Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Outsourcing and Managed Security Services
Why outsource security?
Running a 24x7 security operations centre needs at least eight to ten skilled analysts, plus tools and threat intelligence. For many organisations, a managed security service provider (MSSP) or managed detection and response (MDR) service gives better coverage for less money. The question is how to outsource the work without losing control.
What’s commonly outsourced
| Service | Why |
|---|---|
| SOC monitoring / MDR | 24x7 coverage, analysts and threat intelligence |
| Vulnerability scanning | Tools and expertise as a service |
| Penetration testing | Independence and specialist skills |
| Incident response retainer | Experts on call for major incidents |
| Awareness platforms | Content and simulation tools |
Who does what
The provider does the work: monitoring, tool operation, triage, agreed initial containment and reporting. The organisation keeps the decisions: accountability, risk decisions, business context, major incident calls and oversight of the provider. Keep enough in-house expertise to manage the provider and challenge its work.
Making it work
- A RACI agreed for detection, escalation and containment.
- Measurable SLAs: time to detect, notify and contain.
- Business context shared: critical assets, owners, normal patterns.
- Regular service reviews with metrics and sample checks of the provider’s work.
- Exit terms: logs, detection rules and knowledge must be transferable, to avoid lock-in.
Example. An MSSP escalates a ransomware precursor alert at 2 a.m., but the contact list is out of date and nobody answers for three hours. Afterwards, the company adds an on-call rota, a tested escalation path, and authority for the provider to isolate endpoints immediately.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main benefit of an MSSP | 24x7 coverage and scarce skills |
| Who is accountable after outsourcing? | The organisation |
| Most important thing to keep in-house | Oversight, decisions and business context |
| How to measure the provider | SLAs and regular service reviews |
| What to plan before signing | Exit and the transferability of data and rules |
In short
- Managed security service providers (MSSPs) and MDR services offer 24x7 monitoring, scarce skills and scale that many organisations can't build.
- Commonly outsourced: SOC monitoring, managed detection and response, vulnerability scanning, penetration testing, incident response retainers.
- Accountability, risk decisions and business context stay with the organisation.
- Clear responsibilities (RACI), measurable SLAs, escalation paths and reporting are agreed in the contract.
- Keep in-house expertise to manage the provider, interpret results and make decisions.
- Plan for exit: data, logs, detection rules and knowledge must be transferable.
Exam traps
- Outsourcing a function doesn't outsource accountability for it.
- A provider without business context can't judge which alerts matter; give them it.
- Without in-house oversight, poor provider performance goes unnoticed.
- Lock-in: if detection rules and logs belong to the provider, leaving is painful.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who does what