Practice 01 / Vendor accountability
MSSP & MDR Vendor Interrogation
Make the service promise hold up at 3 a.m.
The operational risk
Make the service promise hold up at 3 a.m.
An alert reaches a dashboard, but nobody owns the decision to isolate a system. A renewal can quietly carry that gap into another year.
“We monitor everything, around the clock.”
Make the responsibility visible.
Monitoring, investigation, containment and recovery are separate responsibilities. The contract needs to name who can act, on which systems, and within what time.
The B3 deliverable
What you receive
- A coverage map of assets, tools, operating hours and exclusions.
- An escalation and containment matrix with named owners and measurable response commitments.
- A side-by-side proposal review, including duplicated tools and total contract cost.
- A negotiation brief covering evidence access, service credits, renewal notice, termination and transition support.
- An incident exercise record and a list of gaps to reconcile with your broker’s actual insurance requirements.
Who this is for
CIOs, lean IT teams and business owners selecting or renewing an MSP, MSSP or MDR provider.
Evidence needed to begin
- Current agreement and renewal quote
- Asset and service inventory
- Recent escalation examples
- Applicable insurer questionnaires
Acceptance criteria
A result you can inspect.
Every in-scope system has a documented service owner; unresolved exclusions and escalation gaps have an owner and a decision date.
Show us the last tested after-hours escalation, who had authority to contain the incident, and which systems your contract excludes.Scope this engagement →
Roles and boundaries
B3 evaluates and negotiates the service. It does not operate a 24/7 SOC or promise insurance coverage.
Read the buyer guide: Questions to Ask an MSP Before You Sign or Renew ↗
Before the next signature
Make the decision with someone on your side.
Start with the decision, the deadline and the evidence you need. We will define a practical scope from there.
Schedule a 20-minute scoping call →