What to look for in a security provider? Three key questions