Worked costings and choosing a provider
Managed security provider due diligence: assurance, data location, staff and exit
How to check a managed security provider before you sign: reading ISO 27001, SOC 2 and IRAP claims, data location, privileged access, subcontractors, insurance, references and exit.
Due diligence on a managed security provider means checking four things before you sign: that its scope and response match what you are buying, that its own security is strong enough to hold privileged access to your systems, that you know where your data goes and who sees it, and that you can leave cleanly. A provider that manages your security has the keys to everything, so a weakness in the provider is a weakness in you. The questions below work for a 10-person firm and a 200-person firm; only the depth changes. Ask for written answers and keep them with the contract.
This guide supports the selection method and the due-diligence checklist. It describes categories of evidence, not any specific provider.
1. Reading assurance claims properly
Providers often show badges. Each means something specific, and the scope matters as much as the badge.
| Assurance | What it is | What to check |
|---|---|---|
| ISO/IEC 27001 certificate | Independent certification of an information security management system | The scope statement: does it cover the service and locations you are buying? Is the certificate current and from an accredited body? |
| SOC 2 Type II report | An auditor's report on controls over a period | Which services and period it covers; exceptions noted by the auditor; ask for the report under NDA, not a summary |
| IRAP assessment | An assessment by an ASD-endorsed IRAP assessor against the Information Security Manual, mainly for government work | Which system was assessed and when; it is not a general certification of the company |
| Essential Eight claims | The provider's own maturity, or its ability to help you | Ask what level, against which version of the maturity model, and assessed by whom |
| Staff certifications | Individual training (for example CISSP, OSCP, GIAC) | Whether the certified people will actually work on your account |
A certificate whose scope covers only the head office, not the operations centre that will watch your alerts, tells you little about the service.
2. The provider's own security
Attackers target managed service providers because one breach gives access to many clients. Ask:
- How do your staff access our systems? Named accounts, MFA, privileged access management, session logging?
- Can we see a log of your access to our environment?
- How do you separate our data and credentials from other clients'?
- How quickly will you tell us if your systems are compromised, and is that in the contract?
- Do you follow ASD's guidance for managed service providers, and how do you test your own controls?
3. Data location, access and privacy
Managed security tools collect logs, email metadata and sometimes file contents, which can include personal information. If the Privacy Act applies to you, you remain responsible for that information when a provider handles it, and disclosing it overseas brings APP 8 into play.
| Question | Why |
|---|---|
| Where are logs stored and processed? Onshore, offshore or both? | APP 8 (cross-border disclosure), customer contracts, insurer questions |
| Which staff, in which countries, can see our data? | "Follow the sun" overnight monitoring often means offshore analysts |
| Which subcontractors are involved, including the platform vendor? | Each is part of your supply chain |
| How long is data kept, and how is it deleted at the end? | APP 11.2 destruction or de-identification duty |
| Will you support a breach assessment within 30 days? | NDB scheme timing |
Offshore monitoring is not wrong, but it should be a decision you make knowingly, reflected in your privacy policy if relevant.
4. People and capacity
- How many analysts are on shift overnight, and how many clients do they cover? The answer reveals real capacity.
- Are staff background checked (for example police checks)? For government-related work, do any hold Australian Government security clearances?
- Who is our named contact, and who covers them during leave?
- What happens during a large event affecting many clients at once? How do you prioritise?
5. Business stability and insurance
- How long has the provider offered this service, and to businesses of your size?
- Does it carry professional indemnity and cyber insurance? Ask for certificates of currency and limits.
- Does it depend on a single platform vendor? What happens if that relationship ends?
Do not rely on testimonials or case studies on the provider's website. Ask for two references of similar size and sector, and call them yourself. Ask what went wrong and how the provider handled it.
6. Exit and transition
Plan the exit before you start:
- The contract states that logs, reports, configurations, documentation and admin credentials are returned in a usable format within a stated period.
- Agents and integrations are removed, and the provider's access is revoked and confirmed in writing.
- Data held by the provider is deleted, with confirmation.
- Transition assistance to a new provider is available at stated rates.
- Notice periods give you enough time to run a new selection process.
Recording the result
For each provider, list the gaps and decide for each one: close it in the contract, cover it yourself, or accept it. A provider with two accepted gaps and a strong contract may be a better fit than one with no gaps on paper and vague answers.
Frequently asked questions
Is ISO 27001 enough?
It shows a management system exists for the certified scope. It does not prove the service you buy is effective. Combine it with the operational questions above.
Do I need an onshore provider?
Not necessarily. It depends on your data, contracts and risk appetite. Some customers, particularly in government and health, require onshore handling.
How much due diligence is enough for a small business?
For a 10-person business, the written checklist plus one reference call is a sensible minimum. Larger or regulated businesses should go deeper, including reading the SOC 2 report.
Can I audit the provider?
Ask for audit or assurance rights in the contract. Most providers offer reports rather than on-site audits for small clients.
Sources
- ASD's Australian Cyber Security Centre — guidance on managed service providers, IRAP and the Information Security Manual
- Office of the Australian Information Commissioner — APP 8 cross-border disclosure and APP 11 security
- Joint Accreditation System of Australia and New Zealand — checking accredited certification bodies
- business.gov.au — choosing IT and cyber security providers
