Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most small businesses, a hybrid arrangement is the practical starting point: keep a responsible owner inside the company, use existing IT staff for business context and routine decisions, and contract an MSP, MSSP, or fractional security specialist for monitoring, specialist expertise, and incident help that is difficult to staff full time. A fully in-house security function can make sense when the company has enough scale, risk, and technical workload to support it. Outsourcing technical work does not outsource accountability. NIST states that a business remains responsible for protecting its systems and customers’ information even when it outsources cybersecurity. NIST’s small-business team guidance and NIST SP 800-61 Rev. 3 support a model based on clearly assigned responsibilities, authority, and information flows rather than a blanket claim that one staffing option is always cheaper or safer.
What the two models actually mean
In-house IT or security
In an in-house model, employees handle some or all security work. That may be a generalist IT administrator who owns endpoint protection, identity, patching, backups, and vendor coordination, or a larger team with dedicated security engineering and incident-response roles. “In-house” does not automatically mean “dedicated security department”: a small company may have one person responsible for security alongside many other duties.
Managed service provider (MSP)
An MSP manages agreed IT operations such as endpoints, networks, cloud administration, patching, help desk, and backups. Security capabilities vary widely. An MSP may perform important controls without offering continuous security monitoring or specialized incident response.
Managed security service provider (MSSP)
An MSSP focuses on security services such as log collection, alert monitoring, detection, vulnerability work, threat investigation, and incident response. The label alone does not establish coverage. One provider may monitor a defined set of cloud logs during business hours; another may offer 24-hour detection and an on-call response team. Read the service description, exclusions, hours, escalation rules, and response authority.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Fractional or on-demand security leadership
A fractional security leader or specialist supplies planning, risk decisions, policy work, compliance support, and occasional technical direction without becoming a full-time employee. NIST’s small-business guidance presents outsourcing and specialist help as options for a company that cannot afford a dedicated cybersecurity employee.
Why the decision matters
Security work combines technical controls with business judgment. Someone must decide which systems are critical, how much downtime is acceptable, whether an account can be disabled, when customers or regulators must be notified, and which risks the company accepts. A provider can perform tasks, but it cannot make every decision on the owner’s behalf or erase legal, contractual, and operational obligations.
NIST’s wording is direct: “even when you outsource some of your cybersecurity needs, you do not transfer your liability for protecting your business and your customers’ information.” The company remains ultimately responsible for its systems and data. Treat the provider as an extension of the team, not as a replacement for internal ownership.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Comparison at a glance
| Decision factor | In-house IT or security | MSP, MSSP, or fractional specialist | Hybrid approach |
|---|---|---|---|
| Business context | Employees usually know workflows, customers, and operational priorities directly. | Context must be learned and kept current through documentation and regular meetings. | Internal staff retain context while specialists add outside expertise. |
| Coverage hours | Often limited by staff schedules, leave, and on-call capacity unless the team is large. | May provide extended or 24-hour monitoring, but hours and response tiers differ by contract. | Provider watches agreed signals; internal staff handle decisions and business coordination. |
| Specialist skills | Depth depends on hiring, retention, training, and the person’s workload. | Can provide access to multiple analysts and technologies, subject to the contracted scope. | Uses specialists for difficult or infrequent work while retaining internal capability. |
| Control and authority | Direct control over tools, accounts, and priorities. | Authority must be explicitly granted; a provider may not be allowed to isolate systems without approval. | Pre-agreed authority lets the provider act quickly while the business keeps final decisions. |
| Cost predictability | Includes salary, benefits, recruiting, training, tools, leave coverage, and on-call work. | Usually a contracted fee, but scope, data volume, response hours, and overages affect the total. | Can target outsourced spending at monitoring or specialist gaps. |
| Provider risk | Access is concentrated in employees and internal systems. | Third-party privileged access, availability, confidentiality, and supply-chain risk must be managed. | Reduces single-provider dependence only if access and fallback procedures are designed deliberately. |
Official guidance does not provide a comparable current price for an internal security hire and an MSSP. Do not assume that outsourcing is cheaper, or that hiring is more expensive, without comparing equivalent deliverables and coverage.
Start with requirements, not a vendor or job title
NIST recommends documenting business objectives, legal, regulatory, and contractual obligations, high-value assets, and critical dependencies before building a cybersecurity team. This prevents a common mistake: buying a monitoring tool or hiring a generalist without defining what the business actually needs protected.
1. Record the business outcomes
- Which operations must continue during an outage?
- Which customer, employee, financial, health, or intellectual-property data would cause the greatest harm if exposed or destroyed?
- What recovery time and recovery point are acceptable for each critical system?
- Which contracts, sector rules, privacy commitments, or cyber-insurance conditions apply?
- Which decisions require the owner, an executive, legal counsel, or a customer-facing team?
2. Build an asset and dependency inventory
List users, endpoints, servers, cloud services, identity systems, remote-access tools, locations, backups, payment or customer systems, and vendors with network or data access. Note who owns each item, how it is authenticated, where logs go, and what would fail if it became unavailable. A provider cannot monitor or protect an asset that was never included in the scope.
3. Define outcomes in plain language
A useful request says “monitor identity, endpoint, firewall, and cloud events; triage high-severity alerts; notify our named contacts; and provide incident assistance outside business hours.” It does not merely say “provide a security platform.” Specify who patches, who reviews vulnerabilities, who tests backups, who investigates alerts, and what evidence the business receives.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When an in-house model is a good fit
Keeping more work inside can be appropriate when the company has a stable technical team, unusual systems that require deep local knowledge, strict data-handling constraints, or enough security workload to support dedicated roles. Internal staff can change priorities quickly and are already embedded in operations.
Requirements for making it work
- Coverage: Provide backup for leave, illness, turnover, and nights or weekends. A single administrator who is always on call is not a resilient response plan.
- Skills: Cover identity and access, endpoint and network security, cloud configuration, logging, vulnerability management, backup recovery, and incident coordination. Training and external escalation may still be necessary.
- Tools and process: Maintain asset records, documented baselines, alert triage, patch schedules, access reviews, backup tests, and an incident plan.
- Independence: Give security work enough authority and time to be performed, reviewed, and reported rather than treating it as an informal task added to an already full help-desk queue.
When outsourcing is practical
Outsourcing is useful when a small team lacks specialist depth, needs monitoring beyond employee hours, must handle an incident that exceeds its experience, or wants structured security planning without hiring a full-time specialist. NIST SP 800-61 Rev. 3 says incident handlers may be employees, contracted through an MSSP, or available on demand; some organizations combine internal response with third-party help for particular situations.
Questions to answer before signing
- Which users, devices, applications, locations, cloud tenants, and log sources are included?
- Is monitoring continuous, business-hours only, or an on-call service?
- What severity definitions and notification times apply?
- Who investigates, declares an incident, contains it, communicates externally, restores systems, and conducts the review afterward?
- Can the provider isolate an endpoint, disable an account, block traffic, or shut down a service without prior approval?
- What happens if the provider’s platform, staff, or connectivity is unavailable?
- How are provider administrators authenticated, logged, reviewed, and removed when access is no longer needed?
- How is business data handled during the engagement and deleted or returned at termination?
- Which reports, evidence, tickets, and audit records will the company receive?
- What work is explicitly excluded, and what additional charges apply to incidents, data volume, or projects?
NIST advises seeking multiple quotes and evaluating experience with both small businesses and the relevant industry, not price alone. The agreement should state the service level, responsibilities, and expectations in unambiguous terms.
The hybrid model: usually the most workable starting point
A hybrid arrangement keeps business ownership inside the company while assigning specific technical or time-intensive functions to specialists. For example, an internal IT administrator may own user access, approve disruptive actions, and coordinate recovery; an MSSP may collect logs, triage alerts, and investigate suspicious activity; and a fractional security leader may maintain the risk register and incident plan.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A practical division of work
| Work | Typical internal owner | Possible external role |
|---|---|---|
| Business priorities and risk acceptance | Owner or executive sponsor | Facilitate risk assessment and provide recommendations |
| Asset and account inventory | IT administrator | Validate coverage and identify blind spots |
| Routine patching and configuration | IT or MSP | Supply tools, maintenance, and verification |
| Continuous alert monitoring | Review service reports and escalations | MSSP monitors contracted sources and triages alerts |
| Incident declaration and containment approval | Named business decision-maker | Investigate, recommend, and act within written authority |
| Recovery and continuity | System owners and leadership | Provide technical recovery assistance and evidence |
| Post-incident improvement | Internal owner tracks changes | Deliver findings and remediation support |
Write a responsibility matrix before services begin
NIST SP 800-61 Rev. 3 emphasizes defined roles, information flows, coordination, and authority. Put those decisions in a written matrix that names one accountable owner for each activity. A simple matrix should cover:
- Asset inventory and criticality decisions
- Identity lifecycle, MFA, privileged access, and access reviews
- Patch and vulnerability management
- Endpoint, network, cloud, and email monitoring
- Backup operation and restore testing
- Alert triage and evidence preservation
- Incident declaration and severity assignment
- Containment approval and emergency authority
- Employee, customer, regulator, insurer, and law-enforcement communications
- System restoration and business continuity
- Post-incident review, lessons learned, and control changes
For each row, identify who performs the task, who approves it, who must be consulted, who receives notification, and the expected response time. Revisit the matrix when systems, staff, contracts, or provider scope changes.
Incident response: decide authority before an emergency
During an incident, delay often comes from uncertainty rather than a lack of technology. Agree in advance on the information the provider sends, the people it contacts, and the actions it may take. NIST specifically highlights decisions such as whether a provider may deactivate services to contain an incident.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Before an incident
- Maintain current contact details for the business, provider, leadership, legal counsel, insurer, and critical vendors.
- Define severity levels, notification channels, evidence-handling rules, and approval thresholds.
- Ensure the provider can reach the required logs and has tested access to the systems it is expected to investigate.
- Exercise the plan with a scenario such as a stolen administrator credential or ransomware affecting a critical file share.
When an alert arrives
- The provider or internal team records the alert, affected assets, timestamps, indicators, and initial severity.
- The assigned investigator validates whether the activity is suspicious and preserves relevant evidence.
- The incident owner informs the named business decision-maker using the agreed escalation path.
- The authorized party approves or directs containment, such as disabling an account, isolating an endpoint, blocking traffic, or temporarily taking a service offline.
- The team assesses business impact, coordinates required notifications, removes the cause, and restores from known-good sources.
- After recovery, the internal owner tracks corrective actions and records what the provider or staff must change.
Outsourcing can improve detection by allowing a provider to correlate events across customers, but it also creates provider-compromise, insider, privileged-access, confidentiality, and availability risks. Limit access, log provider activity, and maintain a fallback contact and recovery path.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsControls the business still has to own
The FTC’s small-business guidance maps practical work to the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. Whether employees or contractors perform the work, the business should verify that it is done.
- Govern and identify: Assign an owner, document assets and risks, understand dependencies, and track obligations.
- Protect: Require multifactor authentication, update software, limit access to what each person needs, encrypt sensitive data, and train staff.
- Detect: Monitor for suspicious activity and ensure alerts reach someone who can act.
- Respond: Maintain an incident plan, contacts, decision authority, communications process, and evidence procedures.
- Recover: Keep backups, test restoration, and maintain disaster-recovery and business-continuity plans.
For vendor access, the FTC advises putting security requirements in contracts, verifying compliance rather than relying only on assurances, limiting access to what is needed, and using MFA for vendor network access. Define how the vendor handles business data and what happens to it when the engagement ends.
MFA hardware keys as one possible control
The FTC gives inserting a hardware token as an example of MFA. A FIDO2-compatible security key can be one implementation for accounts that support it, but compatibility depends on the company’s identity provider, applications, and devices. It is a control—not a substitute for monitoring, backups, staffing, or incident response.
How to compare quotes with an internal plan
Ask every provider to price the same written scope. Then estimate the internal alternative using the full employment and operating burden rather than salary alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Comparison item | What to document |
|---|---|
| People and coverage | Number of staff or analysts, hours covered, leave backup, on-call expectations, and escalation contacts |
| Technology | Included tools, log sources, retention, licenses, integrations, and who administers them |
| Work performed | Monitoring, patching, access reviews, vulnerability work, reporting, tabletop exercises, and incident assistance |
| Response | Severity definitions, notification targets, investigation depth, containment authority, and recovery support |
| Evidence and assurance | Reports, tickets, audit records, security requirements, testing, and review cadence |
| Exit and continuity | Data return or deletion, credential removal, transition assistance, and coverage if the provider is unavailable |
| Total cost | Provider fees and overages, or internal compensation, benefits, recruiting, training, tools, leave coverage, and specialist escalation |
No universal price or effectiveness ranking is established by the cited official sources. A lower quote that omits overnight response, cloud logs, backup testing, or incident work is not equivalent to a higher quote that includes those outcomes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and how to correct them
Buying a label instead of coverage
Failure: Selecting an “MSSP” without checking what it monitors or when people respond.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Correction: Attach an asset list, log-source list, hours, severity definitions, response targets, exclusions, and deliverables to the agreement.
Assuming the provider owns every decision
Failure: No internal person can approve account disablement, service shutdown, customer notification, or recovery priorities.
Correction: Name an accountable business owner and document emergency authority and escalation paths.
Leaving the provider with excessive privilege
Failure: Shared administrator accounts, persistent access, or unreviewed third-party credentials create unnecessary exposure.
Correction: Use individual accounts and MFA, least privilege, logging, periodic access reviews, time-limited elevation where possible, and immediate offboarding.
Ignoring systems outside the contract
Failure: A newly adopted cloud application, remote office, or backup platform is invisible to the security process.
Correction: Tie onboarding and change management to the asset inventory and review scope whenever systems or vendors change.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Confusing reports with assurance
Failure: The business receives dashboards but never verifies patching, alert handling, access reviews, or restores.
Correction: Set review meetings, evidence requirements, sample checks, backup-restore tests, and corrective-action deadlines.
Relying on one person or one provider
Failure: A key employee leaves, or a provider becomes unavailable during an incident.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Correction: Keep current documentation, secondary contacts, emergency credentials under controlled custody, and a tested fallback procedure.
A staged way to choose and implement the model
- Assign an executive owner. Give one person authority to prioritize risk, approve spending, and coordinate business decisions.
- Inventory assets and obligations. Record critical systems, data, dependencies, contracts, and applicable requirements.
- Measure current coverage. Check MFA, patching, least privilege, encryption, backups, logging, monitoring, training, and response plans against the FTC’s baseline guidance.
- Identify the capacity gap. Separate routine work, specialist projects, continuous monitoring, and incident-response needs.
- Choose the target model. Keep work internal, outsource defined functions, or combine both according to risk, expertise, coverage, and authority.
- Write the scope and responsibility matrix. Include systems, hours, outcomes, exclusions, response authority, evidence, data handling, and exit terms.
- Obtain and normalize multiple quotes. Ask each candidate to price the same deliverables and disclose assumptions and overages.
- Validate the provider. Check relevant small-business and industry experience, access controls, escalation practices, references, and contract commitments.
- Onboard deliberately. Remove unnecessary legacy access, enable MFA, test log collection and alerts, document contacts, and run an incident exercise.
- Review performance. Track missed patches, unresolved alerts, response times, access reviews, backup tests, incidents, and open corrective actions.
Regulatory and geographic limits
The cited material is general U.S. federal guidance. The appropriate staffing model and obligations can differ by state, country, industry, customer contract, data type, insurance policy, and risk tolerance. A provider’s general security claim does not establish compliance with a particular law or contract. Have qualified legal or compliance advisers interpret requirements that apply to the business.
Bottom line
Choose the model that provides the required coverage and decision authority, not the model with the most attractive label. A small business commonly gets the best balance by retaining internal ownership of assets, risk acceptance, communications, and recovery while using an MSP, MSSP, or fractional specialist for defined operational and expert work. Whatever the arrangement, put scope, access, response powers, evidence, data handling, and exit obligations in writing, and verify that the promised controls operate in practice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
