A Letter to Your IT Provider
For businesses starting Baseline with Total 360 Security. Forward this to your IT provider before our first call.
To the IT provider for our new client,
Your client has engaged Total 360 Security for Baseline, a 45-day program that builds and documents their security program against CIS Controls v8.1 IG1, the standard Texas SB 2610 names for businesses their size. They're forwarding this letter so you hear what that means for you before our first call.
What we do
We own governance: the risk assessment, the risk register, the policy set, the incident response plan and tabletop, the awareness training rollout, and the attestation pack your client needs for their cyber insurer and customer questionnaires.
What we don't do
We don't implement, configure, monitor, patch, or administer anything. That's your contract, and we're not trying to take it. We never hold administrative credentials to any of your client's systems. That commitment is written into our agreement with them, not just promised in a meeting. Our assessment runs on interviews, document review, and evidence you supply.
What you get out of it
- Your coverage, written down. We'll build a Shared Responsibility Matrix with you that maps all 56 safeguards to you, the client, or us. For a competent provider, that documents how much you already cover.
- Gaps become your scope of work. Anything that needs implementation is written as work you can quote, never as a report card. In practice, we often end up making the case for security spend you've been recommending for a while.
- No surprises. You hear about findings in working sessions, not for the first time at the owner readout.
What we'll ask of you
- A 90-minute technical interview in the first week
- Responses to a short document and evidence request
- A working session to build the responsibility matrix together
- Input on costing the remediation roadmap
- An hour for the incident response tabletop near the end
The short version is what we tell every provider in our first conversation:
You run the controls. We own the paperwork, the risk decisions, and the questions the owner can't answer at renewal. If we find a gap, it becomes your scope of work — not our project.
If you have questions before we start, call me directly at 817-677-0515 or email don@total360security.com.
Don Oxman
Founder & Principal Consultant, Total 360 Security