In short: The best time to find an IT security provider is before you urgently need one. Compare providers using concrete questions: how do they proceed, who works on your systems, how is evidence preserved, what is in the report and where are the limits of their offering. Reputable providers answer these questions clearly and in writing. Absolute promises, pressure and vague service descriptions are warning signs.
Why choosing is hard right now
After a situation like PHP2Shell, demand for security services rises abruptly. At the same time, offers appear that sound fast, comprehensive and cheap. For companies without their own security department, it is hard to tell quality from good marketing.
Then there is the time pressure. Anyone who suspects a break-in wants help immediately and has no week for a comparison. It is therefore worthwhile to make the choice in quiet times and clarify the key points in advance. Whether you need a provider at all is answered by our article Fix it yourself or bring in a provider?. This page is about how to find the right one.
Finding an IT security provider: the 12 questions
Put these questions to every provider you consider. The answers should be concrete and, where possible, in writing.
- Which systems do you know from your own work? A network security provider is not automatically experienced with PHP-FPM, Plesk or containers. Ask about the environments in which the team regularly works.
- Who specifically works on our systems? Own employees, partners or subcontractors? With partners it should be clear who takes on which task and who remains accountable to you.
- What does your approach look like in the first steps? Good answers name containment, evidence preservation and inventory before any cleanup, as the checklist after a hack also provides.
- How do you preserve evidence? Are logs and files backed up before changes, with timestamp and checksum? This matters for insurance, notifications and a possible criminal complaint.
- Which access do you need, and how do you handle it? Reputable providers ask only for the necessary rights, use personal accounts and return access after completion.
- Is there a written agreement before access? This includes scope, authority and, for personal data, a data processing agreement. More on this under Data processing agreements when service providers access servers.
- Who decides on far-reaching steps? Shutting down, deleting, rebuilding: the provider should propose and justify such steps, and the decision stays with you.
- What is in the final report? Ask for an example without customer data. A good report separates what is proven, probable and unknown, and names open points.
- How do you communicate during the engagement? Are there fixed contacts, regular interim updates and a clear channel for urgent queries?
- Where are the limits of your offering? Legal advice, communication with authorities or forensic expert opinions for courts are not taken on by everyone. A reputable provider says so unprompted.
- How is billing done? By effort, flat rate or as a framework contract? Have it explained what is included and what is not, so there are no surprises later.
- What happens after the incident? Does the provider support follow-up, hardening and ongoing support, or does the engagement end with the cleanup?
Warning signs in quotes
Some wording should make you prick up your ears. This includes promises of absolute security, the claim that after a cleanup “certainly nothing” is left on the server, and statements that already know the result without an inventory. Good providers talk about probabilities and evidence.
Caution is also due if a provider pushes for access before scope and authority are clarified, or if it approaches you unprompted by email or phone and claims your server has been hacked. In crisis weeks, fraudsters use such tricks. Verify the sender through an independent route before you react.
Another note: logos, seals and awards are easily placed on a website. In case of doubt, ask who issued a seal and what was assessed for it.
Public sources of guidance
The BSI publishes lists of qualified providers for certain areas, such as responding to so-called APT attacks, that is, targeted, long-term attacks, and defending against DDoS attacks. These lists are good guidance for organisations with a corresponding need. A typical incident on a single web server often does not fall into these categories; providers not listed there also come into question.
Recommendations from your own network are also helpful, for example from trade associations, chambers, your insurer or other companies that have experienced an incident. Some cyber insurers name their own contacts or service providers for a claim in their terms. Check your policy before commissioning anyone yourself.
Record the answers to the twelve questions in a short table and file it with the emergency plan. In an emergency you then know immediately whom to call and what has been agreed.
Put in writing what matters
Even with a good choice, the most important points should be settled in writing: scope of services, access and its return, confidentiality, handling of evidence, reporting duties and billing. Which clauses make sense is described in IT service provider contracts: setting security duties clearly. Whether your contract is legally sound is checked by a lawyer; we supply the technical points for that.
How does PHP SOS help?
- We answer the twelve questions for our own offering in writing before you commission us, including on the limits of our service.
- We state openly which tasks we take on ourselves and where we work with specialised partners, for example for forensics or penetration tests.
- We agree scope, authority and, where needed, data processing before the first access.
- In an incident we work according to the process of our incident response: contain, preserve, clean up, document.
Conclusion
You recognise the right security provider not by the loudest promise but by clear answers to concrete questions. Anyone who asks the twelve questions in quiet times and records the results decides faster and better in an emergency.
Frequently asked questions
How do I recognise a reputable IT security provider?
By clear statements on approach, responsibilities and limits, by a written agreement before access and by a report that separates what is proven from what is assumed. Be wary of absolute promises and of pressure to hand over access immediately.
Does the BSI keep a list of providers?
The BSI (German Federal Office for Information Security) publishes lists of qualified providers for certain areas, such as responding to APT attacks and defending against DDoS attacks. These lists concern special situations; for a typical web server incident, other providers also come into question.
Should I obtain several quotes?
For plannable engagements such as hardening, audit or maintenance contract, yes. In an acute emergency there is often no time for that. All the more important is it to choose a provider in advance and clarify the key points before anything happens.
May the provider shut down systems or delete data itself?
Only if you have expressly agreed that. A good provider asks before far-reaching steps and documents your decision. Define in advance who on your side may make such decisions.