How do I check a security consultancy’s sub-contractors before buying?

Start with the list and the invoices. Compare what the consultancy billed clients with what it paid sub-contractors for the same jobs. That shows how much of the revenue passes straight through and how much is the firm’s own work. It also shows which sub-contractors carry the heaviest load.

Next, read the agreements. Look for terms on confidentiality, ownership of what they produce, and what happens if the consultancy changes hands. Your lawyer should read these, because security work often involves sensitive client systems. Ask whether the sub-contractors have the access to client environments, and how that access is controlled and removed after a job.

Then talk to the clients where you can. Do they know that outside people work on their account? Do they approve? Some clients may only want the firm’s own staff. Finally, ask the sub-contractors whether they would continue after the sale and on what terms. A sale that loses the specialists loses what clients came for. Baseline security practice is a useful reference for questions about access. Finally, ask what the consultancy would do if a sub-contractor made a serious mistake on a client’s system. Insurance, review steps and past incidents show whether the firm manages outside people carefully or simply hopes for the best.

Key takeaways

• Compare client billings with sub-contractor payments to see true dependence.
• Have your lawyer read confidentiality and ownership terms in every agreement.
• Confirm how sub-contractor access to client systems is controlled and removed.