How can an MSP give clients incident evidence quickly?
Keep the evidence as you go rather than reconstructing it afterwards: alerts with their timestamps and explanations, what was done and by whom, and the hosts involved. Agree with each client in advance what you will deliver after an incident and how fast, and who their contact for the authority is. In NetSenX each client's alerts and audit log stay in that client's tenant, the NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. Article 23 deadlines are tracked per incident, and PDF reports are available from the Starter plan. Make sure the plan's alert history covers the period an investigation is likely to need. Submitting the report to the authority stays with the client.
Read next
Related questions
- Does an EU MSP need an EU-hosted security vendor for its clients?
- How can an MSP show clients which AI tools their staff use?
- Can an MSP offer OT monitoring to small manufacturers?
- What does an MSP need to monitor a client's PLCs passively?
- What happens to a client's security data when they change MSP, and can they export or delete it?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.