Worked costings and choosing a provider
How to choose a managed security provider: a best-fit method for Australian SMBs
A step-by-step method to scope, shortlist, question, normalise and score managed security providers so you find the best fit rather than the loudest marketing.
The best managed security provider for your business is the one whose scope, response capability, data handling and contract terms fit your risks at a price you can sustain, not the one with the most awards or the lowest headline per-user rate. The reliable way to find it is a simple, written process: define your scope before you talk to anyone, send the same requirements to three or four providers, ask the same due-diligence questions, convert every quote to a three-year cost for your own counts, and score them against weights you set before you see the prices. This guide walks through that method. It does not rank any provider.
This is the pillar guide for costings and selection. The supporting guides are the 25-person worked example, in-house versus managed costs, incident-response retainers, SLA and contract questions, renewal uplifts, USD pricing, FX and GST and the due-diligence guide.
Step 1: write down your scope and risks
Before contacting providers, prepare a one- or two-page brief:
- Counts: users, endpoints (laptops, desktops), servers, mobile devices, sites, firewalls, cloud tenants (Microsoft 365, Google Workspace, AWS, Azure), key SaaS applications.
- Data: what personal, health, financial or commercial information you hold and where. Does the Privacy Act apply?
- Obligations: customer contracts, insurer requirements, any requested Essential Eight maturity level, whether your turnover exceeds $3 million for ransomware payment reporting.
- Operating hours: when you work, when you are most exposed (overnight, weekends), who in your business can make decisions during an incident.
- What you already have: licences, tools, backups, your current IT provider and what it does.
This brief stops providers selling you their standard bundle and makes the quotes comparable.
Step 2: decide what kind of service you need
| Your situation | Likely starting point |
|---|---|
| No IT security staff, mostly cloud, under ~50 users | Managed endpoint and email security plus MDR with identity monitoring |
| Internal IT team in business hours | Co-managed MDR or SOC: provider watches 24/7, your team fixes |
| Servers, multiple sites, logging requirements | MDR plus managed SIEM for selected log sources |
| Governance gaps, customer questionnaires | vCISO program, then managed services |
| Specific assurance need (launch, tender) | Penetration test and Essential Eight assessment |
See the comparison table for what each service type does.
Step 3: shortlist three or four providers
Look for providers that work with businesses of your size and sector, can support your systems, and can explain clearly who does the work and from where. Large national providers, smaller local MSSPs, your existing managed IT provider and vendor-run MDR services are all legitimate categories. Each has trade-offs: a local provider may know you better; a larger one may have deeper overnight coverage. Your brief and questions will reveal which matters more to you.
Do not shortlist on reviews or "top 10" lists. They are rarely based on a consistent test of the service you need.
Step 4: send the same questions to everyone
Use the due-diligence checklist and the SLA and contract questions. Ask for written answers and a sample monthly report. The quality of the answers is part of the evaluation.
Step 5: normalise the quotes
Convert every proposal into the same table:
| Line | Provider A | Provider B | Provider C |
|---|---|---|---|
| Recurring monthly fee for your counts (ex GST) | |||
| Licences you must buy separately | |||
| Onboarding fee | |||
| Included response (what and how much) | |||
| Expected hourly charges for response beyond that | |||
| Pen test, vCISO, retainer if included | |||
| Renewal price rule (uplift cap) | |||
| Three-year total (ex GST) |
Add the gaps: if Provider A excludes servers and Provider B includes them, add your estimate for server cover to A. Use the cost estimator and the uplift calculator for years two and three.
Step 6: score against weights set in advance
Set weights before looking at prices, then score each provider from 1 to 5 on each criterion. An illustrative scoring, with hypothetical providers:
| Criterion | Weight | Provider A | Provider B | Provider C |
|---|---|---|---|---|
| Scope fit | 25% | 4 | 3 | 5 |
| Response capability and authority | 25% | 3 | 5 | 4 |
| Data handling and assurance | 15% | 5 | 3 | 4 |
| Contract terms and exit | 15% | 4 | 3 | 2 |
| Three-year cost (5 = lowest) | 20% | 3 | 5 | 2 |
| Weighted score | 100% | 3.70 | 3.90 | 3.55 |
For example, Provider B = 0.25 × 3 + 0.25 × 5 + 0.15 × 3 + 0.15 × 3 + 0.20 × 5 = 3.90. Scores are the reader's judgement, not facts about real providers. If two scores are close, the deciding factor should be the criterion most important to you, and you can negotiate the weak points (for example, ask Provider B to improve its scope or contract terms).
Step 7: negotiate and check before signing
- Get scope, response definitions, renewal caps and exit terms in the contract, not just the proposal.
- Check one-sided terms against the unfair contract terms rules for small business contracts.
- Tell your cyber insurer which provider you are appointing; see cyber insurance.
- Agree an onboarding plan with a date when monitoring is actually live for every device.
Frequently asked questions
Should I just use my current IT provider?
Possibly. It already knows your systems. Put it through the same process; if it subcontracts security to another firm, ask who that is and what their service includes.
How long should the selection take?
For a small business, four to eight weeks is common: a week for the brief, two or three for proposals and questions, and the rest for scoring, references and contract review.
Is the cheapest quote ever the best fit?
Yes, when its scope and response are as good as the others for your needs. Price is one weighted criterion, not the decision.
Should I hire an independent adviser?
For larger contracts, or where you have obligations to customers or regulators, an independent adviser or vCISO can write the brief and assess the answers. Make sure they do not receive commissions from providers.
Sources
- ASD's Australian Cyber Security Centre — guidance on choosing and managing IT and security service providers
- business.gov.au — cyber security checklist and free advice services
- Australian Small Business and Family Enterprise Ombudsman — help with contract disputes
- Office of the Australian Information Commissioner — privacy obligations when using service providers
