Managed Security Provider Due-Diligence Checklist

0 / 16 completed

Scope first

• List every asset to be covered: laptops, servers, cloud tenants, Microsoft 365 or Google Workspace, firewalls, branch offices, remote staff and operational technology.
• Write down the outcome you are buying (monitoring only, monitoring plus response, full management, advisory) and the hours of coverage you need.
• Map the services against the Cyber Centre baseline controls for small and medium organizations and note which ones stay your responsibility.

Pricing

• Get the pricing basis in writing (per user, per endpoint, per device, per GB of logs, tier or retainer), the minimum commitment and what happens when counts change mid-term.
• Ask which tool licences are included and which are passed through, the onboarding fee, the billing currency and the renewal price or increase cap.
• Ask what incident response is included, how many hours, the hourly rate beyond that, and whether an incident-response retainer is required or optional.

Response and SLA

• Confirm in writing what the provider may do without calling you first (isolate a device, disable an account, block an IP) and who can authorise more.
• Get acknowledgement, triage and escalation times by severity, how they are measured, and the service credits if they are missed.

Legal and privacy

• Agree who assesses real risk of significant harm, who notifies the OPC, the CAI or Alberta's Commissioner, and how fast the provider must tell you about an incident.
• Ask where logs and incident data are stored, which countries analysts work from, which sub-processors are used, and how long logs are kept.
• For Quebec personal information communicated outside Quebec, complete a privacy impact assessment before signing.
• For any penetration test, sign written authorisation and rules of engagement that name the systems, dates, methods and contacts, and confirm you have the right to authorise testing of third-party hosted systems.

Evidence

• Ask for independent assurance reports or certifications the provider holds, the scope they cover, and their dates; check insurer questionnaire requirements such as MFA, EDR and offline backups are met.
• Ask for a sample monthly report and a sample incident report with confidential details removed.

Exit

• Confirm the term, auto-renewal and notice period, how logs and configurations are exported at exit, the format, the timing and any exit fee.
• Make sure admin credentials, firewall configurations and tool tenants are in your organisation's name or can be transferred to you.