Questions to ask business internet providers about cybersecurity: who can change routing, which logs you can export, the incident clock, MFA on the portal, and credits that land on the invoice. CISA's Demand guide is the shopping list. Get it in writing.
Questions to ask business internet providers about cybersecurity should be answered in writing before you sign. Cover five items: who can change how your traffic is routed, which logs you can export, how many hours they have to tell you something broke, whether the account portal uses a second login check, and which credits appear on the next invoice without a fight. The same muscle, for software, is what to ask your vendors about security.
Kief Studio is two people, me and Brian. We work from Shrewsbury, Massachusetts. People lock onto the speed number the way they lock onto a phone-plan headline, then skip the paragraph about nights and weekends. I have watched that skip become a Saturday of "the circuit is up from our side" while the register waits on a page that never arrives.
Routing is the map of where your packets go. A packet is a tiny slice of a page load, an email, or a card swipe. If the map changes, a shop in Worcester can look "up" from the provider's dashboard while the line at the counter does not move.
Someone at the provider can change that map. Ask who, by name or by role, and how that person proves who they are. If the answer is "the tech who was here Tuesday" and the password is shared, you cannot reconstruct who moved the traffic. NIST said the same thing about shared passwords in another context: you cannot prove who acted. Circuits fail the same way. The log still names a group, not a person.
CISA, the US cyber agency, asks software makers to ship multi-factor authentication as a default. Multi-factor authentication (MFA) is a second check besides the password, like a phone prompt when you open the billing portal. You can ask your internet provider the same thing about the portal you use to open tickets and pay bills.
If MFA is a paid extra on that portal, write that down. It tells you how they think about your account before anything fails. Brian covers deeper network design on briansgagne.com. My job here is the five questions you can paste into an email this afternoon.
A log is a diary the machines keep. It records who logged into the portal, when an address changed, and whether the office router rebooted. Export means they send you a file you can keep on your own drive.
If the answer is "we can look for you," you are asking for a favor at 2am. Favors do not brief an insurer, a landlord, or a bank that wants to know why the shop was dark. Ask for a sample export from a lab circuit while everyone is calm. If they cannot produce a file in daylight, they will not at 2am.
CISA's Secure by Demand guide (August 2024) is a shopping list for buyers. It tells you to ask whether logging is built in, not bolted on after you sign. Put retention in the statement of work: how many days of logs, in what format, and who pays if you need a copy after an outage. That paper is also why I keep a software version of these questions at CISA Secure by Demand questions for software vendors. The circuit is a different contract. Treat it like one.
That statement of work is the paper that sits next to the quote. If the PDF ticket later disagrees with a packet capture you never received, you have disconnected data on the wire. Two stories, one Tuesday, and nobody can close the gap. A packet capture is a recording of what actually crossed the line. A ticket is a conversation. Conversations disappear. Files brief a landlord.
An incident clock is a written number of hours until they tell you, hours until a status page exists, who calls whom, and on which number a human still answers after 6pm. Put that in the same runbook as the registrar login. A runbook is a one-page list you can open when the line at the register is already forming.
Silence is the part people fill with a story. The story is usually "they must be on it." Write the hours so nobody has to invent that story. CISA's 1 May 2026 note on agentic systems called out obscure event records: you cannot fix what you cannot see. Circuits fail the same way. You often learn from a customer at the counter, not from the provider. That gap is what the clock is for.
Ask three concrete lines. How they notify you: email, phone, portal banner. Who on your side is the named contact. What happens if that person is on vacation. Who owns the site, the host, and the login is the website version of the same split. Keep the registrar in your name. Do not let a project freelancer hold the only copy of the DNS.
A service level agreement (SLA) is the promise in writing about what happens when they miss. In an office, it is the paragraph that decides whether a four-hour outage is a credit or a shrug. The 99.99 percent figure is easy to remember. The exclusion paragraph is where the promise shrinks.
Read scheduled maintenance, attacks, "your equipment," and weather. I have watched teams argue about a number and never read those exclusions. Compare two providers on three follow-ups: what window they measure, what is excluded, and whether credits post automatically. A credit that only arrives after you threaten to leave is not a service level. Ask when it shows up on the invoice, in dollars or days.
If they will not put those in the paper, you already have the answer. Leave megabits for last. Megabits are easy to print. Logs and credits are the part that shows up on a Tuesday.
Flexera's 2025 ITAM survey of 506 professionals put complete visibility of the tech stack at 43 percent. Visibility of who actually carries your traffic is often thinner than that. If you cannot name last mile, upstream, and who holds the router login, you cannot brief anyone when it fails. Last mile is the wire into your building. Upstream is whoever that company buys transit from.
That is fragmentation on the wire. Four companies can sit on one "business internet" invoice. You still need one person in your shop who can say which company owns which hop.
Network as a service (NaaS) means they sell you connectivity as a bundle. In a small office that can look like one monthly line item covering the circuit, a portal, and a "security add-on." The bundle can hide extra companies: last mile, transit, a DDoS service, a portal that is actually someone else's software.
DDoS is a flood of junk traffic meant to knock a site over. Ask who else sits on the path, and whether you may speak to them when the portal only shows a spinner. That sits next to the sub-processor problem without copying that article. You still own the office network, the domain registrar, and the decision to fail over to a backup path.
A backup path can be as simple as a second circuit or a known hotspot you will actually use if the primary dies. Write that down before you need it. Do not invent it at the counter.
The same questions sit inside evaluating a technology vendor. The circuit is still a contract. If you want a retained operator who already holds the night shift, that hire is how we describe the work at ltfi.ai. Engineering notes live on kief.dev. Neither replaces the five answers in your inbox. kief.studio is the parent studio if you want the full Build, Protect, Automate, Support picture.
Who can change routing, which logs you can export, the hours they have to notify you, whether the portal uses MFA, and how credits land on the invoice. Get it in writing.
A service level agreement is the written promise about misses. Read the exclusions and whether credits are automatic. The 99.99 number is the easy part.
A second check besides the password, usually a phone prompt or a hardware key. If they charge extra for it on the billing portal, treat that as a product-security fact.
A log export is a file you can keep that shows who changed what, and when. A ticket is a conversation. Conversations disappear. Files brief a landlord or an insurer.
If you cannot get a file after an outage, you cannot brief anyone who needs a timeline. Price a switch against that gap, then against megabits.
CISA Secure by Demand (August 2024) is the buyer list: is MFA extra, do default passwords still exist, how do patches install, is there a public VDP. Design is the maker pledge. Demand is what you ask before you sign.
68% of technology leaders plan to consolidate vendors this year. In regulated industries, the compliance case is even stronger than the cost case.
Your vendor's security posture is part of your security posture. When they have access to your systems, your data, or your clients — their breach is your breach.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
