Cybersecurity Consulting: Specify the Work Behind the Document

Specify what the consulting purchase is meant to achieve

Policies, risk registers and awareness concepts are established consulting deliverables. Generative AI makes generic first drafts easier to produce, which changes the value of purchasing text production alone. It does not settle whether a draft reflects the organization’s processes, risks or obligations.

The useful distinction is between generating a document and making it suitable for operational use. A policy still needs decisions about scope, authority and implementation. A risk register needs a defensible assessment basis and owners able to act. An awareness concept must address the tasks and situations employees actually face.

Compare offers by the work behind the document

When consulting offers promise similar documents, procurement needs to establish which organizational work is included. A certificate or a familiar framework can indicate relevant knowledge, but neither explains the proposed assignment on its own.

I recommend asking what information the consultant will obtain, which assumptions will be examined with process owners and what the organization will be able to do when the engagement ends. A completed template and an implemented procedure are different results and should be priced and evaluated as such.

AI-supported drafting can be useful within that work. Its contribution is to accelerate preparation, not to transfer responsibility for the content to the tool. The organization and consultant still need to resolve contradictory requirements, select workable controls and establish who will maintain them.

Build internal capability deliberately

External advice has continuing value where it supplies experience, a relevant comparison or a structured approach to a difficult question. Its value is not determined by the volume of pages produced. Nor can time and price be inferred without knowing the assignment.

For recurring management tasks, I recommend making capability transfer part of the scope. Internal owners should be able to explain why a control was chosen, recognize when its assumptions change and commission specialist support where needed. This combines external expertise with responsibility that remains inside the organization.

The procurement brief should therefore specify whether it seeks a document, an expert judgment or support in establishing a capability. An offer may include all three, provided its expected results remain distinguishable.

→ Structuring security assignments: Services → Working approach: Approach