Most small businesses hire a cybersecurity advisor after something goes wrong. Here is what a good engagement actually looks like — before the pressure hits.