Questions to put to every shortlisted MSSP, MDR or SOC provider before you sign, grouped by scope, people, data, response, contract and exit.
0 / 14 completed
Use this checklist on every shortlisted provider so that the answers are comparable. Ask for written answers, not a sales call, and keep them with the contract. A provider that cannot answer a scope or response question clearly before you sign is unlikely to answer it clearly during an incident.
The items follow the same order as the due-diligence guide: scope first (what is covered), then response (what the provider will actually do), people and data (who touches your information and where it goes), contract (price, renewal and remedies) and exit (how you leave). Tick an item only when you have the answer in writing.
How to use the results: a missing tick is not automatically a reason to reject a provider, but it is a gap you must either close in the contract, cover yourself or accept knowingly. Record which you chose. Weight the items that matter most for your business, for example data location if you hold health information, or overnight response if you run a 24-hour operation, and score providers against those weights in the selection method.
This checklist is general information, not legal or technical advice. For a large contract, an incident-response plan or a regulated business, get advice from a lawyer and an independent security adviser.
Failures, incidents and official sources
How to test whether a managed security service really watches and acts around the clock, why alert fatigue causes missed attacks, and the questions and drills that expose gaps.
Failures, incidents and official sources
A plain guide to cyber insurance for Australian SMBs: typical covers and exclusions, how managed security answers proposal-form questions, panel firms, excesses and disputes.
Prices, cost drivers and 2026 rules
Who must report a ransomware or cyber extortion payment within 72 hours, how the $3m turnover test works, what the report contains, enforcement in 2026 and SOCI Act incident reporting.
Worked costings and choosing a provider
A step-by-step method to scope, shortlist, question, normalise and score managed security providers so you find the best fit rather than the loudest marketing.
Worked costings and choosing a provider
How to check a managed security provider before you sign: reading ISO 27001, SOC 2 and IRAP claims, data location, privileged access, subcontractors, insurance, references and exit.
Worked costings and choosing a provider
The SLA definitions, contract clauses and questions that decide what a managed security provider must actually do, plus service credits and Australian unfair contract terms rules.
