restore time from a job the provider has already done.
Are they in your incident response plan, and have you run it together?
NIST SP 1305 is blunt on this point. Under GV.SC-08 it asks organizations to include their relevant suppliers in cybersecurity incident planning, response and recovery activities. Under GV.SC-09 it asks that security requirements be defined in service level agreements so supplier performance can be monitored against something.
Most firms have a plan. Fewer have one their provider has read, and fewer still have sat in a room and walked through it together. Ask when the provider last ran a tabletop exercise with a customer, who was in it, and what got changed as a result. A provider who cannot remember one has a plan on paper.
Your insurer and your counsel belong in the same conversation. The first hour of a real incident is spent working out who to call, and that is a bad hour to be improvising.
Will they map their tiers to the 56 IG1 Safeguards?
This is the question that makes competing proposals comparable, and it is the one providers least expect.
The Center for Internet Security publishes the CIS Critical Security Controls, currently version 8.1. Its first Implementation Group, IG1, is a foundational set of 56 cyber defense Safeguards that CIS describes as essential cyber hygiene and as an emerging minimum standard of information security for all enterprises. IG1 is aimed at exactly the kind of organization asking this question: small to medium-sized, with limited internal security expertise.
Send each provider the 56 Safeguards and ask them to mark every one as included in the price quoted, available at additional cost, or the customer’s responsibility. You will get two documents that are directly comparable for the first time, and the gaps will be in different places.
One caution. Nobody is certified against the CIS Controls, because CIS publishes controls and does not audit anyone. Any provider claiming certification against them has misunderstood the thing they are citing, which is worth knowing too.
What to do with the answers
None of these eight questions is a trap, and none has a single right answer. A provider who answers three of them well and says “we do not do that” to the others may serve you better than one who answers all eight smoothly and cannot produce a contract clause.
What you are testing is whether the answers are specific, whether they are consistent between the sales conversation and the paperwork, and whether the provider treats being asked as reasonable. The security of a firm that outsources its technology rests on the provider’s own practices, and six national agencies thought that was worth writing down for buyers.
Ask early. All eight are easier to raise before signature than after.
Where Renascence stands on these
We publish our answers rather than saving them for a sales meeting. The managed IT services page sets out what is in the agreement. The help desk is staffed weekdays, 5:00 AM to 6:00 PM Pacific, with a 15-minute first-response commitment written into the agreement. Monitoring runs 24/7, and an overnight critical alert reaches a Huntress analyst on shift, with no minute figure attached to that because none would be honest. Our partners get a quarterly business review and a written plan they can read.
If you would rather have the eight questions answered about your own environment before you go shopping, that is what the support arrangement behind a working business looks like in practice.
Sources
- Joint Cybersecurity Advisory AA22-131A, Protecting Against Cyber Threats to Managed Service Providers and their Customers, CISA, NSA, FBI, NCSC-UK, ACSC and CCCS, 11 May 2022.
- Coalition, 2026 Cyber Claims Report, covering more than 100,000 policyholders, 1 January to 31 December 2025.
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report.
- Center for Internet Security, CIS Critical Security Controls v8.1, Implementation Group 1.
- NIST Special Publication 1305, Cybersecurity Supply Chain Risk Management Quick-Start Guide, October 2024.