Which key questions to ask while vetting an incident response company?

Question

If I ever suspect a security incident exceeding internal capacity & skill sets, my plan calls for outside professionals. In choosing a specific Company, I expect to expose the company to these risks:

1. Company does not have someone available for us right when we need them
2. Company sends someone lacking experience & competence to help us
3. our understanding of how much it costs to involve Company is way off
4. their services are are delayed beyond the desired damage control, e.g. by our inability to provide the documentation and credential-sharing they need, or by our inability to efficiently communicate with essentially unknown contractors

What I have:

• two companies which someone I trust praised
• hourly rates (but no idea how they translate to totals)

Questions I considered:

• How long has Company been in the security business? -> XX years.
• Does Company present at relevant conferences? -> Yes, at X-con.
• Does Company employ sufficient personnel to suggst immediate availability? -> They claim XX!
• How does Company homepage look? -> Full of essentially meaningless security buzzwords
• Do they employ notable people? -> Yes, author of tool X worked there at some point.
• Did we encounter them before? -> I once read a pretty neat writeup on Company blog. And I was once in a short call with Ms W. from Company who confirmed that yes, they do "incident response" a lot.

I do not believe these questions adequately help mitigate those risks. How should I improve my vetting to verify whether my choices really do mitigate some of the relevant risks?

Answer 1

When vetting a company where you are unqualified to assess the service they would provide, the main thing to ask for are references where you can talk to their own customers.

As for your list of risks that you want to mitigate:

The biggest mitigation is the contract, not the qualifying questions you ask.

Company does not have someone available for us right when we need them

If you need a certain availability, that should be in the SLA, not a question on a vetting list.

Company sends someone lacking experience & competence to help us

This is also an SLA issue. The maximum level of the expertise in the company is determined by the vetting process, but who they ultimately send needs to be covered in an SLA.

Our understanding of how much it costs to involve Company is way off

This isn't a vetting question at all, but a contract question.

we lack experience & competence to efficiently communicate with essentially unknown contractors during a crisis

we lack appropriate documentation and credential-sharing procedures to get them setup quickly

These are not vetting questions at all, but completely separate issues. I'm not sure why they are on the list.