How to Choose a Cybersecurity Company for a Long Island Business

Most small businesses on Long Island don't have a security person on staff. That makes choosing an outside cybersecurity company a big decision. The right one blocks most attacks before you ever hear about them. The wrong one leaves gaps you won't see until something breaks.

This guide covers what a cybersecurity company should do for you. It also lists the questions to ask before you sign and the red flags to watch for.

What a cybersecurity company should cover

A good provider starts with the basics that stop most real attacks. For a small or mid-size business, that list is short and well known.

• Multi-factor authentication on email, remote access and admin accounts
• Endpoint detection and response (EDR) on every computer and server
• Email filtering that catches phishing and fake invoices
• Backups that are encrypted, kept offsite and test-restored on a schedule
• Firewall and network management with rules and firmware kept up to date
• Security training so staff can spot a phishing email
• A written incident response plan so everyone knows who does what

If a provider can't explain how they handle each of these, keep looking. Our page on managed cybersecurity services shows how we approach them.

Your IT company or a separate security firm?

Many small businesses get security from the company that runs their IT. That company is often called a managed service provider, or MSP. Others hire a separate security firm, sometimes called an MSSP. Some use both.

One vendor is simpler. There's one number to call, and nobody can blame the other company. If you already pay for managed IT services, ask what security is included and what costs extra.

A separate security firm adds a second set of eyes. It can check the IT company's work. Businesses with strict compliance rules often like that setup.

Terms you'll see in a proposal

Security proposals are full of acronyms. Here is what the common ones mean.

• EDR (endpoint detection and response). Software on each device that spots and stops suspicious activity. It goes further than old-style antivirus.
• MDR (managed detection and response). A team that watches your EDR alerts and acts on them for you.
• SOC (security operations center). The people and tools that monitor alerts. It can be in-house or outsourced.
• SIEM. A system that collects logs from many sources in one place. Analysts use it to spot patterns.
• Penetration test. A hired expert tries to break in. You get a report and fix what they find.

Questions to ask before you sign

1. Who watches the alerts, and when? Ask if monitoring runs around the clock and who does it. Some providers use their own staff. Others use an outside security operations center.
2. What happens during an incident? Ask for their response plan in writing. Find out who comes on site and how fast.
3. How do they test backups? Backups can fail without anyone noticing. Ask how often they run a test restore.
4. Which compliance rules do they know? Ask about the rules that apply to you. Our guide to which compliance rules apply to your business covers the common ones.
5. Who owns the admin accounts? You should always keep your own admin access. Get that in writing.
6. What does the contract include? Most providers charge per user or per device each month. Look at the length, the scope and how you can cancel.
7. Can you talk to a client like you? Ask for a reference in your industry.

Red flags to watch for

• A promise that you'll never be breached. No one can honestly promise that.
• No written scope. You should know exactly what's covered and what isn't.
• Pressure to sign before an assessment. A good provider looks at your setup first.
• Scare tactics. A good provider gives you a clear list of gaps and what each fix costs.
• Weak security on their own tools. Attackers have gone after IT companies' remote access tools to reach their clients. Ask how they lock theirs down.

How cyber insurance fits in

Many insurers now ask detailed security questions before they write a cyber policy. Common questions cover multi-factor authentication, endpoint protection and backups.

A good provider helps you answer those questions accurately. A wrong answer can cause trouble when you file a claim. Ask your provider to review the application with you before you sign it.

What matters for Long Island businesses

Your industry often decides which rules you follow. It also shapes which attacks you're most likely to see.

Law firms and financial offices hold client files and move money by wire. That makes them common targets for fake payment instructions. Garden City has a lot of these offices. Our page on cyber security in Garden City covers how we protect them.

Insurance agencies and lenders licensed by New York State follow the NYDFS cybersecurity rule, known as Part 500. It requires multi-factor authentication and a written security program.

Several defense suppliers work out of the Hauppauge Industrial Park. Companies that handle Defense Department work may need CMMC certification. If that's you, ask any IT company in Hauppauge whether they've helped a business prepare for it.

Some problems also need a technician at your office. Ask where their techs are based. Ask how they handle on-site visits across Nassau and Suffolk.

How to get started

Start with an assessment. A good provider looks at what you have before quoting a plan. You should get a written list of gaps, ranked by risk.

To get started, request a free IT assessment or call (631) 654-6597. Tell us what you have today, and we'll tell you where the gaps are.