Start with the systems, accounts and data your business relies on. This guide helps you organize a review, compare supplier scope and identify unanswered questions. It is a procurement aid, not a security assessment or insurance certification.
The threat landscape for Canadian SMBs
Consider how phishing, stolen credentials, exposed systems or a compromised supplier could affect your operations. Identify the systems and data at risk, and ask a qualified security provider to assess the gaps in your current controls.
The Canadian Centre for Cyber Security recommends baseline controls for small and medium organizations, including incident planning, software updates, access controls and backups. Use the source below as a starting point, then tailor the review to your systems and requirements.
What cybersecurity your business actually needs
Before evaluating any vendor, map your current controls, risks and gaps. Check the requirements that apply to your business, including your insurer's actual questionnaire and policy terms.
Endpoint protection
Inventory the devices that access your systems and data, then assess which can support endpoint detection and response (EDR). Other device types may need different controls. Ask what the proposed tool detects, how it responds and who reviews its alerts. Coverage on paper is different from active monitoring.
Identity and access controls
Review multi-factor authentication coverage across remote access, cloud applications and email, prioritizing privileged and sensitive accounts. Check your insurer's actual requirements and document any exceptions. Beyond MFA: least-privilege access (people have access to what they need, not everything), prompt deprovisioning of former employee accounts, and regular reviews of who holds admin credentials.
Backup and recovery
Backup protects you from ransomware, hardware failure, and accidental deletion. A backup that has never been tested is a backup of unknown value. The detail that has become critical with ransomware: backup isolation — your backup data needs safeguards against access or deletion through compromised production accounts. That typically means offsite or cloud backup with immutable storage or air-gapped separation from your primary systems.
Email security
Review filtering, sender authentication, suspicious-message reporting and staff training with your provider. Ask what impersonation, malicious attachments and links the proposed service covers, and how missed or suspected threats are handled.
Patching
Check whether software and device updates are applied across your environment, including remote workers. Ask who tracks critical updates, how exceptions are managed and how the team verifies deployment.
MDR vs. managed firewall vs. SIEM: what each layer does
The managed security market uses acronyms interchangeably in ways that obscure what you are actually buying. Here is what each layer provides.
Managed firewall. A third party manages and monitors your perimeter firewall — rule updates, patching the firewall itself, and alerting on unusual traffic. This is infrastructure management, not active threat hunting. Useful for businesses without the internal expertise to manage network security devices, but it does not provide visibility into what is happening on your endpoints or inside your cloud environment.
MDR (Managed Detection and Response). MDR provides active monitoring of your environment — typically endpoints and sometimes network and cloud — with human analysts who investigate alerts and take containment actions. The key differentiator from just having EDR software is the human response layer. MDR services vary significantly in scope: what environments they cover, whether response is automated or human-led, and response time commitments. Clarify these before signing.
SIEM (Security Information and Event Management). A SIEM aggregates logs and events from across your environment and applies detection rules to identify suspicious patterns. By itself, a SIEM is a tool that requires skilled analysts to get value from — it generates alerts that someone needs to investigate. Managed SIEM wraps analysts around it. Compare managed SIEM and MDR proposals by actual coverage, staffing, response authority and cost rather than assuming one fits every small business.
Check your insurance requirements before choosing controls
If your business has cyber insurance or is applying for it, read the actual application and policy with your broker or insurer. Note each question about access, devices, backups and incident response, then check which controls your team can demonstrate. Requirements vary by policy; a supplier's standard package is not evidence that your business meets them.
Before you attest to a control, ask the person who operates it to confirm its scope and keep the relevant evidence. If a requirement or coverage term is unclear, get an answer from your broker, insurer or qualified adviser. SwitchU can help compare supplier proposals against your stated requirements; it cannot determine insurance coverage or certify your security posture.
Red flags when evaluating vendors
Selling complexity before addressing the basics
If a proposal leads with advanced tools, ask the vendor to explain the underlying requirements and the state of your current controls. Ask how each proposed service addresses a documented gap and who will operate it.
Vague scope in the managed service agreement
What exactly is monitored? What does the provider do when they detect something — alert you, or take action? What is the response time commitment? What is not covered? Managed security services have wide variance in scope. If the contract does not answer these questions specifically, you do not know what you are buying.
No clear incident response process
Ask: if you detect ransomware in my environment at 2 am on a Saturday, what happens? Who does what, in what order, within what timeframe? A good security provider has a documented answer. A provider who describes this vaguely is telling you something important about their actual capability.
Stack complexity without proportional benefit
More products are not more security. Tool counts do not establish protection; configuration, coverage and a named operator matter. Ask any vendor to explain specifically what gap their product fills that your existing tools do not cover.
The evaluation checklist
- Audit what you currently have before you buy anything new. Many businesses are paying for tools that are installed but misconfigured or unmonitored.
- Review your cyber insurance application and confirm you are in compliance with every control you attested to.
- Confirm MFA is enabled on every remote-access system, cloud application, and email environment. Prioritize privileged and sensitive accounts, and document systems that need another control.
- Test your backups with an actual restore — not just confirm that backup jobs are completing.
- Map your endpoint coverage: are EDR agents installed and active on every device that accesses your network or data?
- Ask any managed security provider specifically what they do when they detect a threat — alert only, or active response?
- Confirm patch cadence: how long does a critical patch take to deploy across your devices?
- Understand your identity perimeter: who has admin access, is privileged access reviewed regularly, and are former employee accounts deprovisioned promptly?
- Ask a vendor about their SOC coverage model — is it 24/7, and is it in-house or outsourced?
- Check whether your security tools produce reports you can share with your insurer or auditor if required.
When to bring in a procurement desk
Cybersecurity procurement is harder to compare than most technology categories because vendors structure their services differently, scope their managed agreements loosely, and price in ways that make side-by-side comparison genuinely difficult. Our desk works with a curated set of Canadian security providers and can help you map your requirements to the right level of service — including identifying questions for a qualified security provider before you buy new services. SwitchU does not certify that your existing controls are adequate.
For what we source and how the desk works, see our cybersecurity solution page — or start a review with the form below.