How to choose an MSSP: questions to ask

Why lists and rankings only get you so far

Searching for a managed security service provider list or the best MSSP in the UK will give you plenty of names. What it will not tell you is whether a provider's service fits your tools, your appetite for automated response, your regulators or your budget. Two services with the same headline can differ enormously in what they actually do at three in the morning.

We do not publish a list or ranking, and we would treat any league table with caution. The better approach is to ask every shortlisted provider the same questions and compare the answers in writing. The checklist below is the one we would want answered if we were buying.

Before you compare providers

You will get better answers if you know your own requirements first. Spend an hour writing down:

• What you have: number of users, laptops, servers and sites; your Microsoft 365 licences; the endpoint, email, identity and firewall products you run
• Who is available: who in your organisation could respond to an alert at night or at weekends, and who can make decisions during an incident
• What you are comfortable with: whether a provider may isolate a laptop or disable an account without asking first
• Who is asking: insurers, customers, auditors or regulators that expect monitoring, logging or incident response, and what they need to see
• What you must keep: how long logs need to be retained, and any rules on where data is held

With that on one page, you can send the same brief to each provider and compare like with like. If you are not sure where to start, what is an MSSP? and MSSP vs MDR explain the options.

The MSSP checklist

1. Who runs the SOC? Is it the provider's own team, a security vendor's SOC that the provider manages, or a mix? Where are the analysts, and how are nights, weekends and bank holidays covered?
2. What response modes are available? Good services let you choose how much the analysts can do without asking. Sophos MDR, for example, offers Authorize, Collaborate and Notify Only modes. Find out which modes exist and what each one means in practice.
3. What is contained, and what is only alerted? Ask for a list of response actions: isolating a device, killing a process, disabling an account, revoking sessions, blocking an address on the firewall. Anything not on the list will wait for a human on your side.
4. What can the service see? Endpoints only, or identities, Microsoft 365, email, cloud workloads, firewalls and network traffic too? Many attacks start with a stolen login rather than malware.
5. Does it work with your tools? If you already own Microsoft Defender or another EDR, ask whether the service can use it rather than replacing it, and whether it can act inside those tools or only read alerts.
6. Where is your data held and processed? Ask about data residency and the data processing terms under UK GDPR. Check Point, for example, lists the UK among its MDR data residency options.
7. How long are logs and telemetry kept? Retention varies widely, from weeks to a year or more, and longer retention often costs more. Make sure it meets your regulatory, insurance and investigation needs.
8. Is incident response included? Some tiers include full incident response (Sophos MDR Plus and Check Point MDR, for example); others contain the threat and hand over. Find out where the line is and what a separate retainer would cost.
9. What does onboarding involve? Ask what happens in the first weeks: deployment, integrations, tuning, exclusions, an agreed runbook and a go-live review.
10. What reporting and regulatory support do you get? Ask for sample incident reports and service reviews, and how the provider would help you meet reporting duties such as UK GDPR breach notification or the NIS Regulations.
11. What is written into the contract? Ask for the service description, the responsibilities matrix and any service levels in writing. Verbal assurances do not help during an incident.
12. How do you leave? Ask how you get your logs, configurations and reports back, how agents are removed and what notice is needed.
13. What assurances can the provider show? Certifications such as ISO/IEC 27001 and Cyber Essentials Plus are worth asking about. For incident response, the NCSC assures Cyber Incident Response (CIR) providers at Enhanced and Standard levels; ask whether any incident response element comes from an assured provider.

MSSP contract terms and SLAs

Contract terms are where many MSSP relationships go wrong. When you review a proposal, look for:

• Scope: which users, devices, sites, cloud tenants and log sources are covered, and what happens when you add more
• Responsibilities matrix: who does what for monitoring, response, tool changes, patching, reporting and incident coordination
• Service levels: what is committed in writing, how it is measured and what happens if it is missed; do not rely on marketing figures
• Response authority: the agreed actions the SOC may take without asking, recorded in the contract or runbook
• Term, renewal and changes: the minimum term, how renewals work and how price changes are handled
• Data: retention, location, return on exit and deletion

If you use several providers, for example an IT provider and an MSSP, make sure their responsibilities meet in the middle with no gaps. The page MSSP vs MSP explains where the two usually overlap.

MSSP onboarding: what good looks like

Onboarding determines how well the service works for the next few years. A sound process usually includes:

1. Discovery: an inventory of users, devices, identities, cloud tenants and existing security tools.
2. Deployment: agents rolled out and checked, so that coverage is measured rather than assumed.
3. Integrations: Microsoft 365, identity, firewall, email and other sources connected and tested.
4. Tuning: a period in which the SOC learns what normal looks like and exclusions are agreed, so false alarms fall.
5. Runbook: escalation contacts, response permissions and out-of-hours arrangements signed off.
6. Go-live review: what is covered, what is not, and what to fix next.

How long this takes depends on the size of your estate and the number of integrations, so ask for a plan rather than a promise.

Warning signs

Be cautious if a provider:

• Cannot say clearly who runs the SOC or where the analysts are
• Describes its service as monitoring but only forwards alerts by email
• Has no written response authority or escalation process
• Is vague about where your data is stored or how long it is kept
• Has no answer to how you would leave
• Promises that nothing will get through; no honest provider can make that promise

How Forever Systems answers these questions

We would rather you compared us properly. Here is how our model answers the first questions on the list:

• Who runs the SOC: the vendor whose service you choose, for example Sophos, Check Point, Cisco, WatchGuard, Blackpoint, CrowdStrike, SentinelOne or Todyl. Forever Systems does not run its own SOC.
• What we do: recommend the service, deploy and connect it, set up response authority and escalation with you, manage the tools and changes, and act as your escalation point
• Response, retention, data location and incident response: these depend on the vendor service and tier, and we set them out for each option in writing, confirmed at quote
• Assurances: we will tell you which certifications apply to us and to the vendor service; Forever Systems is not an NCSC-assured CIR provider, and where you need assured incident response we will say so

The vendors page compares the services we supply, and MSSP pricing explains how costs are built. To put us through the checklist, contact us.