Briefing
Many offices run three vendors: one for the phone system, one for the internet circuit and firewall, and one for computers. When call quality drops or the network stops, each vendor checks its own piece and reports that it is fine. The problem lives in the gap.
A single managed scope removes the gap, but only if it is defined in writing and measured. The baseline should match public guidance rather than a vendor brochure. CISA's Cybersecurity Performance Goals describe a short list of practices with known risk reduction value, and CISA's KEV catalog tells you which vulnerabilities need attention first.
Compliance work belongs inside that scope, not bolted on once a year. Evidence such as patch records, access reviews and backup tests should be produced as a side effect of daily operations. And the operator should not certify its own work, a point HHS makes clearly about HIPAA certifications.
What to do
- Write down the scope: help desk, monitoring and alerting, patching, account management, backups, network and firewall, voice and call routing, and the compliance evidence you need.
- Require KEV-first vulnerability handling and a stated response time for KEV items on internet-facing devices.
- Ask for a single monitoring and reporting view. Ares RMM is the managed platform we use for that.
- Keep the right to buy hardware wherever you choose, with a spec list from your provider.
- Arrange independent review for the environment your operator runs.
How to verify
- Ask for last month's report. It should show patch status, open alerts, closed tickets and any KEV items with dates.
- Test the escalation path: open a ticket about call quality and see whether one team owns it end to end.
- Run a restore test from backup and record the time it took.
Sources
- CISA, Cybersecurity Performance Goals 2.0
- CISA, Known Exploited Vulnerabilities catalog
- HHS FAQ, Are we required to certify our organization's compliance with the Security Rule?
Questions about your phones, network or IT? Contact Texwan.