Ask for a written description of the service: what is monitored, when people review alerts and who can act on the findings.
1. Which systems are actually included?
Ask for a named list of devices, accounts, cloud services and other systems in scope. Then identify what is excluded or cannot provide usable security information. “Our whole business is covered” is difficult to assess without that detail.
The practical check is straightforward: could your IT team point to the included systems and explain how their security information reaches the provider? CIS Control 8 treats log collection, review and retention as parts of a managed process.
2. Who reviews an alert?
Find out which work is automated and which work involves a person. Ask who checks the context, what information they use and how they distinguish a finding that needs action from activity that is expected.
Use a concrete example: an employee signs in from an unfamiliar device. Ask what the provider would check before contacting your team.
3. When will someone review our alerts?
Continuous data collection and continuous human review are different commitments. Ask when people are available, how urgent issues are escalated and what happens outside the agreed hours.
If you need around-the-clock human monitoring, make it an explicit requirement in the proposal. Confirm any response-time commitments and the conditions attached to them.
5. What will we receive?
Ask for an example of a finding and a routine report. The useful output should explain the issue, the available evidence, the recommended action and who is responsible.
Agree how unresolved findings are tracked. Your team should be able to see what has been decided, what still needs to be done and who is responsible.
6. How will access and information be handled?
Clarify which permissions the provider needs, what information is collected, where it is processed and how long it is retained. Agree what happens to access and retained information when the service ends.
Include these details in the service and data-handling arrangements. The people responsible for IT and privacy should review them before access is granted.
7. What is included in the price?
Separate the service fee from software licences, onboarding, implementation work and any support charged separately. Ask which changes in your environment would change the fee.
Compare proposals using the same requirements. A lower price for fewer monitored systems or shorter support hours is a different service, so record those differences before deciding.
| Ask the provider for | What it should clarify |
|---|---|
| A coverage list | Included systems, exclusions and information sources |
| A worked example | Investigation, communication and response authority |
| A commercial breakdown | Recurring fees, software and separately charged work |