What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Before signing or renewing a business internet agreement, ask the provider six things in writing: which controls protect the service, what customer and traffic data it collects, how incidents are reported, what DDoS protection actually covers, where the provider’s responsibility ends, and what evidence proves its commitments. An ISP’s general security promise does not guarantee confidentiality or prevent a compromise. Your business still controls its devices, accounts, applications and internal network.
The questions below are a U.S.-focused due-diligence framework based on guidance from the Federal Trade Commission (FTC), Cybersecurity and Infrastructure Security Agency (CISA) and Federal Communications Commission (FCC). They are not a universal legal checklist. Map the answers to your industry, contracts, insurance, privacy obligations and the locations where you operate.
Start by defining what your business needs the connection to protect
A provider cannot give a useful answer until you describe the service and the consequences of failure. List every location, circuit, cloud connection, public-facing service and critical business process that will use the connection. Note whether the service carries payment information, health data, employee records, trade secrets, voice traffic or operational technology.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Identify the services that must remain reachable, such as point-of-sale systems, remote-access gateways, websites, email, voice or production applications.
- Record uptime, recovery-time and recovery-point expectations for each critical service.
- List regulatory, contractual and cyber-insurance requirements that may affect notification, logging, retention or supplier oversight.
- Decide which controls your team operates and which you expect the ISP to operate.
This preparation prevents a common mistake: treating “business internet” as a complete security service when it may only provide transport to your premises.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What security controls protect the service?
Ask the provider to describe controls for its network, equipment, facilities and support systems—not just the security of an optional firewall or cloud product. The FTC recommends investigating a provider’s data-security practices, putting expectations in the contract and verifying that the provider follows through.
Questions to ask
- What technical and physical controls protect the network and the service delivered to our locations?
- Which controls are included in the base connection, and which require a managed security service or separate agreement?
- How are network devices hardened, patched and protected from unauthorized administrative access?
- How do you monitor for vulnerabilities, abuse and security incidents affecting our service?
- How are privileged accounts protected, and is multifactor authentication required for administrator access?
- Which subcontractors or upstream carriers can access systems involved in delivering our service?
Request evidence, not only assurances
Ask for current security policies, independent assurance reports, certifications or a clear control description that your security team can evaluate. Confirm the period covered by any report and whether it applies to the exact service and locations you are buying. Ask how often controls are assessed and whether material findings are tracked to remediation.
Also ask what you may review during the relationship: security updates, service reviews, audit summaries, penetration-test attestations or compliance reports. A provider may reasonably restrict sensitive details, but it should explain the restriction and offer a way to verify contractual commitments. CISA’s small-business guidance emphasizes policies, access controls, hardened devices, incident detection and recovery as supplier-assessment concerns.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What customer, device and traffic data does the ISP collect?
Do not assume every ISP collects or uses the same information. Ask for the provider’s current privacy policy, service order and data-processing terms, then reconcile them with your own obligations.
Use this data-and-access question set
- What customer, device, connection, location and traffic information do you collect or generate while providing the service?
- Do you retain source and destination information, timestamps, bandwidth records, DNS data, support recordings or equipment logs?
- How are those data used—for operations, billing, abuse prevention, analytics, advertising, troubleshooting or other purposes?
- How long is each category retained, and can retention periods be shortened?
- Which employees, contractors, carriers or government authorities can access it, and under what process?
- Is information shared with affiliates or service providers, and where are those parties located?
- What safeguards protect information stored or transmitted by the provider?
- What customer controls, restrictions or opt-outs are available, and where are they documented?
FCC materials identify risks from passive monitoring of data or metadata, but those analyses do not establish that a particular provider currently monitors or mishandles your traffic. Ask the provider to distinguish payload content from metadata and explain what it can technically observe. Encryption you control—such as properly configured HTTPS, a site-to-site VPN or application-level encryption—can reduce exposure, but it does not make connection metadata disappear.
How quickly will the provider notify you about an incident?
Incident language is one of the most important parts of the agreement. The FTC advises businesses to insist on notification even when an event is suspected and has not yet been confirmed as an actual data breach.
Rank #2
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
Define the trigger
Ask whether notice is required for unauthorized access, malware, credential compromise, loss of provider equipment, service disruption, suspected exposure of your information, or a security event at a subcontractor. A clause limited to “confirmed breach of personal data” may leave you unaware of an attack that affects availability or requires your team to investigate.
Recommended Free Tools
Define timing and channels
- How soon after discovery will the provider send an initial notice?
- Will it notify you around the clock, including weekends and holidays?
- Which channels are used—telephone, email, portal, text or an emergency bridge?
- Who is the named 24/7 escalation contact, and how is that contact tested?
Ask for an initial notice as soon as practicable, followed by updates as facts become available. Your contract should not force the provider to wait for a complete forensic conclusion before warning you about a potentially material event.
Specify the information and assistance you receive
Require notices to include the affected service and locations, time line, indicators of compromise where shareable, data categories potentially involved, containment steps, expected customer actions and a current point of contact. Ask what response, restoration, evidence preservation and post-incident review support is included. Clarify who coordinates with law enforcement, regulators, insurers and your incident-response firm. Request a description of a relevant past incident, subject to confidentiality limits, so you can assess whether the provider can execute its process.
Does the service include DDoS protection?
“DDoS protected” is not a complete answer. CISA recommends engaging the ISP to understand existing DDoS protections and reviewing the agreement for coverage limitations and gaps.
Pin down the protection’s scope
- Is detection or mitigation included by default, or does it require a managed service, higher tier or separate activation?
- Which public IP addresses, locations, circuits, protocols and ports are covered?
- Are volumetric, protocol and application-layer attacks treated differently?
- Are cloud services, voice, customer-managed equipment or traffic through another carrier excluded?
- What thresholds trigger mitigation, and can a threshold create false positives or unnecessary blocking?
Understand how mitigation operates
- Is mitigation automatic, or must your team call the provider?
- How long does traffic diversion or filtering normally take after detection?
- What emergency number and escalation path should be used during an attack?
- What customer changes—such as DNS, routing or firewall updates—are required?
- What attack data, reports and lessons-learned information will be supplied afterward?
Ask what availability, restoration and service-credit commitments apply during an attack. No mitigation service guarantees zero downtime or blocks every attack, so document the residual risk and the controls you must operate.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where does the ISP’s responsibility end?
Use a responsibility matrix rather than relying on marketing terms. For each control, name the owner, the required action, the evidence you receive and the consequence if it is missed.
Rank #3
- Extensive Connectivity Options: The FortiGate 60F is designed with 10 GE RJ45 ports, including 2 WAN ports, 1 DMZ port, and 7 internal ports, offering broad flexibility and high-density connections for diverse enterprise networking needs.
- Superior Performance for Secure Networks: Features powerful system-on-a-chip acceleration to deliver top-tier security with 1.4 Gbps IPS throughput and 700 Mbps threat protection throughput, ensuring effective defense against advanced threats.
- Enhanced SSL Inspection and SD-WAN Capabilities: Utilizes purpose-built security processor technology to provide the industry's highest SSL inspection performance and robust SD-WAN functionality for secure, high-speed network operations.
- Simple and Effective Management: Comes equipped with a user-friendly management console that supports comprehensive network automation and visibility, alongside Zero Touch Integration with Fortinet's Security Fabric for streamlined deployment.
- Advanced Security Features: Leverages continuous threat intelligence from AI-powered FortiGuard Labs, identifying and mitigating both known and unknown threats, enhancing security across all network traffic, whether encrypted or not.
| Area | Questions for the provider | Typical customer responsibility to confirm |
|---|---|---|
| Network and carrier infrastructure | Which routers, links, facilities and upstream providers are covered? How are they secured and monitored? | Protect on-premises cabling, local switches and equipment that your staff manages. |
| Edge equipment | Who patches, backs up and restricts administrative access to provider-supplied gateways? | Change default credentials, restrict your own devices and approve configuration changes. |
| Perimeter filtering | Is a firewall or DDoS service included, and what rules and logging do you receive? | Maintain internal firewall policy, segmentation, endpoint protection and log review. |
| Accounts and applications | What support-account controls and identity checks protect provider access? | Use multifactor authentication, least privilege, patching and secure application settings. |
| Incident response | Who detects, contains, communicates and restores the provider portion? | Investigate your systems, preserve evidence, notify your stakeholders and execute your plan. |
Have qualified counsel review material terms. FTC and CISA guidance supports written obligations, monitoring and verification, but it does not prescribe one standard set of ISP clauses for every business.
What should the contract say?
Convert the answers into enforceable language in the master agreement, order form, service-level agreement and any data-processing addendum. Confirm that a marketing page cannot silently override the signed terms.
- Name the security controls and service boundaries that apply to your locations and products.
- Define incident triggers, notification timing, channels, cooperation and restoration duties.
- State DDoS coverage, exclusions, thresholds, customer actions and escalation contacts.
- Describe verification rights, available reports, review frequency and notice of material control changes.
- Require advance notice, or at least prompt disclosure, of relevant subcontractor or upstream-provider changes.
- Specify how data, logs, credentials, configurations and equipment are returned, deleted or disabled when service ends or changes.
- Review limitations of liability, exclusions, service credits and other remedies alongside the business impact of an outage.
Ask how the provider will demonstrate ongoing compliance, not only compliance on the signing date. Set a recurring supplier review with an owner in your organization.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow can you compare providers’ answers?
Send every candidate the same questionnaire and score the evidence, not the confidence of the salesperson.
| Comparison axis | Stronger answer | Warning sign |
|---|---|---|
| Specificity and proof | Names controls, scope, assessment dates and documents you can review. | “Enterprise-grade security” with no service-specific evidence. |
| Data practices | Clearly states collection, use, retention, access, sharing and safeguards. | Privacy terms are broad, inconsistent or unavailable before signing. |
| Incident readiness | Written triggers, time frames, contacts, updates, cooperation and restoration roles. | Notice is limited to a confirmed breach or handled only through a general help desk. |
| DDoS scope | Identifies covered destinations, attack types, activation, exclusions and customer actions. | Protection is advertised without thresholds, exclusions or an emergency process. |
| Accountability | Contract includes verification, change notice and meaningful remedies. | Important promises appear only in presentations or are expressly excluded. |
| Business fit | Answers match your locations, critical services, sensitive data and obligations. | The provider expects you to accept a generic package without risk mapping. |
Questions for common buying situations
When the ISP also hosts your website or email
Ask hosting-specific questions about application backups, administrator access, malware handling, data export and restoration. A web-host checklist is not automatically an ISP checklist; apply those questions only to services the provider actually hosts.
When you have several offices or remote workers
Ask whether the same controls, notification terms and DDoS coverage apply at every location and to remote-access circuits. Confirm failover routing, configuration consistency and who owns changes when a site is added or moved.
Rank #4
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
When you operate under sector rules or strict contracts
Give the provider a written list of required retention, location, audit, breach-notice and subcontractor terms. Obtain confirmation that the exact product and region satisfy those requirements; do not infer compliance from a corporate certificate that covers a different service.
Controls your business still needs
Provider diligence complements, rather than replaces, customer-side security. Maintain patched endpoints and network devices, strong identity controls, multifactor authentication, segmentation, tested backups, secure remote access, logging and an incident-response plan. A business firewall appliance may add a useful customer-side layer, but check compatibility with the ISP’s equipment and have your IT provider design and maintain the configuration.
More than 30 million U.S. small and medium-sized businesses account for nearly half of U.S. GDP, according to a 2023 CISA vendor-assessment fact sheet. That scale makes supplier decisions consequential, but the figure is not a measure of ISP breach frequency or security risk.
“Every technology provider must take ownership at the executive level to ensure their products are both secure by design and secure by default.”
CISA makes that statement on its Small and Medium Businesses resource page. Treat it as a procurement expectation: the provider should be able to explain how security is built into the service and how that claim is checked.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
A practical review sequence before you sign
- Document locations, critical services, sensitive data, recovery needs and applicable obligations.
- Send the same written question set to each provider and require answers for the exact product and region.
- Collect policies, assurance documents, data terms, DDoS descriptions and sample service-level language.
- Mark every answer as provider-owned, customer-owned or shared, then identify an owner for unresolved items.
- Ask follow-up questions about exclusions, subcontractors, evidence, emergency contacts and termination handling.
- Have IT and qualified counsel review the technical and contractual gaps before approval.
- Put accepted controls, notification duties, verification rights and remedies into the signed agreement.
- Schedule recurring reviews and test emergency contacts before an outage or incident occurs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
