A technology provider should solve a defined business problem and leave your organization in control of its accounts, data and documentation. Start with an inventory and a clear service scope.
Define what needs support
List devices, email, website, software, remote access and the systems that must keep working. Identify the business owner for each account. Ask prospective providers how onboarding, incident response, backups and routine support are separated.
Keep ownership and recovery clear
Document administrative access, billing ownership, renewal dates and the exit process. Ask for a demonstrated backup restore and a written handover rather than assuming that a backup exists. Use CISA’s public guidance as a starting point for security habits and planning.
Measure the service you buy
Agree on response expectations, reporting, change approval and excluded work. Keep credentials in an appropriate secure system and review access when staff or vendors change. A sales claim of security is not a substitute for a defined control and evidence it works.
Richmond-area starting points
- Richmond Technology Council — Explore regional technology events and professional connections; check each event’s current registration details.
- CISA security guidance — Use public guidance to discuss account protection and security habits with staff and service providers.
- Richmond business networking guide — Compare local networking sources before choosing an event or membership.
Ask for a written service plan
Record the answers in one place so you can compare options on the same basis.
- Systems and accounts covered
- Administrative ownership and billing
- Response expectations and exclusions
- Backup restoration evidence
- Documentation and exit handover
Start with a business continuity conversation
Choose one essential task and discuss what would happen if its email, software or service provider were unavailable. Use the exercise below to assign owners, identify dependencies and prepare questions for your technology provider.
Six questions for a technology provider
Which systems and accounts are covered? Who owns administrator access? What response and recovery work is included? What restore evidence can you demonstrate? Which outside vendors does the service depend on? How are records, access and support transferred when the engagement ends? Ask for written answers tied to your systems.
Connect cyber planning to payments and contracts
Coordinate access and payment changes with the people responsible for finance and payroll. If a customer or government contract includes security requirements, identify the actual contract language and obtain qualified guidance. A general readiness exercise is not a certification or proof of compliance.
Common questions
Is a backup the same as a recovery plan?
Ask for a restoration demonstration and a plan for the business tasks that depend on the restored data. A backup message alone does not answer those questions.
Should we disable email to run the exercise?
No. Use a discussion scenario. Any technical testing should have a defined scope and appropriate authorization.
Are these cyber alerts?
This is practical planning guidance and source-linked reading. It does not promise continuous monitoring or an alert subscription.
