Cost Estimates, Worked Examples and Best-Fit Checklists
MSSP and MDR SLA and contract questions: response times, authority, liability and service credits
SLA metrics and contract clauses to negotiate with an MSSP or MDR provider: response times, authority, breach notice, liability, credits.
A managed security contract should say, in measurable terms, how fast the provider acknowledges, investigates and escalates an alert by severity, what it may do without asking you, how quickly it tells you about an incident affecting your data, what happens when it misses a target, and how liability is shared if it fails. Many proposals promise "24/7 monitoring" and "rapid response" without numbers. Ask for definitions, measurement methods and remedies in the service level agreement (SLA) and master services agreement, and have a lawyer review the liability and privacy clauses for any significant contract.
This guide is part of how to choose a managed security provider. Example numbers are illustrative, not market standards.
The core SLA metrics
| Metric | What it measures | Questions to ask |
|---|---|---|
| Time to acknowledge | From alert generated to an analyst starting work | Is it measured per alert or as a monthly average? |
| Time to triage | From acknowledgement to a decision: false positive, benign, or incident | Who decides severity, using which definitions? |
| Time to notify | From confirmed incident to contacting your named person | By phone, or only by email or ticket? |
| Time to contain | From confirmed incident to isolation or account lock | Only for actions within the provider's authority? |
| Service availability | Uptime of the monitoring platform and portal | How is downtime that blinds monitoring handled? |
| Reporting | Monthly and quarterly reports delivered on time | Are reports readable by management? |
Illustrative severity table to negotiate from:
| Severity | Example | Acknowledge | Notify you |
|---|---|---|---|
| Critical | Ransomware behaviour on several devices | 15 minutes | 30 minutes, by phone |
| High | Confirmed compromised account | 30 minutes | 1 hour |
| Medium | Malware blocked, needs follow-up | 4 hours | Next business day |
| Low | Policy violation | 1 business day | Monthly report |
Averages can hide failures. Ask for a target such as "95% of critical alerts acknowledged within 15 minutes each month" and a monthly report that shows performance against it.
Response authority: the clause that matters most
Write down a pre-approved action list: actions the provider may take immediately, and those that need approval.
- Pre-approved: isolate a workstation, kill a process, quarantine a file, disable a user account, block an IP or domain, revoke sessions.
- Requires approval: isolate a server, shut down a production system, block a business-critical service, contact third parties.
- Escalation path: named people with phone numbers, in order, with a fallback if nobody answers within a set time.
Without this, a provider that detects ransomware at 2 a.m. may only be able to send an email.
Breach and privacy clauses
Because your business stays responsible under PIPEDA, Quebec's Law 25 and Alberta's PIPA, the contract should include:
- Notice of incidents affecting your data within a set number of hours of the provider becoming aware.
- Cooperation: the facts you need for the OPC report or the CAI notice, and for breach records you keep for 24 months under PIPEDA or in the Quebec incident register.
- No direct notification to regulators or individuals without your instruction, unless the provider is legally required to.
- Data location and sub-processors, with notice of changes; see SOC data residency.
- Return and destruction of data at the end of the contract.
Details are in breach reporting under PIPEDA, Law 25 and Alberta PIPA.
Service credits and liability
Service credits are a percentage of the monthly fee returned when targets are missed. They are rarely large. Illustrative example: a $4,000 monthly fee with a 5% credit per missed critical target, capped at 25% a month, returns at most $1,000 in a month. That is a signal, not compensation for an incident.
Liability caps are often limited to fees paid in the previous 12 months, and may exclude indirect losses such as lost profits. Points to discuss with your lawyer:
- A higher cap, or a separate cap, for data breaches caused by the provider's negligence.
- The provider's own insurance: professional liability (errors and omissions) and cyber liability, with certificates.
- Indemnity for third-party claims caused by the provider's breach of contract or law.
- What counts as gross negligence or wilful misconduct, often carved out of the cap.
Commercial terms
| Term | What to aim for |
|---|---|
| Initial term | 12–36 months, with a price that reflects the commitment |
| Renewal | No automatic renewal without notice; increase cap in writing; see renewal uplifts |
| Termination for cause | Right to exit if SLAs are missed repeatedly |
| Termination for convenience | Possible with notice and a defined fee |
| Exit assistance | Export of logs, configurations and reports in usable formats; see exit and offboarding |
| Price changes | Same unit price for added users or endpoints during the term |
| Testing | Notice process for your own penetration tests |
Questions for the sales meeting
- Show me last quarter's SLA report for a client of similar size, with names removed.
- Who is on shift at 3 a.m. on a holiday, and where are they located?
- What exactly happens in the first hour after you detect ransomware in my environment?
- Which of my systems will you not see?
- What do you need from my staff each month?
- What is your process when you suspect an incident affecting my customers' personal information?
- What happens to my data and agents when the contract ends?
Record answers against the due-diligence checklist, and price in firewall and endpoint commitments if the provider manages devices.
Frequently asked questions
Are service credits worth negotiating?
They matter mostly as a reporting discipline. Focus on response authority, notice times and termination rights.
Can I ask for a higher liability cap?
You can. Providers may agree to a higher cap for data breaches or price it in. Get legal advice.
What is a reasonable notice time for incidents?
There is no legal standard for SMEs. Choose one that lets you meet client contracts, insurer conditions and "as soon as feasible" reporting.
Should SLAs apply to the provider's partners?
Yes. If the provider subcontracts monitoring, the same targets should flow down.
Sources
- Office of the Privacy Commissioner of Canada — accountability and contracts with service providers
- Commission d'accès à l'information du Québec — confidentiality incidents
- Canadian Centre for Cyber Security — guidance on outsourced IT and cloud security
- Competition Bureau Canada — misleading business representations
