How to choose a cybersecurity consulting firm: scope, frameworks and questions

Three vendors, three proposals, three lists of acronyms. One offers monitoring, another an identity protection platform, the third an audit. All say theirs is the urgent one. Without a criterion of your own, the decision ends up being who presented best or who charges least.

This guide explains what a cybersecurity consulting firm does, which types of service exist, what two public frameworks that serve as references say, how to compare proposals and what leadership should ask before hiring.

What does a cybersecurity consulting firm do?

A cybersecurity consulting firm helps the company decide what to protect, with which controls and with which vendors, and verify that those controls work. Its work starts from the business — which systems support the operation, which data must not be exposed, what customers and the sector require — and ends in a prioritized list of controls and the selection of the solutions that cover them.

What distinguishes a consultant from a tool vendor is the order: the consultant defines the risk and the criteria before proposing a solution; the vendor starts from its product. Both can coexist, but it's worth knowing which one you are hiring.

What types of cybersecurity services exist?

It helps to separate four types of service, because they are contracted and evaluated differently:

Advisory and assessment: evaluating risk, defining controls and policies, preparing the company for a standard or a customer requirement. This is the scope of an independent consultant.

Implementation: deploying and configuring the chosen solutions. Done by the vendor, an integrator or the internal team.

Operation: continuous monitoring, detection and response, usually contracted as a service from a specialized provider.

Verification: audits, penetration tests and periodic reviews that check the controls work.

The useful question isn't 'which tool do I buy', but 'which risk am I covering, with which control, and who answers if it fails'.

Have proposals but no criteria to compare them?

We assess the risk, define the controls the company needs and select solutions and vendors with criteria defined before seeing proposals, with no vendor commissions.

• Assessment organized by the NIST CSF 2.0 Functions
• Four criteria: functional, technical, economic and sustainable

Learn about cybersecurity consulting

Which public frameworks serve as references?

Two public frameworks help structure the assessment and compare proposals without being tied to a vendor.

The NIST Cybersecurity Framework 2.0, published by the U.S. National Institute of Standards and Technology on February 26, 2024, offers a taxonomy of high-level cybersecurity outcomes that any organization — regardless of its size, sector or maturity — can use to better understand, assess, prioritize and communicate its cybersecurity efforts. The framework does not prescribe how outcomes should be achieved; it organizes the categories into six Functions: Govern (the cybersecurity risk management strategy, expectations and policy are established, communicated and monitored), Identify (current cybersecurity risks are understood), Protect (safeguards to manage risks are used), Detect (possible attacks and compromises are found and analyzed), Respond (actions regarding a detected incident are taken) and Recover (assets and operations affected by an incident are restored). According to the document, the framework is designed for organizations of all sizes and sectors.

ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, is, according to ISO's official page, the world's best-known standard for information security management systems (ISMS) and defines the requirements an ISMS must meet. It provides companies of any size and from all sectors with guidance for establishing, implementing, maintaining and continually improving that system, and conformity with the standard means the organization has put in place a system to manage risks related to the security of the data it owns or handles. Its third edition was published in October 2022.

They are complementary: NIST CSF structures the assessment and prioritization; ISO/IEC 27001 structures the management system and allows certification when a customer or the sector requires it.

How do you compare cybersecurity proposals?

With the same four criteria that work for any technology selection. Functional: which identified risks the proposal covers and which it leaves out, Function by Function. Technical: how it integrates with what already exists — identities, devices, cloud, business systems — and what it demands of the internal team. Economic: the multi-year total cost, including operation, not just the license or the initial project. Sustainable: what happens when the company grows, changes systems or the vendor changes its terms.

And one prior criterion: if the proposals don't respond to the company's own assessment, they are not comparable to each other. Each one solves the problem its author knows how to solve.

Security is part of continuity

Controls reduce the likelihood of the incident; the continuity plan defines how the company keeps operating if it happens. We design them together.

• BIA that says what to protect first
• Plan tested with a real scenario

Talk to our team

What should you ask before hiring a cybersecurity consulting firm?

Five questions, in our view, distinguish an independent consultant from a sales channel:

Is the assessment done before proposing tools, and which framework structures it?

Does the firm receive commissions or incentives from the vendors it recommends?

What deliverables remain: risk inventory, prioritized list of controls, selection criteria, vendor comparison?

Who implements and who operates afterwards, and how is that implementation governed?

How does it connect with the business continuity plan and with certification requirements, if any?

What must leadership decide?

Cybersecurity has decisions that don't belong to the IT department: which data and processes must never be exposed, how much risk the company accepts and how much it invests to reduce it, who answers for an incident and who communicates with customers and authorities, and whether the company needs to certify. NIST CSF 2.0 places the Govern Function at the center precisely for that reason: it informs how the other five are implemented.

How we can help

At Cyrrus we provide independent cybersecurity consulting: we assess the risk starting from what is already in production, define the controls the company needs and select solutions and vendors with criteria defined before seeing proposals, with no vendor commissions. Implementation is governed by our Project Management.

Security is designed together with the business continuity plan, and if a customer requires certification, leadership prepares with the ISO 27001 course at Leadership Academy.

To go deeper into related topics: what a business continuity plan is and what IT strategy is.