Coming together is a beginning. Keeping together is progress. Working together is success.

— Henry Ford

According to a recent study by the California MEP Center (CMTC), only 10% of manufacturers surveyed have internal IT staff. This is certainly what I’ve observed among manufacturers who are seeking help with cybersecurity challenges. The process of choosing an IT services provider (ITSP) or managed services provider (MSP) starts with defining critical relationship success factors: vendor selection criteria. The following list of questions can be adapted to guide the selection process, survey prospective vendors, and produce a score for comparing different vendor offerings.

1. Performance.
   1. How does the service vendor measure the outcomes it achieves for clients?
   2. How does the service vendor report its performance (e.g., weekly, monthly, quarterly)?
   3. How detailed are reports on services delivered?
2. Reliability.
   1. What is the service vendor’s reputation among your peer group?
   2.  What is the service vendor’s reputation within the industry?
3. Responsiveness.
   1. What is the response window for troubleshooting calls?
   2. Is there a formal problem-reporting process?
   3. How is problem resolution documented and shared?
4. Service Transparency.
   1. Does the vendor explain services provided in nontechnical terms?
   2. Are backup processes tested and validated?
   3. Are software patching and system upgrade processes scheduled and communicated in advance?
5. Treatment of Manufacturer Information.
   1. How does the service vendor protect the manufacturer’s information?
   2. How is information used?
   3. Where does information reside when the engagement is complete?
   4. In what format is the information available to the manufacturer?
6. Industry Knowledge.
   1. Has the service provider worked with other manufacturers within your industry sector?
   2. Has the service vendor worked with others within the same or related supply chain?
7. Technology Knowledge.
   1. Is the service vendor agnostic with respect to technical solution(s)?
   2. Is the vendor proposing a packaged bundle that is proprietary or inflexible?
   3. Are outcome guarantees reasonable? (For example, a guarantee of “100% secure” or “100% uptime” is neither realistic nor reasonable.)
8. Security Knowledge.
   1. Is the service vendor familiar with a range of security guidelines? (Examples include contractual requirements like DFARS and ITAR; legal requirements like state privacy laws; and industry sector requirements like NIST SP 800-171, HIPAA, PCI-DSS.)
   2. Does the vendor support other organizations that operate within the same security framework(s) as your organization?
   3. Does the vendor team have cybersecurity certifications (e.g., Security+, CompTIAA, CISSP)?
   4. Does the vendor team have relevant technology certifications (i.e., for firewall, network, operating system, hardware, and other infrastructure components)?
9. Technology Planning.
   1. Does the service provider subscribe to security alerts like CISA?
   2. Does the vendor offer services to maintain an IT asset inventory, track software licenses and component end-of-useful-life considerations, and recommend infrastructure improvements?
10. Engagement Process.
    1. Is management of the process well-defined with an assured point of contact?
    2.  Are bios available for individual vendor team members who will be fulfilling the contracted work?
    3. Are specific technicians assigned to the account?
    4. Are services delivered on-premise, via remote access, or hybrid?
11. Terms and Conditions.
    1. Does the service vendor “allow” changes to its contract or is it willing to accept the manufacturer’s contracting language?
    2. Are the payment terms reasonable?
    3. Do costs quoted appear reasonable?
    4. Do services offered appear reasonable and comprehensive?
    5. What is not covered in the proposed contract?
    6. Are there penalties for nonperformance?
    7. Is there a penalty for termination of the contract?
    8. Are roles and responsibilities defined so that boundaries are clear?
12. Financial Stability.
    1. How is the service vendor rated with respect to information available through BBB or other credit-related resources?
    2. How long has the vendor been in business?

CLOSING THOUGHTS

Going with the low-cost bidder—or the friend of a friend of a friend—is not always the most prudent approach. Implementing a solid vendor selection process establishes the mutual expectations and basic rules of engagement that promote successful working relationships in the future.