How do I select someone to do vulnerability assessments?

When it comes to selecting a vendor to perform vulnerability assessments, there are a few key factors to consider. First and foremost, it's important to understand the difference between a vulnerability assessment and a penetration test. A vulnerability assessment is a non-intrusive evaluation of your organization's systems, networks, and applications to identify and assess any vulnerabilities that could be exploited by an attacker. A penetration test, on the other hand, is a simulated attack on your systems, networks, and applications to test the effectiveness of your security controls.

When selecting a vendor to perform vulnerability assessments, it's important to look for a vendor that has experience and expertise in your specific industry. For example, if you're in the healthcare industry, you'll want to look for a vendor that has experience working with healthcare organizations and understands the specific regulations and compliance requirements that apply to your industry.

Another important factor to consider when selecting a vendor is their methodology. It's important to look for a vendor that uses a reputable and well-established methodology, such as the OWASP Testing Guide or the NIST SP 800-115. This will ensure that the vendor is following industry best practices and that the results of the assessment will be reliable and actionable.

It's also important to consider the vendor's level of expertise and experience. Look for a vendor that has certified and experienced security professionals on staff. Certifications such as the Certified Information Systems Security Professional (CISSP) or the Offensive Security Certified Professional (OSCP) are a good indication that the vendor's staff has the necessary expertise and experience to perform vulnerability assessments.

When selecting a vendor, it's also important to consider the scope of the assessment. Will the vendor be performing a comprehensive assessment of your entire organization, or just a specific subset of systems or applications? It's important to have a clear understanding of the scope of the assessment so that you can budget accordingly and ensure that all necessary systems and applications are included in the assessment.

Another important factor to consider is the vendor's reporting and documentation capabilities. Look for a vendor that provides detailed and actionable reports that clearly identify vulnerabilities and provide recommendations for remediation. Additionally, ensure that the vendor provides all necessary documentation, such as a statement of work, a project plan, and a list of deliverables.

It's also important to consider the vendor's availability and responsiveness. Look for a vendor that can provide the assessment services within your desired timeframe and is responsive to your needs and questions throughout the process.

Finally, be sure to check references and customer reviews. Reach out to other companies that have used the vendor's services to get a sense of their level of satisfaction with the vendor's services and the quality of the assessment results.

All of these factors will help you make an informed decision when selecting a vendor for vulnerability assessments. It's also important to remember to consult with legal counsel to ensure that your company is in compliance with all relevant laws and regulations.