As the business world slowly but surely warms to the importance of penetration testing and risk assessment in general, more providers than ever are popping up and offering their own unique service packages. Of course, this technically isn’t a bad thing as more competition means better value for money for the end-customer. At the same time however, there will always be those specialists who’ve been in business for years and are industry leaders in what they do, while others are just out to make a quick buck and don’t really know what they’re talking about.
And as this is the very security and safety of your business that’s on the line, taking risks with second-rate security services really isn’t a viable option.
So, with all of the above taken into account, what should you expect/demand from a risk-assessment provider with the needs of the 21st century business in mind?
1 – Specifically Tailored Service Packages
Well, first of all it’s a good idea to remember that there’s no such thing as a one-size-fits-all risk assessment…never has been, never will be. Even when looking at two businesses in the same sector and same line of work, the differences by way of their own unique risks will always be night and day. As such, the first and most important thing of all to expect and demand is that your own risk assessment service package be crafted from scratch in line with the needs of your business with no pre-fab services offered or presumptions made. If it’s not 100% tailored, it cannot be 100% effective.
2 – Trained and Experienced Staff
It’s also a good idea to look into the specifics of the staff used by the provider when it comes to carrying out risk assessment processes. The reason being that in some instances there will always be those service providers who bring in the help of third-party outsiders to carry out various elements of the job with ‘HQ’ then covering the analysis and report writing etc. Sadly, this really isn’t good enough as a risk-assessment will only ever be as effective and thorough as the quality of those carrying it out allow it to be. As such, every single staff member across the board should be highly trained and experienced with no outsiders brought in to fill gaps under any circumstances.
3 – Provision of Training
It’s all well and good for a risk assessment team to come in, find the holes in the fence and plug them well enough, but this does little for the understanding of those within the business or for their ability to watch over things more effectively going forward. This is why another hallmark of a fabulous risk assessment service is the provision of training and coaching to whatever extent is required to ensure that once the process is complete, risks can be more carefully monitored and controlled internally. Without the appropriate training and coaching, all the positive results the assessment achieves could easily be undone within a matter of weeks.
4 – Wall to Wall Risk Assessment
The very last thing any business wants is to have to involve and deal with multiple providers just to get a single job done. This tends to be not only an inconvenient way of doing business, but also incredibly expensive to boot. As such, when it comes to risk assessment it’s a good idea to choose a provider that’s able to take care of every last element of the process in-house and without involving anyone else. From the initial consultation to the assessment itself to security proposals to implementation to training and right through to long-term aftercare, if you can find yourself a provider that takes care of all of this under one single roof, you’ll find the whole process much easier, more effective and less costly.
5 – Clear and Simple Reporting
Last but not least, it’s one thing for a risk assessment team to find and report on any given threats, but it’s another entirely for them to report on said threats in a manner that an everyday business owner without an IT degree can understand. It’s only by understanding the threats that exist that really anyone can stand any real chance of being able to proactively monitor and control them going forward. Solid risk assessment is about putting the power of threat management firmly in the hands of the business itself, which is only made possible if all such risks and threats can be understood with ease.
