5CybersecurityQuestionstoAskYourITProviderBeforeYourRegulatorAsksYou

October is Cybersecurity Awareness Month, so your inbox is probably full of reminders to pick a stronger password. Fair enough. The bigger risk for most organizations sits in the gap between what their IT provider says it does and what it can prove.

That gap is getting expensive. The FBI's Internet Crime Complaint Center received more than 1 million complaints and $20.9 billion in reported losses in 2025, a 26% increase over 2024. In healthcare, hacking and IT incidents caused 81% of the large breaches reported to HHS in 2024 and accounted for 99% of the people affected.

If you run a medical practice, an advisory firm, or any business that holds patient or client data, someone with authority will eventually ask how your systems are protected. Your answer depends on the answers your IT provider gives you. We have covered the strategic questions to ask a new managed service provider before. These five are narrower, and each one asks your current provider for evidence.

1. When Did You Last Restore Our Data, and How Long Did It Take?

Every IT provider says you have backups. Fewer can name the date of the last full restore test or how many hours it took.

That matters because ransomware goes after backups. CISA's #StopRansomware Guide tells organizations to keep offline, encrypted backups and to regularly test their availability and integrity in a disaster recovery scenario, because many ransomware variants hunt for reachable backups to delete or encrypt.

Healthcare has extra reason to pay attention. The FBI listed Healthcare and Public Health among the three critical infrastructure sectors most targeted by ransomware in 2025. HHS has also proposed a HIPAA Security Rule update that would require written procedures to restore certain systems and data within 72 hours. It is still a proposal, but 72 hours makes a good yardstick today.

A good answer includes a date, a duration, and what was restored. A vague promise about nightly backups does not count. An untested backup is a hope with a monthly storage bill. Our 72-hour ransomware playbook for healthcare shows what a tested recovery plan looks like, and if your provider can't produce a restore report, our Business Continuity & DR team can help.

2. Is Multi-Factor Authentication on Every Account, and What Kind?

On February 12, 2024, attackers used stolen credentials to log into a Change Healthcare remote access portal. UnitedHealth Group CEO Andrew Witty later told the Senate Finance Committee that the portal did not have multi-factor authentication. Change Healthcare has since told HHS that approximately 192.7 million individuals were affected. That is roughly 193 million people, and the attackers walked in through a login page with no second factor.

MFA is old advice, yet HHS's 2024 breach report to Congress found that organizations often turned it on only after a breach. Financial regulators have stopped waiting. Since November 1, 2025, New York's Department of Financial Services has required covered entities to use MFA for all individuals accessing their information systems.

The type of MFA matters too. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication and says SMS and voice codes should be a last resort because they are vulnerable to phishing and SIM swap attacks.

Ask your provider for a list of accounts without MFA, including service accounts, vendor logins, and the old admin account nobody remembers creating. The right length for that list is zero. Then ask how many accounts still rely on text message codes. For more, read The Expensive Truth About Weak SMB Logins and our MFA and SSO baseline for advisor client portals.

3. How Would Your Help Desk Know It's Really Me Calling?

This question tests your provider's own process, and attackers already test it for you.

CISA's advisory on the Scattered Spider group describes attackers who pose as employees, call IT help desks, and talk staff into resetting passwords and MFA tokens. Once inside, they register their own MFA devices to keep access. The advisory also warns that the group abuses trusted relationships with contracted IT help desks.

A help desk that resets passwords for anyone who sounds stressed and claims to be the CFO delivers great customer service and a security incident in the same phone call.

A credible answer describes a verification step a caller can't talk past, such as a callback to a number already on file or approval from a second person. Ask whether executives go through the same check. They should, since the CISA advisory notes the attackers research high-value users, including answers to their security questions, before they call.

Your provider's controls are part of your security program. That is one reason Techvera became SOC 2 compliant: clients deserve to see our own controls checked by an independent auditor.

4. What Stops a Fake Wire Request From Getting Paid?

Business email compromise cost U.S. victims more than $3 billion across 24,768 complaints in 2025, according to the FBI. The scheme rarely needs malware. Someone spoofs or takes over a trusted email account, sends new payment instructions, and waits for accounts payable to be helpful.

Financial services firms carry this risk with their own funds and their clients'. The same trick works on any organization that pays vendors or runs payroll, which includes every medical practice. Our post on wire fraud in title and settlement shows how fast a closing can go wrong.

Your IT provider doesn't approve wires, but it controls much of what surrounds them: MFA on email, alerts on suspicious inbox forwarding rules, email authentication, and phishing training that includes fake payment requests. Ask which of those are in place today.

Then ask what happens in the first hour after a bad transfer. The FBI says time is of the essence when reporting a fraudulent transfer. In 2025, its Recovery Asset Team froze about $679 million of roughly $1.16 billion in attempted theft, a 58% success rate. Your provider should know where to report, who calls the bank, and how to preserve the evidence.

5. If an Auditor Called Tomorrow, What Evidence Could You Hand Me?

Regulators judge security by its records. If a control isn't documented, an investigator can't tell it apart from a control that doesn't exist.

In April 2026, HHS's Office for Civil Rights announced four ransomware settlements totaling $1.165 million and reported 13 completed investigations under its Risk Analysis Initiative. The HIPAA Security Rule requires a thorough assessment of risks to electronic protected health information, and OCR keeps finding risk analyses that fall short. Its 2024 breach report notes that many focused on business applications and skipped clinical systems, email, and backup servers. Our 2026 HIPAA audit outlook covers what OCR expects to see.

Financial firms have new clocks. The SEC's amended Regulation S-P gave smaller firms 24 months from publication to comply, which set a June 3, 2026 deadline. Covered firms need a written incident response program and must notify affected customers within 30 days. The rule also requires firms to make sure their service providers report a breach within 72 hours. Your IT provider is one of those service providers, so ask whether its contract commits to that timeline. We broke down the details in The Reg S-P Deadline: What Every RIA Must Update in Its IT Policy.

Non-bank financial businesses such as mortgage brokers, tax preparers, and investment advisors not registered with the SEC answer to the FTC. Since May 13, 2024, the FTC's Safeguards Rule has required them to report breaches involving at least 500 consumers within 30 days of discovery. In New York, DFS-regulated entities must notify the department within 72 hours of determining that a cybersecurity incident occurred. Our NY DFS Part 500 guide covers the rest.

A credible provider can produce a current risk assessment, an asset inventory, MFA coverage reports, backup test results, and an incident response plan someone has rehearsed. If assembling those takes a month, you have your answer. Techvera's free Compliance Readiness Checker is a quick way to see where you stand.

What a Good IT Provider Does With These Questions

A provider worth keeping answers these five questions with documents, dates, and names. A provider that gets defensive has answered them too.

Techvera works with healthcare and financial services organizations across Dallas-Fort Worth and New York City. Our Cybersecurity, Compliance Readiness, Business Continuity & DR, and vCIO Services teams build that evidence into the work, so the answers exist before anyone asks. See how we support healthcare and financial services organizations, or read why your vendor list may be your biggest cyber risk.

If your current provider stumbled on any of these, schedule a consultation. Bring the five questions. We will answer them about our own operations first.

Frequently Asked Questions

What Cybersecurity Questions Should I Ask My IT Provider?

Start with five: when backups were last restored and how long it took, whether every account has multi-factor authentication and what type, how the help desk verifies callers, what controls protect against fraudulent wire requests, and what compliance evidence the provider could produce for an auditor tomorrow. Ask for documentation with each answer.

Does HIPAA Require Multi-Factor Authentication?

The current HIPAA Security Rule requires covered entities to verify that a person seeking access to electronic protected health information is the one claimed, but it does not name MFA. HHS has proposed an update that would require MFA with limited exceptions, and OCR's 2024 breach report recommends MFA, especially for remote access. The current rule stays in effect while that rulemaking continues.

How Quickly Do Financial Firms Have to Report a Data Breach?

It depends on the regulator. SEC Regulation S-P requires covered firms to notify affected customers within 30 days. The FTC Safeguards Rule requires non-bank financial institutions to notify the FTC within 30 days of discovering a breach involving 500 or more consumers. NYDFS requires regulated entities to notify the department within 72 hours of determining that a cybersecurity incident occurred.