"What kind of investment are you willing to make? Are you willing to bring in and maintain intrusion prevention systems? You have to know the answers to these questions."

3. What changes are you willing to make in your infrastructure and in your policies to make sure that the data is protected?

Trembly says clients are most concerned with and ask how they should set policies about employees and the use of personal devices for work, while still being able to ensure locked-down data protection.

"You have to ask if you are going to standardize on certain portable devices and protect them so you don't have to worry about them, or are you going to let everybody use the devices of their own choice, which is going to be a nightmare for your IT people," he says. "It's something that IT folks are really in a quandary about because the more devices you allow people to use, the more security problems you can have."

You also have to set clear policies that determine and designate which employees can access the secure data and specify if there are limits to their access, Trembly says. "That's a real important one. It's always a good idea to limit access to only those who really need it."