Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBefore signing or renewing a business internet agreement, ask the provider to explain five things in writing: how it secures the service, what customer and traffic data it collects, how it handles incidents, what DDoS protection actually covers, and where the provider’s responsibility ends and yours begins. Then require evidence and contract terms that let you verify those promises. An ISP’s general security statement does not guarantee confidentiality or prevent a compromise of your devices, accounts, applications, or internal network.
Why an ISP security questionnaire matters
Your internet provider carries traffic between your locations and the wider internet. It may also operate routers, managed firewalls, DNS, voice systems, cloud connections, email, web hosting, or other services on your behalf. That access creates operational and privacy dependencies, but it does not transfer your entire security obligation to the provider.
As an Amazon Associate I earn from qualifying purchases.
The U.S. Federal Trade Commission (FTC) advises businesses to investigate a service provider’s security practices, put expectations into contracts, monitor performance, and verify that the provider follows through. The Cybersecurity and Infrastructure Security Agency (CISA) similarly emphasizes policies, access controls, hardened network devices, incident detection, recovery, and contractual obligations. These are due-diligence principles, not a universal legal checklist for every industry or country.
The scale of the issue is substantial: CISA says the United States has more than 30 million small and medium-sized businesses, representing nearly half of U.S. gross domestic product. Your questions should therefore be tied to your own locations, critical services, sensitive information, regulatory duties, and tolerance for downtime rather than to a generic “business-grade” label.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
CISA’s small-business resource page summarizes the supplier expectation this way: “Every technology provider must take ownership at the executive level to ensure their products are both secure by design and secure by default.” Treat that as a prompt to seek specific controls and proof, not as evidence that any particular provider meets the standard.
How to prepare before speaking with a provider
- Map what the connection supports. List offices, remote sites, cloud workloads, payment systems, voice services, public websites, remote-access tools, and any service that would materially affect operations if the connection failed.
- Identify information at stake. Note personal information, health or financial data, credentials, business secrets, logs, and traffic metadata that could pass through or be stored by the provider.
- Separate provider and customer controls. Document what your team manages—endpoints, identity, Wi-Fi, firewalls, applications, backups, and configuration—from what the ISP manages, such as its backbone, edge equipment, monitoring, and any optional managed services.
- Set evidence requirements. Decide which documents, reports, service descriptions, testing summaries, or contractual commitments you need before approval. A sales presentation is not a substitute for verification.
- Invite the right reviewers. Have IT, security, operations, procurement, and qualified legal counsel review answers that affect regulated data, liability, notification duties, or termination.
What security controls protect the service?
Ask which controls are included
Ask: “What security controls protect the network and the service delivered to our locations?” Follow with: “Which controls are part of the base connection, and which require a managed service or separate agreement?” A provider may advertise firewalling, filtering, secure remote access, monitoring, or DDoS mitigation without including every feature in your quoted service tier.
Request a plain-language description of network access controls, device hardening, authentication for administrative access, vulnerability management, logging, physical protection, and backup or recovery for provider-managed systems. Ask whether the description applies to every location and circuit in your order or only to selected products.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAsk how controls are assessed
Ask for security policies, assurance documents, independent assessment summaries, or other material that explains how controls are tested. The useful question is not simply whether a provider has a certification; it is which systems and services the document covers, its assessment period, and what exclusions apply.
Ask how the provider monitors for vulnerabilities and security incidents affecting the service, who reviews alerts, and how weaknesses are prioritized and corrected. If subcontractors operate portions of the network or support function, ask which controls apply to them and how the provider oversees their work.
Ask how you can verify performance
Ask: “What can we review or request to verify that contractual security commitments are being met?” Possible evidence includes service reports, control attestations, incident summaries, maintenance notices, penetration-test summaries, or a customer audit process. Clarify what is available routinely, what requires a request, and what information is withheld for security or confidentiality reasons.
Rank #2
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
What customer and traffic data does the provider handle?
Define the data categories
Do not assume every ISP collects the same information. Ask what customer, device, connection, billing, support, diagnostic, and traffic information the provider collects or generates while delivering the service. Ask whether traffic data includes content, destination information, timestamps, volume, protocol, addressing, DNS activity, or other metadata.
Understand use, retention, access, and sharing
Ask how each category is used, how long it is retained, where it is stored, who can access it, and under what circumstances it is shared with affiliates, contractors, authorities, or other customers. Request the current privacy policy and the contract language that controls if the two documents differ.
The Federal Communications Commission (FCC) has described risks involving passive monitoring of data or metadata, as well as active attacks such as denial-of-service disruption and BGP hijacking. Those descriptions establish why the questions matter; they do not prove that a particular provider currently monitors or mishandles your traffic.
Ask about safeguards and customer choices
Ask what safeguards protect information the provider stores or transmits, including access controls, encryption in transit or at rest where applicable, segregation between customers, key management, and secure disposal. Ask whether you have controls or opt-outs for optional analytics, traffic inspection, marketing use, or data sharing, and where those choices are documented.
How will the provider notify and handle security incidents?
Define the events that trigger notice
Ask what events trigger notification: a confirmed breach, suspected unauthorized access, malware on provider systems, loss of availability, exposure of credentials, or a vulnerability that could affect your service. FTC guidance recommends insisting on notice even when an incident has not yet been confirmed to have caused an actual compromise.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set timing, channels, and escalation
Ask how soon the provider will notify you, whether the clock starts at discovery or confirmation, which channels it will use, and who your 24/7 escalation contact is. Obtain a named role or team, an emergency telephone process, and a backup route if the normal support portal is unavailable.
Rank #3
- Extensive Connectivity Options: The FortiGate 60F is designed with 10 GE RJ45 ports, including 2 WAN ports, 1 DMZ port, and 7 internal ports, offering broad flexibility and high-density connections for diverse enterprise networking needs.
- Superior Performance for Secure Networks: Features powerful system-on-a-chip acceleration to deliver top-tier security with 1.4 Gbps IPS throughput and 700 Mbps threat protection throughput, ensuring effective defense against advanced threats.
- Enhanced SSL Inspection and SD-WAN Capabilities: Utilizes purpose-built security processor technology to provide the industry's highest SSL inspection performance and robust SD-WAN functionality for secure, high-speed network operations.
- Simple and Effective Management: Comes equipped with a user-friendly management console that supports comprehensive network automation and visibility, alongside Zero Touch Integration with Fortinet's Security Fabric for streamlined deployment.
- Advanced Security Features: Leverages continuous threat intelligence from AI-powered FortiGuard Labs, identifying and mitigating both known and unknown threats, enhancing security across all network traffic, whether encrypted or not.
Specify the information and assistance you will receive
Ask what an initial notice will contain: affected services or locations, known time range, indicators of compromise, data categories, containment steps, customer actions, and the next update time. Ask whether the provider will preserve relevant logs, support forensic analysis, coordinate with your investigators, and provide a post-incident report when facts are established.
Clarify restoration and lessons learned
Ask what response and restoration work is included in the service, what is billable, and what recovery targets apply. Ask whether the provider can describe a relevant past incident without disclosing confidential customer information. Require the notification, cooperation, and escalation commitments in writing rather than relying on a verbal assurance.
Does the service include DDoS protection?
Identify the exact coverage
A “yes” answer is incomplete. Ask whether DDoS detection or mitigation is enabled by default, which destinations and locations are covered, what traffic types and protocols are included, and which service tiers or add-ons are required. Ask whether protection applies to public addresses, hosted applications, private links, voice services, or only to a specified circuit.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Understand triggers and customer actions
Ask what thresholds trigger mitigation, whether detection is automatic, and whether you must contact the provider before action begins. Ask about exclusions, rate limits, traffic that cannot be scrubbed, and customer configuration requirements. Obtain the emergency contact and escalation path to use during an attack.
Ask what happens during and after an attack
Ask what information you will receive while mitigation is active, such as attack type, affected addresses, observed volume, filtering status, and expected next update. Ask what availability, restoration, and service-credit commitments apply, and what information will be provided afterward for your incident review.
CISA recommends engaging the ISP and cloud provider to understand existing DDoS protections and reviewing the agreement for coverage limitations and gaps. Mitigation can reduce impact, but no contract wording should be read as a promise that every attack will be stopped or that downtime is impossible.
Rank #4
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
Where does the ISP’s responsibility end?
Write the control boundary
Ask the provider to list its responsibilities and yours for network equipment, firmware, credentials, firewall rules, Wi-Fi, endpoint security, identity, backups, application configuration, and incident response. Confirm who approves changes, who receives alerts, and who acts when a problem crosses the boundary between the provider network and your premises.
Cover contract terms and remedies
Ask whether the contract names security standards, notification duties, response contacts, review or audit rights, subcontractor oversight, and change-notice requirements. Ask what limits, exclusions, service credits, indemnities, or other remedies apply if the connection is disrupted or a security commitment is missed. The sources do not establish one standard ISP clause set, so have counsel map the language to your obligations.
Plan for termination and change
Ask what happens to customer data, logs, credentials, configurations, IP allocations, and provider-managed equipment when service ends, a location moves, or a product changes. Request secure return or deletion procedures, transition assistance, notice periods, and a way to obtain records needed for continuity or an investigation.
How to compare providers’ answers
Send every candidate the same written questions and score the answers against evidence rather than marketing language.
| Comparison axis | What a strong answer contains | Warning signs |
|---|---|---|
| Specificity and proof | Named controls, scope, responsible teams, documents, and a way to verify performance | “Enterprise-grade” claims with no scope or supporting material |
| Data practices | Clear collection, use, retention, access, sharing, safeguards, and customer-choice terms | Broad rights or vague references to “network data” |
| Incident readiness | Defined triggers, timing, channels, escalation, cooperation, restoration, and updates | Notice only after a confirmed breach or no emergency contact |
| DDoS scope | Covered services, activation method, exclusions, thresholds, customer actions, and reporting | A yes/no feature with no coverage map or limitations |
| Contract accountability | Responsibilities, standards, verification, change notice, and meaningful remedies | Security promises confined to nonbinding sales material |
| Business fit | Answers matched to your sites, critical services, sensitive data, and obligations | A standard package that ignores your architecture or risk profile |
Record unanswered questions and make approval conditional on resolving them. A less expensive circuit with precise, verifiable commitments may present less operational risk than a feature-rich offer whose boundaries are unclear.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common mistakes to avoid
- Accepting “secure by default” without details: Ask which defaults, for which product, and how they are maintained.
- Assuming business service means private traffic: Ask directly about collection and access to content and metadata; do not infer confidentiality from the plan name.
- Treating DDoS protection as complete availability insurance: Review exclusions, activation, dependencies, and restoration commitments.
- Leaving notification to a general support policy: Put triggers, deadlines, channels, and cooperation in the agreement.
- Ignoring your own network: Provider controls do not replace patching, identity protection, endpoint defenses, backups, segmentation, or a hardened customer firewall.
- Using a web-hosting checklist unchanged: Questions about website or email hosting apply only when the ISP actually provides those services; hosting responsibilities are not automatically internet-access responsibilities.
- Failing to revisit answers: Require notice of material changes to controls, subprocessors, data practices, or service scope during the contract term.
A practical approval checklist
- Obtain the provider’s security, privacy, acceptable-use, incident, DDoS, and service-level documents for the exact product and locations.
- Mark every statement as included, optional, customer-managed, excluded, or not answered.
- Match data handling and incident terms to your legal, regulatory, insurance, and customer-contract duties in the jurisdictions where you operate.
- Test the emergency contact and escalation route before production service begins.
- Document your side of the boundary: device ownership, firewall and router hardening, credentials, monitoring, backups, and response roles.
- Have qualified counsel approve material liability, notification, audit, data-retention, subcontractor, and termination language.
- Schedule periodic reviews so the written answers remain accurate after upgrades, relocations, or provider changes.
The result should be a documented operating relationship, not a one-time questionnaire. Use the provider’s answers alongside your internal controls and business-specific requirements, and revalidate them before renewal.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
