Key takeaway
Check the proposal and contract for who monitors what, who approves changes and how work is handed over. Request evidence of coverage and task completion.
Where the provider’s role ends
A managed security service (MSS) may include vulnerability assessment, intrusion detection, investigation, security technology operations and monitoring. A scan and report do not themselves remediate a system. Patching or configuration changes require an agreed asset list, authority, approval, change window and rollback plan. The customer retains accountability for business decisions and risk acceptance. Recovery work can also be contracted; identify its technical operator and approval owner separately.
Break the scope into service areas
Ask who monitors intrusion detection and prevention system (IDS/IPS) signals, rule changes and escalation. For investigations, confirm available digital forensics, malware analysis and threat intelligence sources. Technology operations may cover firewalls, virtual private networks (VPNs) and cloud security tools. For endpoints, verify supported operating systems and devices, update ownership and agent limitations. A category name does not establish agent support for printers or Internet of Things (IoT) devices.
Recovery, identity and continuous monitoring
A backup service should specify covered systems and data, storage location and retention, deletion protection and restoration tests. An identity service may monitor sign-in logs and account use or help apply multifactor authentication (MFA). MFA reduces risk but does not provide immunity to phishing. Agree authority for account suspension, session-token revocation and recovery-channel protection. Continuous monitoring alone does not specify response deadlines: document staffing, escalation triggers, contact channels and response expectations.
Compliance and contract questions
A provider may support records, control evidence and audit preparation for applicable obligations. Review responsibility, permitted data access, retention and subcontractor access. Use the following terms to compare proposals, and separately agree whether each activity is included.
| Term | What to agree | How to verify |
|---|---|---|
| Monitored scope | Assets, data sources and exclusions | Coverage list |
| Change authority | Approver, permitted actions and rollback | Agreed procedure |
| Escalation | Contacts, triggers and response expectations | Exercised handoff |
| Service exit | Data return, deletion and access removal | Documented exit checklist |