Key takeaways
- •Ask exactly what is included and monitored.
- •Clarify service hours and response arrangements.
- •Agree escalation contacts and actions in advance.
- •Check integrations, onboarding and exit requirements.
Define the service boundary
List products, telemetry, users, devices and cloud environments included. Understand exclusions, customer dependencies and how scope changes are handled.
Understand monitoring and escalation
Ask what the stated coverage hours mean, how alerts are triaged, which events trigger contact and how contact attempts are documented. Confirm response targets in the written service terms.
Agree response permissions
Containment can affect business operations. Clarify actions that can be taken without approval, actions requiring approval, and how emergencies are handled.
Plan onboarding and reporting
Confirm prerequisites, access, integrations, expected handover, reporting format and review schedule. Check what the customer must maintain to keep coverage effective.
Compare proposals on outcomes and accountability
Compare service scope, responsibilities, evidence, costs and contractual commitments rather than relying only on labels such as MDR or 24/7.
Sources and further guidance
Official guidance may change. Check the source directly for current requirements. This article is general information, not legal advice.
Put your next step into context.
A free 30-minute cybersecurity review provides a Red, Amber or Green score and prioritised fixes.
Book a review