iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Build a cybersecurity offering around each client’s risks and essential business services, not a fixed checklist of products. Use NIST’s Cybersecurity Framework (CSF) 2.0 to assess the client’s current and target security posture, then turn the most important gaps into defined services with named owners, clear response expectations, and tested recovery procedures.
Start with the client’s risks, not a bundle name
Before proposing controls, understand what the client needs to keep operating and what could put that at risk. Identify critical business services, important data, systems and identities, external dependencies, and the people authorized to make decisions. Ask how much disruption the client can tolerate and what must be restored first after an incident.
NIST CSF 2.0 offers a common structure for those conversations: Govern, Identify, Protect, Detect, Respond, and Recover. Build a Current Profile of the client’s cybersecurity posture and a Target Profile reflecting its priorities. The difference between them helps you sequence work around meaningful risk rather than sell every possible control. CSF 2.0 is a risk-management framework, not a certification. NIST provides the framework and related resources at NIST Cybersecurity Framework.
Turn assessment into owned work
- Map the environment: inventory important systems, data, users, administrators, cloud services, vendors, and dependencies. Record who owns each business service and who can approve changes or recovery.
- Set the current and target profiles: document existing practices, desired outcomes, and gaps that materially affect the client’s risk.
- Prioritize actions: agree what must happen first, who is responsible, what prerequisites apply, and how progress will be reviewed.
- Convert actions into services: define the provider’s recurring work, the client’s responsibilities, evidence of completion, and the outcome each service is intended to support.
What should a cybersecurity package include?
A comprehensive portfolio covers protection, detection, response, and recovery as well as assessment and governance. The table describes service-design outcomes, not a universal package prescribed by NIST or CISA; adjust coverage to the client’s profile and your ability to deliver it.
#1 Best Overall
| Service area | What the offering should do | Scope to make explicit |
|---|---|---|
| Assess and govern | Maintain an asset and data picture, risk priorities, a baseline, an action plan, and a review cadence. | Systems and business units assessed; client decision-makers; review frequency; treatment of suppliers and cloud services. |
| Identity and access | Require multifactor authentication (MFA), manage account lifecycle, restrict privilege, and secure provider access. | Users, applications, and accounts covered; administrative access; supported authentication methods; exceptions and account recovery. |
| Endpoint and configuration protection | Manage endpoint protection, security configuration, updates, and secure remote access. | Devices and operating environments in scope; update and configuration responsibilities; handling of unsupported or unmanaged devices. |
| Awareness | Help staff recognize and report common security risks, including phishing, and use safer password practices. | Audience, delivery cadence, reporting route, and how completion or follow-up is documented. |
| Logging and detection | Collect relevant telemetry, monitor defined systems, protect logs from unauthorized access or deletion, and escalate alerts. | Assets and data sources monitored; service hours; alert triage; log access and retention; escalation contacts and thresholds. |
| Incident response | Coordinate containment, investigation, communications, and recovery decisions under a written, exercised plan. | Provider and client decision rights; notification route; actions the provider may take; client and subcontractor responsibilities. |
| Backup and recovery | Make automatic, continuous copies of critical data and configurations, protect copies from the production network, and test restoration. | Data and configurations included; isolation or other protection; retention; restoration priorities; who performs and approves recovery. |
| Supplier oversight | Assess relevant cloud, MSP, and other critical suppliers, and incorporate dependencies into incident and continuity planning. | Security expectations, notification terms, subcontractors, evidence access, and exit or data-portability arrangements. |
Set a practical baseline for protection
For many small and medium-sized businesses, a starting baseline can combine an assessment and prioritized plan with managed identity and endpoint controls, patch and configuration management, staff awareness, protected backups, and scheduled reporting. CISA’s small-business resources address areas including phishing, passwords, MFA, updates, logging, backups, and encryption.
Make MFA and privileged access deliberate
Require MFA wherever the client’s systems support it, with priority for administrators and users who handle sensitive data. Prefer phishing-resistant methods when available and compatible with the client’s accounts. A hardware security key is one possible method, not a standalone security fix; confirm account compatibility and establish a workable recovery process. CISA’s MFA guidance discusses these priorities.
Provider access is part of the client’s risk surface. Use MFA, least privilege, scoped or dedicated accounts where practical, secure remote connections, and controlled administration. Avoid relying on a broad, always-available provider account when narrower access can do the job.
Make backups recoverable, not merely present
Specify which critical data and configurations are copied, how copies are kept apart from the production network, what retention applies, and who can restore them. Set restoration priorities with the client and test restores so both parties know whether the data can be recovered and who must act. CISA’s #StopRansomware Guide and MSP hardening guidance address protected backups and recovery.
Define monitoring and incident response before an alert arrives
“Monitoring included” is not a usable service description on its own. State what is monitored, when analysts review alerts, how alerts are triaged, how quickly and through which channel the client is contacted, and what happens if the contact does not respond. Define which actions the provider may take without approval, such as isolating a device or disabling an account, and which require client authorization.
Agree on the systems that produce logs, who can access them, how they are protected from alteration or deletion, and how long they are retained. Set retention to fit the client’s policy and relevant compliance needs; the appropriate period depends on the client’s circumstances. CISA’s logging guidance for business systems covers log protection and organizational retention considerations.
Rank #3
Maintain a written incident and communications plan naming business and technical decision-makers, provider and client responsibilities, containment steps, notification paths, and recovery coordination. Exercise the plan rather than treating its existence as proof that it will work. Joint CISA and partner-agency guidance for MSPs and customers emphasizes logging, monitoring, endpoint detection, and exercised response and recovery plans; see the joint MSP advisory announcement.
Package services by outcomes and delivery capacity
Tiers can make an offer easier to buy and operate, but labels such as “basic,” “advanced,” or “complete” do not explain what a client receives. Define included systems, users, service hours, responsibilities, evidence, and exclusions at every level. The examples below are packaging options, not a universal model endorsed by NIST or CISA.
| Package shape | Possible included outcomes | Important boundary to specify |
|---|---|---|
| Core managed protection | Assessment and action plan; managed identity and endpoint controls; patching and configuration management; awareness; protected backups; scheduled reporting. | Covered devices and accounts, remediation responsibilities, backup scope, and the difference between routine service and incident response. |
| Expanded detection and response | Core controls plus broader or extended-hours monitoring, defined alert escalation, and incident coordination. | Actual monitoring hours, analyst actions, response authority, notification expectations, and whether hands-on investigation or containment is included. |
| Specialized support | Where qualified staff and client needs justify it, add security testing, compliance support, or recovery services. | Specific deliverables, specialist qualifications, exclusions, dependencies, and any legal or regulatory interpretation that requires separate expertise. |
Offer a higher tier only when staffing, tooling, and operational processes can meet its stated commitments. A service promise that cannot be delivered consistently creates risk for both provider and client.
Make the statement of work operational
For each service, write down the following items in the service description and contract rather than leaving them implied:
- Systems, users, sites, and data included, plus customer prerequisites and exclusions.
- Provider actions, client actions, decision-makers, and any subcontractor roles.
- Service hours, severity definitions, response and escalation expectations, and incident notification procedures.
- Log sources, evidence access, protections, and retention; backup scope, retention, restoration roles, and test cadence.
- Change-management and reporting procedures, data handling, and exit or data-portability terms.
- How supplier and cloud dependencies are assessed and brought into incident and continuity planning.
Agree how the client will receive useful evidence that the service ran: for example, documented reviews, control status, alert escalations, backup and restore records, and tracked actions. Make clear what those records demonstrate and what they do not; a report is not a guarantee that a client cannot be breached.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Choose an internal, MSP, or hybrid delivery model
There is no universally best delivery model. Compare options against the client’s critical assets and identities, the hours it needs covered, the expertise it can sustain, and the decisions that must be made during an incident. Use the same service scope and questions for each option so the comparison is about operational fit, not feature count.
Best Value
| Comparison question | What to establish |
|---|---|
| Coverage | Are the client’s critical systems, identities, and dependencies included? |
| Operating hours | When are alerts monitored and acted on, and what is outside those hours? |
| Response authority | Who can isolate endpoints, disable accounts, contact affected parties, and authorize recovery? |
| Evidence | Can the client access relevant logs, service records, and incident information, and for how long? |
| Recovery | Are backup copies protected, restoration priorities agreed, and restores tested with clear roles? |
| Responsibilities | Which tasks belong to the client, provider, and subcontractors, including notification and escalation? |
| Contract and exit | Are notification, data handling, retention, subcontracting, and data-portability terms clear? |
| Operational fit | Does the model fit the client’s skills, budget, sector, risk priorities, and ability to make timely decisions? |
CISA’s vendor-risk resources include material for evaluating cloud services and MSPs. A client should assess its provider as a supplier, while an MSP should account for its own access and dependencies in the client’s risk and response planning.
Keep legal and sector requirements client-specific
Do not treat a general SMB package as proof of compliance. Applicable obligations depend on jurisdiction, sector, data types, contracts, and potentially insurance conditions. Establish those factors with the client and involve appropriate legal, compliance, or insurance specialists where needed; a general service portfolio cannot determine them on its own.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
