Free checklist
Every one of these can be answered in a sentence by a provider doing the work, and cannot be answered at all by one that is not. That is the only thing they are designed to separate.
Five pages. Each question comes with what a real answer looks like and what the plausible non-answer sounds like. Sent to you by email.
Where should we send it?
Why these ten
That is the difficulty with checking on technology. Everyone in the room is reassuring, nobody is lying, and there is still no way to tell from the conversation whether the work was done. So each question here comes with the thing that settles it: a document, a date or a number.
This is not a test of whether your provider is honest. Most are. It is a test of whether the evidence exists, which is a separate question, and the one nobody usually asks.
The first four
01 · Security
A real answer. A dated report you can read, with findings, and a named person against each one.
Not an answer. The name of a product. Owning a security tool is not the same as having it configured, monitored and tested.
02 · Security
A real answer. A current list. One named person per account, and a reason per account.
Not an answer. A number with no names, or “only the IT team.” Excessive administrator access is one of the most common findings there is.
03 · Backup and recovery
A real answer. A date, a duration, and what was restored.
Not an answer. “Backups run nightly.” That describes the backup, not the recovery. A backup that has never been restored is untested.
04 · Backup and recovery
A real answer. Two numbers, in hours, that someone has agreed to in writing.
Not an answer. “We would have you back up quickly.” Quickly is not a number, and nobody can plan around it.
The other six cover provider performance, technology spending, strategy and independence.
Reading your own answers
One gap is normal. Every organisation has one. Four is not a run of bad luck, it is a pattern, and a pattern means the reporting you receive is describing intentions rather than work.
Most people take the gaps back to their provider and a good provider closes them. That is the best outcome of this document and it needs nobody else involved. Where it does not resolve, the difficulty is rarely bad faith: it is that the only party who can confirm the work was done is the party who was paid to do it. That is what an independent review is for.