Vendors, Insurance & Response for Small Business
Section updated .
Small-business vendor and response planning has four parts: set security expectations for your MSP, keep an inventory of the vendors and SaaS that hold your data, know your cyber insurance requirements before a claim, and write down the first hour of incident response. Much of your risk sits in systems you do not run yourself.
A small business rarely runs its own IT end to end. A managed service provider, a payroll platform, an accounting package and a dozen SaaS tools hold the data and hold the keys. When one of them is breached or goes down, your business is affected whether or not you did anything wrong.
These guides turn that dependence into questions you can ask, lists you can keep and a short plan you can follow when something goes wrong.
Guides in this section
MSP security expectations
What to ask your IT provider, and how to write questions so that a yes can be verified.
Read the guide →Vendor and SaaS inventory
A one-page list of who holds your data, who can sign in, and how you would leave.
Read the guide →Cyber insurance requirements
Controls insurers commonly ask for, and why you must call the insurer before you call anyone else.
Read the guide →The first hour of incident response
Do, do not, and who to call, written down while it is calm.
Read the guide →How to work through this section
Read MSP security expectations and ask the questions at your next review. Build the vendor and SaaS inventory in an afternoon. Read your policy against common cyber insurance requirements, and print the first-hour plan before you need it.
Friday is vendor day in the daily briefing: pick one supplier each week and check what access it has.
Frequently asked questions
What should I ask my MSP about security?
Ask who has administrator access, whether it uses multi-factor authentication, how patches are verified, where backups are kept and who can delete them, and how quickly it will tell you about an incident. Ask for a version number or a date, not a reassurance.
Do I need cyber insurance?
Many small businesses carry it, and many customers and lenders ask for it. Policies differ widely, so read the exclusions and the control requirements, and keep the insurer's emergency number where staff can find it.
Who do I call first in a ransomware incident?
Call your cyber insurer's hotline first if you have a policy, because the insurer often controls which responders are approved. Then your IT provider or MSP, legal counsel, and the national reporting body.
How do I know which vendors matter most?
The ones that hold sensitive data, can move money, or whose outage stops you trading. The inventory guide sorts them by those three questions.
Be first when the email edition starts
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.