Lesson 2.46: Security operating model and managed providers
Few companies run every security function in-house. A managed security service provider (MSSP) may run the SOC, while the company keeps decisions and accountability. Outsourcing moves the work, not the responsibility: regulators and customers still hold Northwind to account. That only works with clear service levels measured from your own data, a shared RACI with no gaps, and a contract that lets you leave with what you need. In the lab you measure the MSSP's triage times against its SLA, find activities nobody owns, read the exit clauses and write the quarterly review.
19 min
You will learn to
- Explain what can and cannot be outsourced
- Measure SLA compliance from your own records
- Find gaps in a shared RACI
- Read exit and IP clauses
- Run a provider performance review
Key terms
- MSSP
- Managed security service provider: runs security operations such as monitoring for a customer.
- SLA
- Service level agreement: measurable targets in a contract, with consequences when missed.
- Service credit
- A fee reduction owed when an SLA is missed.
- Exit strategy
- How you would move a service elsewhere without losing data, knowledge or protection.
- Accountability
- Answering for the outcome; can't be outsourced.
← Vulnerability SLAs: measuring remediation · All lessons · Risk financing: retain, mitigate or insure? →