How should an MSP describe security monitoring in a contract without promising a SOC?
Describe the service in observable terms: which systems and segments are monitored, which tool is used, when alerts are reviewed, how fast you respond to each level, what you do and what the client does, and what is not covered. Separate detection, which runs automatically at all hours, from review and response, which happen when your staff work or are on call. Name the limits plainly: encrypted content, unmonitored segments, devices without traffic, endpoint activity. Agree what evidence the client receives and how long alert history is kept. Have a lawyer review the wording. Avoid words such as SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks., 24/7 or guarantee unless you deliver them. With NetSenX, the retention period follows the client's plan.
Read next
Related questions
- Who is liable if a monitored client is breached?
- What should an MSP do if a client refuses to pay for security?
- When my customer falls under NIS2, does the MSP fall under it too?
- What is in a NIS2 supplier questionnaire, and how do I answer it?
- What NIS2 evidence can an MSP give its clients every quarter?
Terms used here
- SOC (security operations centre)
- A team, often working around the clock, whose job is to watch for and respond to attacks.