Cybersecurity buying researchBuy the missing operating capability, then choose the product or provider that can deliver it. Start with the business process that must keep working and the person responsible when it fails.
Write down three scenarios: a stolen Microsoft 365 administrator account, ransomware affecting a critical application, and the loss of an essential supplier. For each, identify the data needed to discover the problem, who can investigate, who can authorize containment, and how the business resumes service. This is a practical buying exercise informed by the risk-management approach in NIST's small-business guide.
| Missing capability | Likely buying route | Evidence to request |
|---|---|---|
| Nobody investigates alerts overnight | MDR or a staffed co-managed operation | Shift coverage and a witnessed escalation |
| Nobody owns priorities and executive reporting | Security leader or vCISO | Named lead, decision authority and quarterly outputs |
| Controls exist but are poorly configured | Implementation specialist | Configuration scope, change plan and acceptance evidence |
| Unknown exploitable weaknesses | Appropriately scoped penetration test | Rules of engagement, test coverage and retest terms |
| Recovery has never been demonstrated | Recovery engineering and exercise | Application-level restore and business sign-off |
These routes can be combined. A single contract is useful only if responsibilities remain explicit.
Working view: explore the first table
Missing capability
Nobody investigates alerts overnight
- Likely buying route
- MDR or a staffed co-managed operation
- Evidence to request
- Shift coverage and a witnessed escalation
Sources cited on this page
- NIST's small-business guide ↗csrc.nist.gov