In brief
Choose through a responsibility model, not a service acronym. Identify who monitors, investigates, approves action, executes containment and coordinates business recovery. Compare the scope and internal work under each proposal, then rehearse the handoffs. No model should be accepted because its label appears to promise a complete response.
Why are the labels an incomplete comparison
MDR and MSSP identify the service or provider named in an offer. An in-house SOC describes a capability you intend to operate. This guide does not assign universal contractual scope to either commercial label. A proposal headed MDR still needs an explicit list of systems, investigation activities and response permissions.
The UK National Cyber Security Centre (NCSC) describes SOCs as varying in scope and recommends an operating model proportionate to the organisation. That supports a better buying question: which work will this arrangement perform, and which responsibilities remain with us?
Source: UK National Cyber Security Centre. Building a Security Operations Centre
Use five verbs to define the arrangement: monitor, investigate, decide, act and improve. ‘Notify’ and ‘contain’ are different entries. Separate an analyst’s recommendation from permission to disable access or isolate an important business system.
Which work would you retain under each model
| Model being considered | Potential fit to discuss | Retained work to make explicit |
|---|---|---|
| MDR proposal | A requirement centred on detection, investigation and response support | Business context, approvals, uncovered systems and corrective changes |
| MSSP proposal | A defined collection of managed security activities | Ownership and escalation for each contracted service |
| Internal SOC | An intention to own and sustain the operating capability | Staffing, engineering, management, cover and improvement |
| Hybrid arrangement | Internal decision authority with selected external delivery | Boundaries, shared records and cross-team handoffs |
The table is our discussion framework, not a claim that all products within a label have those features. Ask each bidder to amend it to reflect its actual offer. Do not infer continuous availability, included incident support or authority to act from the proposal title.
The NCSC’s managed-provider guidance recommends explicit customer and supplier responsibilities. Use a responsibility schedule to identify the executor, approver and escalation route for each activity. Its UK small-business setting is guidance, not a rule that automatically binds other organisations.
Source: UK National Cyber Security Centre. Choosing a managed service provider
What happens in a fictional privileged-account incident
Illustrative scenario: suspicious activity concerns a privileged account linked to an important application. A provider sends an alert. The application owner is unavailable, and disabling the account could interrupt operations. This is a fictional exercise, not an account of an actual incident.
| Decision point | Evidence to request |
|---|---|
| Who investigates? | Named role, access to relevant records and investigation boundary |
| Who decides on containment? | Approval authority and an alternative when that person is unavailable |
| Who executes the action? | Agreed permissions and a record of the action taken |
| Who handles business consequences? | Application and operations owners, with a recovery decision route |
| Who closes the learning loop? | A shared incident record and owned improvement actions |
If the supplier may recommend containment but only your team can execute it, plan for someone on your side to act during the agreed coverage period. If authority is delegated, specify conditions and safeguards. The important outcome is a workable decision route, not a fictional speed target.
How should you compare cost and capacity
Compare equivalent responsibilities over an agreed planning period. Record licences, onboarding, data ingestion, integration, retention, staffing, management, training and separately charged incident support where applicable. Ask what changes when systems or volumes grow. These are proposed cost-planning categories, not market averages.
For an internal capability, identify who sustains engineering, investigation, management and absence cover. For an external arrangement, identify who maintains integrations, approves actions and fixes weaknesses. A supplier fee and a salary budget are not comparable until the scope behind each is written down.
The US National Institute of Standards and Technology’s incident-response guidance places response within wider cybersecurity risk management. Buying monitoring should therefore lead to an agreed operating discussion, not an assumption that business recovery and governance have transferred with the contract.
Source: US National Institute of Standards and Technology. Incident Response Recommendations and Considerations for Cybersecurity Risk Management
When should you resolve prerequisites first
If you cannot identify critical services, usable data sources or the person authorised to act, clarify those prerequisites before committing to a larger service. Otherwise, a detailed proposal may still leave the essential handoff unanswered. A focused scope exercise can be a useful first purchase; a full operating model is not always the immediate next step.
Agree onboarding acceptance before service starts. Ask for the nominated systems, data sources, investigation access and escalation contacts to be demonstrated against the scope. If an important source is unavailable, record the gap and who owns it; do not treat an incomplete connection as evidence that the agreed monitoring is operating.
What should you do now
- Security leader: define the five activities and the required coverage.
- IT owner: list systems, data sources and integration dependencies.
- Business owner: define authority for disruptive decisions.
- Procurement: compare retained work and exclusions, not acronyms.
- Operations lead: walk through a scenario before accepting the arrangement.
How Bravewall helps
Bravewall describes monitoring, investigation and response capabilities under an agreed delivery model. Network Security and Threat Operations
This article is general information for awareness and education. It is not legal, regulatory or professional advice and does not take into account the circumstances of your organisation. Laws, standards and threats change; check the primary sources cited and take qualified advice before acting.