Nine questions before you sign a managed SOC contract

Outsourcing detection can be the right call. Outsourcing accountability can't be. The contract is where those two get confused, so these are the questions I'd want answered in writing before signing.

1. Who declares an incident, and how fast? Minutes to acknowledge an alert is a vendor metric. Minutes to tell you something is wrong is the one you care about.
2. What can they do without asking? Isolating a host at 3 a.m. is either in scope or it isn't. If it isn't, your containment time is bounded by how fast your own people answer the phone.
3. Whose detection content is it? If the rules are theirs, leaving the contract means starting from zero.
4. What telemetry do they actually ingest? "We monitor your environment" and "we receive endpoint and identity logs from these specific sources" are different sentences.
5. How do you see what they see? A monthly PDF isn't visibility. You want the console, or at least the raw alerts.
6. What happens during their incident? Providers get breached too. What's the notification clause?
7. How are analysts staffed for your account? Shared pools behave differently from named teams, and both can be fine, but you should know which one you've bought.
8. What's the escalation path to a human who can decide? Not a ticket queue. A name.
9. What does leaving look like? Data export, rule export, notice period, and what they keep.

The common thread: a managed SOC is a capability you've rented. The decisions, the evidence, and the consequences remain yours. A good contract makes that explicit. A bad one lets everyone assume someone else is holding it.

If you're evaluating providers, I can help you ask these in the room.

Explore: More on security operations · Work with me