Checklist for choosing a cybersecurity provider
Questions, evaluation matrix and pilot template for mid-sized companies
Cadena de suministro-TPRM
Checklist for choosing a cybersecurity provider
A four-phase checklist to compare cybersecurity providers on the same criteria: define your needs, ask everyone the same questions on eight criteria, score with a weighted matrix and test with a bounded pilot. Includes red flags per criterion and a pilot template.
Contents / Contenido
- How to use this checklistPreview
- Phase 1. Define what you needPreview
- Phase 2. Eight criteria to compareRequires download
- Phase 3. Weighted evaluation matrixRequires download
- Phase 4. Bounded pilot templateRequires download
- SourcesRequires download
Preview: first pages
A four-phase checklist to compare cybersecurity providers on the same criteria: define your needs, ask everyone the same questions on eight criteria, score with a weighted matrix and test with a bounded pilot. Includes red flags per criterion and a pilot template.
The preview of this whitepaper includes the executive summary, regulatory context and methodological approach that frames the rest of the document. Download to access full templates, matrices and checklists.
- How to use this checklist
- Phase 1. Define what you need
Sources
- Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (SP 800-161 Rev. 1 Upd. 1) — NIST
- Supply chain security guidance — UK NCSC
- NIS2 Directive: securing network and information systems — European Commission
- SOC suite of services — AICPA & CIMA
- STAR Registry — Cloud Security Alliance
- Software Bill of Materials (SBOM) — CISA
- MITRE ATT&CK — MITRE
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (SP 800-61 Rev. 3) — NIST, 2025-04-03
- Web Security Testing Guide — OWASP
- Application Security Verification Standard (ASVS) 5.0 — OWASP, 2025-05-30
Frequently asked questions
- Who is this checklist for?
- For security, IT, procurement or management leads at mid-sized companies about to hire or renew a cybersecurity service (pentesting, managed SOC, consulting, training) who want to compare providers on the same criteria.
- Are the matrix weights mandatory?
- No. The proposed weights are illustrative and add up to 100. Adjust them to your risk, your sector and your obligations before scoring.
- Does it replace legal advice?
- No. It is guidance only. The contract, liability and data processing should be reviewed with legal advice.
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.