Questions to ask before commissioning a mitigation plan

A mitigation plan sits between diagnosis and action. Someone has assessed your security weaknesses; now you need a roadmap to fix them within your constraints. But a plan is only useful if it's tailored to your reality, not a generic template, and if the person writing it has tested their recommendations against your actual environment. Before you commission one, you need to know whether the consultant understands your business and your limits.

"How will you involve my team in developing this?"

A mitigation plan that ignores how your business actually works will sit on a shelf. A good answer here includes site visits, interviews with staff who manage security day-to-day, and walkthroughs of your systems. The consultant should ask *you* questions about workflow, budget cycles, staffing constraints and what you've already tried. Watch for vague promises—"we'll assess your environment"—versus specific commitments. They should explain how they'll translate technical findings into steps your team can execute. If they suggest outsourcing everything rather than building capability in-house, ask whether that's because you genuinely can't do it, or because it's easier for them to sell.

"What's your process for prioritising recommendations?"

An unranked list of 50 fixes is useless. Ask how they decide what comes first. A solid answer ties priority to *your* risk tolerance and budget: which vulnerabilities pose the greatest threat, which are cheapest to fix, which will unlock other improvements. They should explain their logic—not just hand you a spreadsheet. If they say "we'll prioritise based on industry best practice," push back. Best practice for a bank differs wildly from best practice for a small retail business. They should ask you directly: if you can only act on three things this year, what matters most to your operations? Their answer should reflect that conversation, not a formula.

"Will you spell out what 'done' looks like for each step?"

Vague language kills plans. Instead of "improve access control," a good mitigation plan says "install biometric readers on the warehouse door, log all entries, audit logs monthly, and retrain staff on badge protocol by March." Before you commission the plan, ask the consultant how detailed they'll get. A strong answer includes measurable outcomes, timelines, who's responsible, and how you'll know it's working. They should also explain which recommendations have dependencies—step two can't happen until step one is complete. If they're comfortable with loose language now, their plan will be too.

"How will you account for what we're already doing?"

Mitigation plans are often written without seeing what's already in place. Ask whether the consultant will audit your current measures before drafting the plan. A good answer is yes—they'll document locks, cameras, software, staff training, visitor protocols, everything—then build on that foundation rather than proposing redundant layers. They should also ask what you've *tried and abandoned* and why, so they don't repeat dead ends. An evasive answer—"we'll work from your risk assessment"—suggests they plan to write the plan without properly knowing your baseline. That's a red flag. They're less likely to deliver something realistic, and you'll waste time explaining why their recommendations won't work for you.

The consultant should be comfortable with tough questions now because implementing the plan will involve even harder conversations later. If they deflect when you're vetting the approach, imagine how they'll handle pushback when your finance team balks at a five-figure bill or your operations manager says a recommendation breaks the workflow.

When you're ready to find someone to develop a plan, Strove lets you compare consultants' experience, qualifications and client feedback, then request quotes from several to see how each one approaches the problem.