Buy a managed security service by defining the work you need performed and the response you expect. The contract should identify the covered systems, the evidence the provider receives, the actions it may take and the responsibilities that remain with your team.
This guide is for smaller organizations comparing proposals or reviewing an existing provider. Bring an asset list, your important business services, current IT contracts and the person who can authorize incident response. The worksheet helps structure discussion; legal and procurement review belong with your qualified advisers.
Translate service labels into actions
An MSP commonly manages IT operations. An MSSP provides managed security functions, which may include device security, log monitoring or firewall administration. MDR generally emphasizes managed detection and response. These labels are used differently by vendors, so compare the written scope and delivery model.
List endpoints, servers, identity accounts, email, cloud services and networks. For each, record what is monitored, what is administered and what is excluded. Ask how a new device becomes covered and how the provider detects a stopped agent or missing log feed.
The UK's NCSC provider-selection guidance emphasizes clear contracts, responsibilities and incident communication. Those are useful procurement questions beyond the UK; local contractual and regulatory requirements still need separate review.
Assign responsibility before an incident
| Activity | Decision to record | Evidence to request |
|---|---|---|
| Inventory and onboarding | Who finds new or unmanaged assets? | Reconciled asset list and exceptions. |
| Monitoring and triage | Who reviews alerts, on what schedule, from which data? | Coverage report and a sample investigation. |
| Containment | Who can isolate a device or disable an account, and under what authority? | Approved action rules and audit trail. |
| Recovery | Who rebuilds systems, restores data and approves return to service? | A rehearsed recovery procedure and test result. |
| Communication | Who contacts management, affected parties and outside advisers? | Named contacts, backup contacts and notification process. |
| Exit or provider incident | Who retains logs, revokes access and transfers service? | Export process, retention terms and transition plan. |
Put one accountable owner next to each activity, then name contributors. “Shared” needs an explicit handoff. Identify subcontractors and the access they receive, and include those dependencies in the agreement.
Read response-time promises carefully
A ticket acknowledgment, a human investigation, a containment action and recovery are different milestones. Ask when each clock starts, which severity level applies, what pauses the clock and whether the commitment operates outside business hours.
For example, “respond within 15 minutes” could mean an automated receipt. Ask the provider to show the actual commitment and an anonymized incident timeline. Define how your team escalates if the primary contact is unavailable.
Discuss the provider's own compromise. The joint advisory on MSP and customer security highlights the importance of access control and explicit responsibility across the boundary. Ask about individual administrative accounts, MFA, access logging, least privilege and separation between customers.
Compare proposals with the same scenario
Add a failed-backup scenario and an unavailable-provider scenario. Record unresolved questions as gaps in the proposal, then seek written answers. Avoid choosing a provider solely from a demonstration dashboard or an alert count.
Compare the total operating arrangement
Price the same population and scope: users, devices, servers, log volume, storage retention, onboarding and incident work. Determine which investigation, restoration, after-hours support and specialist services cost extra. Record data-export charges and transition support.
Agree on access to your own logs, configuration and account ownership. A provider should have only the access needed for its assigned work. Keep a tested way for an authorized internal owner to regain control and revoke provider access at the end of the relationship.
Request evidence for service claims: sample reports, escalation tests, relevant assessments and references for comparable environments. A certificate's scope and date matter; it does not automatically cover every service in your proposal.
Verify the service after signing
- Reconcile the first coverage report against your inventory.
- Run an agreed harmless test event and check the alert, human handoff and recorded result.
- Review missed data feeds, unresolved incidents and exceptions at the agreed cadence.
- Rehearse an account incident and a restore without disrupting production.
- Update the agreement when systems, staffing or business requirements change.
The comparison worksheet includes the incident scenario, responsibility fields and a decision log. Use the policy guide to define internal obligations and the identity guide for provider and employee access.