How to Choose a Trusted Cyber Security Consultant

Choosing a cyber security consultant is a decision about who you trust with your weaknesses. The right adviser reduces real risk and leaves your team stronger; the wrong one sells fear, tools or paperwork. This checklist, written by Security Solution Consultants (SSC), helps Australian businesses compare cyber security consulting services objectively, including ours.

10 things to check before you hire a trusted cyber security consultant

1. Relevant, current credentials

Look for certifications that match the work: ISO/IEC 27001 Lead Auditor or Lead Implementer for ISO programs, CISSP, CISM or CISA for security leadership and audit, and CREST accreditation for firms providing penetration testing. For Australian Government systems, IRAP assessments must be performed by an assessor endorsed by the Australian Signals Directorate. Ask who will actually do the work and which credentials they hold.

2. Experience with your obligations

Your consultant should know the rules that apply to you, not just general security. Depending on your sector that may include the Essential Eight, ISO/IEC 27001, APRA CPS 234 and CPS 230, the SOCI Act and AESCSF, PCI DSS, SOC 2, the Privacy Act 1988 and state government policies.

3. Independence

Ask whether they earn commissions on products they recommend, and whether the same firm will both implement and audit your controls. A good adviser discloses any interest and keeps implementation and assurance separate.

4. A risk-focused approach

Beware of tick-box compliance. A good consultant starts with your business, data and threats, and recommends the controls that reduce the most risk for the money, then maps them to the frameworks you need.

5. Clear scope and deliverables

You should know exactly what you will receive, by when, and for what price: for example, a gap assessment report, a prioritised roadmap, policies, or support through a certification audit.

6. References and comparable work

Ask for references from organisations of similar size and sector, and call them. Ask what changed after the engagement, not just whether they liked the consultant.

7. How they protect your information

A consultant will see your vulnerabilities, network diagrams and sometimes credentials. Ask how they store and protect that information, who can access it, and whether their own security is independently certified.

8. Knowledge transfer

The best engagements leave your team able to run the program. Ask how the consultant documents decisions, trains your people and avoids creating long-term dependence.

9. Communication with leadership

Your board and executives need clear, non-technical reporting. Ask for a sample executive summary or board paper.

10. Insurance and contracts

Check professional indemnity and cyber insurance, confidentiality terms, liability limits, and how findings will be handled if they discover a serious issue during the work.

Questions to ask before you sign

• Who exactly will work on our engagement, and what are their qualifications?
• Which frameworks and regulations have you delivered against for organisations like ours?
• What will we receive at the end, in what format, and who owns it?
• How do you prioritise recommendations, and how do you estimate effort and cost?
• Do you receive any payment from vendors whose products you recommend?
• How will you protect the sensitive information we share with you?
• How will you report to our executive team and board?
• What happens after the engagement if we need help implementing the roadmap?

Red flags that should make you walk away

• Guarantees. Promises that you will be “100% secure” or that certification is guaranteed. No honest adviser can promise either.
• Fear selling. Pressure to buy immediately after a scary demonstration, without a risk assessment.
• Product first. Recommendations that start with a tool before anyone has understood your business.
• Vague scope. Open-ended time and materials with no deliverables or milestones.
• Templates without tailoring. Policy packs with another organisation’s name still in them.
• Auditing their own work. The same people implementing controls and then certifying them as effective.

Consultant, managed service provider or auditor?

Many organisations use all three. The important thing is that the auditor is independent of the people who built and run the controls.

Choosing a consultant in your city

Local knowledge matters most for public sector work, where each state sets its own policy:

• Melbourne and Victoria: the Victorian Protective Data Security Framework and Standards apply to Victorian public sector organisations and their contracted service providers.
• Sydney and New South Wales: the NSW Cyber Security Policy sets mandatory requirements for NSW government agencies.
• Brisbane and Queensland: the Queensland Government’s information and cyber security policy (IS18) requires agencies to operate an ISMS based on ISO 27001. See cyber security services in Brisbane.
• Canberra: Commonwealth entities work to the Protective Security Policy Framework and the Information Security Manual.
• Perth, Adelaide and Hobart: state government policies and the Essential Eight increasingly flow through to suppliers.

We also have guides for Melbourne and Sydney. In New Zealand? Read how to choose a cybersecurity consultant in New Zealand.

What does a cyber security consultant cost?

Pricing depends on scope, complexity and the seniority of the people involved, and is usually quoted per engagement for defined work such as a gap assessment, or per day for ongoing advisory. Our guide to how much a cyber security consultant costs in Australia sets out typical engagement types and what drives price.

SSC’s cyber security consulting services: how we measure up

We wrote this checklist, so judge us against it:

• SSC is certified to ISO/IEC 27001 and follows a Secure by Design approach, including penetration testing, code review and threat modelling of our own platforms. See our Trust Centre.
• We are a risk-focused advisory firm working across Australia and New Zealand on ISO 27001, the Essential Eight, PCI DSS, energy sector security, business continuity and certification readiness.
• We also build software, GRCLens and EASMLens. When a recommendation involves our own products, we say so, and you are free to use any tool.
• We prepare you for certification; independent, accredited bodies audit and certify you.

If we are not the right fit, we will tell you. Contact us for an initial conversation.