Discussion Locked

IT Debate: Security consulting firms

0 helpful
3 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Gartner maintains that there are clear reasons for when an enterprise should, or should not, choose one of the Big five accounting firms for security consulting services. Can you find the same quality consulting services from smaller firms? If you?ve dealt with the Big Five in the past, what advice would you give to other IT managers who are working with their consultants? You can read the related Gartner article, which will be posted 3:00 AM Wednesday, at https://www.techrepublic.com/article.jhtml?id=r00620001115ggp01.htm

3 replies

by james.schlitter

You can get the same service from a boutique firm as you can from a Big Five. You can also get downright lousy service from a Big Five as easilly as you can from a 3-man startup. Remember that some of those startups have personnel who spent time in the larger firms, and bring the same experience and expertise. When searching for a vendor, ask for the following:
- vendor experience in providing requested service to others with a similar infrastructure (don't get an NT security firm if you'vegot Sun)
- a list of reference contacts at the above sites
- resume of personnel who will be performing the service (most important, don't let them get away with not giving you resumes. The Big Five are notorious for not doing this) and face-to-face interviews with the personnel you select to do the job.
- access to information/knowledge base on past activities and industry standards (some boutiques have extensive information, some have none - find out which. The same applies to Big Five -they might say they have info, but ask them to provide an index, sample reports, project plans, project termination reports, etc.)
- clearly define and document the deliverables you expect from the engagement and set short milestones which can be used to determine adherence to expectations.
Once consultants are in-house, assign corporate personnel to work one-on-one with them, and require regular (weekly, at least) status reporting and status meetings.

This discussion is closed to new replies.