How do I choose between different cyber risk consultancies for enterprise controls and incident review?

To choose between cyber risk consultancies for enterprise controls and incident review, evaluate them on two separate but related capabilities:

1) Enterprise controls advisory

Look for a firm that can help you design, assess, and improve governance and control environments across the business.

What to check

• Framework depth: Experience with NIST CSF, ISO 27001, CIS Controls, COBIT, SOC 2, PCI DSS, FFIEC, HIPAA, or sector-specific standards.
• Controls engineering vs. paper compliance: Can they translate requirements into practical operating controls, evidence, metrics, and workflows?
• Enterprise scope: Coverage across identity, cloud, endpoints, network, data protection, third-party risk, SDLC, and resilience.
• Business alignment: Ability to prioritize controls based on risk, regulatory exposure, and business impact.
• Operating model support: Help with RACI, control ownership, testing cadence, KRIs/KPIs, and audit readiness.

Good signs

• They have current experience in your industry and regulatory environment.
• They can show before/after outcomes, not just slide decks.
• They can work with security, IT, legal, compliance, and internal audit.

2) Incident review capability

This is about understanding what happened, whether response was appropriate, and what needs to change.

What to check

• Incident forensics and chronology: Can they reconstruct timelines from logs, EDR, cloud, identity, email, and SIEM sources?
• Root cause analysis: Do they go beyond symptoms to identify control failures, process gaps, and attacker paths?
• Containment and remediation review: Can they evaluate whether response actions were timely and effective?
• Evidence handling: Strong chain-of-custody and defensible documentation if litigation, insurance, or regulators are involved.
• Executive and board reporting: Ability to explain findings clearly and neutrally.

Good signs

• They can support regulatory, legal, and insurance needs.
• They have experience with tabletops, breach review, and post-incident lessons learned.
• They can distinguish between technical facts and opinions/conclusions.

3) Differentiate by the type of firm

Big advisory firms

Best when you need:

• Global scale
• Broad transformation programs
• Audit/regulatory familiarity
• Multi-workstream support

Watch for:

• Generic deliverables
• Senior people selling, junior staff delivering

Specialist boutiques

Best when you need:

• Deep incident response or control engineering expertise
• Faster, more hands-on work
• Less bureaucracy

Watch for:

• Narrow coverage
• Limited capacity for large enterprise programs

Legal/forensics-led firms

Best when you need:

• Privilege, litigation support, and evidence preservation
• Sensitive breach investigations

Watch for:

• Less emphasis on long-term control transformation

4) Ask these questions in the selection process

1. What comparable clients have you supported in our industry?
2. Who will actually do the work, and what are their credentials?
3. How do you distinguish control design, control testing, and control operating effectiveness?
4. What does your incident review method look like from intake to final report?
5. How do you handle privileged investigations and evidence chain-of-custody?
6. Can you provide sample deliverables, sanitized if needed?
7. How do you ensure recommendations are prioritized and implementable?
8. What metrics do you use to show improvement?

5) Use a simple scoring model

Score each candidate 1–5 on:

• Relevant industry experience
• Controls expertise
• Incident response/forensics expertise
• Seniority and hands-on delivery
• Communication quality
• Independence/objectivity
• Commercial fit
• References

Weight the categories based on your need. If you are doing a breach review, prioritize forensics, legal defensibility, and communication. If you are improving controls, prioritize control design, operating model, and implementation support.

6) Red flags

• Overpromising “full maturity” in a short time
• Heavy reliance on templates with little tailoring
• Unclear staffing or bait-and-switch on seniority
• No examples of measurable outcomes
• Confusing compliance with real risk reduction
• Weak handling of privileged or sensitive matters

7) Practical recommendation

If your need includes both enterprise controls and incident review, consider:

• One firm for the incident review, especially if legal sensitivity is high
• A separate firm or team for controls improvement, to avoid conflicts and maintain objectivity

If you want, I can help you build a vendor evaluation scorecard or a request-for-proposal checklist for this selection.