What to ask your IT provider before a cyber assessment

Before a cyber assessment begins, agree with your IT provider which controls they operate, what evidence they can provide, and what decisions remain with your organisation. A working support relationship is a useful foundation. The assessment may require a different level of access, explanation and coordination from routine service delivery.

This is a scope conversation, not a test of whether your provider is doing a good job. A provider may be delivering exactly what was agreed while the assessment requires information or activities outside that agreement. Resolving those boundaries early helps both parties prepare.

Start with the environment being assessed

Give the provider a clear description of the proposed assessment: the systems and services involved, the assessment objective, and the people coordinating it. Include relevant cloud services and systems operated by other suppliers. Avoid assuming that every part of the environment sits within one provider’s responsibility.

Ask the provider to confirm where its service scope matches that boundary and where it does not. A difference is something to resolve, rather than evidence of a service failure. It may require another supplier, an internal owner or a change to the assessment arrangements.

Ask about operation as well as responsibility

A service description can establish who is expected to perform an activity. The assessor may also need to understand where the control operates, how it is checked and what happens when it does not work as intended. Useful questions include:

• Which controls do you actively operate, and which are operated by our team, a cloud provider or another supplier?
• Which systems and user groups are covered, and are there exclusions or exceptions we should understand?
• How do you check that the controls continue to operate across that scope?
• What evidence can you provide for the assessment, and what additional access or approval would be required?
• If a gap is identified, who can investigate it, who can implement a change, and who makes the business decision?

Agree how evidence will be made available

Evidence may be available through a report, a configuration view, a record of completed work or a discussion with the person operating the control. Agree the appropriate route with the assessor and provider before requesting a large export of material.

Clarify who can authorise access and how sensitive information will be handled. Some evidence may contain information about other customers or systems outside the assessment. A suitable view or demonstration may be needed instead. Ask about lead time and any additional work under the service agreement, rather than assuming immediate availability.

Use a short coordination record

For each relevant control or evidence request, record the following in a shared assessment coordination sheet. It can sit alongside the existing request list rather than becoming another reporting system.

• Scope: the systems, services or user groups the request concerns.
• Operational owner: the person or team that runs the control.
• Evidence contact: who can explain or provide the relevant material.
• Access arrangement: required permissions, handling constraints and the agreed delivery method.
• Open decision: any unresolved boundary, additional work or approval, with an owner and agreed date.

Keep business decisions with the right people

The provider can explain technical options and the consequences of a change. Your organisation still needs to identify who can decide on operational disruption, remediation priorities and acceptable exposure. Those decisions should not fall to a support contact simply because that person received the assessment request.

The useful outcome is a shared understanding of responsibilities and a workable route to the evidence. Where something remains uncertain, make it visible before the assessment starts. That gives the provider, assessor and business a clear issue to resolve together.

Strategic Cyber’s Essential Eight assessment service can help clarify the assessment scope and the evidence required from your organisation and its providers.