Chapter 6 — Working with a managed security provider
Lesson map
Lesson 06 published. Map, example, EX026.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Agreement"]
N2["6.2 Context"]
N3["6.3 Daily handover"]
N4["6.4 Monthly review"]
N5["6.5 Testing the provider"]
N6["6.6 Exit plan"]
N7["Communication channels"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX026"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Agreement"]
N2["6.2 Context"]
N3["6.3 Daily handover"]
N4["6.4 Monthly review"]
N5["6.5 Testing the provider"]
N6["6.6 Exit plan"]
N7["Communication channels"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX026"]
[Learning outcomes]
|
v
[6.1 Agreement]
|
v
[6.2 Context]
|
v
[6.3 Daily handover]
|
v
[6.4 Monthly review]
|
v
[6.5 Testing the provider]
|
v
[6.6 Exit plan]
|
v
[Communication channels]
|
v
[Worked example] --> [Exercise EX026]
Learning outcomes
You will (1) write a clear service agreement with a provider; (2) share business context; (3) review provider performance; (4) manage the hybrid handover.
6.1 Agreement
The service agreement lists monitored sources, service levels, pre-approved actions, contacts, reporting and exit terms. It refers to Fenwick's charter for authority. The agreement turns the charter into service terms the provider must meet. Listing monitored sources makes it clear which logs the provider watches, so a missing source is noticed. Exit terms protect Fenwick if the provider fails. Referring to the charter means authority is defined in one place, so the two documents cannot disagree. Priya reviews the agreement with the provider each year, and changes are signed by both parties and the managing director.
6.2 Context
Providers lack local knowledge. Fenwick shares the asset list, travel calendar, change windows, VIP list and normal factory shift patterns. Each item answers a question the provider cannot answer alone. The travel calendar explains a new-country login, as with the sales manager at a trade fair; change windows explain admin changes; shift patterns explain factory logins at unusual hours. Priya updates the information monthly and asks the provider to confirm it has the current version. Without context, the provider would escalate many benign alerts and miss the signs of real ones.
6.3 Daily handover
At 08:00 the provider sends a summary of overnight alerts and open cases; Tom reviews it and replies with questions. The handover means nothing from the night is forgotten. Tom checks that every alert has a note and an outcome, and that open cases have a next step and an owner. His questions often lead to context updates, such as a missing change window. The handover also gives Priya a daily record of how the provider handled Fenwick's alerts, which she uses at the monthly review to discuss response times and missed alerts.
6.4 Monthly review
Priya and the provider review response times, false positives, missed alerts and context updates. The review uses figures from both sides: the provider's response times and Tom's records of false positives and missed alerts. Each problem is traced to a cause, such as missing context or a rule that fires too often, and given an action with an owner. Priya records the actions and checks them at the next review. Context updates are confirmed so the provider has the current travel calendar, change windows and VIP list.
6.5 Testing the provider
Twice a year, with agreement, Fenwick runs an announced test: a test account is added to an admin group at night to see how quickly the provider responds. An announced test checks the whole path from detection to call, using a harmless action that matches the March behaviour. The provider knows a test will happen but not exactly when, so it measures normal performance. The first test met the fifteen-minute target, while the second took 26 minutes because the on-call analyst was busy with another client. Priya reports both results to the board, and the provider added a backup analyst.
6.6 Exit plan
If the provider fails, logs and rules must transfer to a new one; the agreement makes Fenwick the owner of both. Owning logs and rules means Fenwick can move to another provider without starting again. The agreement says how logs and rule definitions are exported, in what format and within what time. Priya checks once a year that the export works by asking for a sample. When the managing director asked what would happen if the provider failed, Priya pointed to these terms and the data ownership clause.
Communication channels
The agreement lists how each kind of message travels: critical alerts by phone, high by phone or chat, medium and low through the ticket system. Phone numbers are checked monthly by a short test call, because an outdated number at 02:00 defeats every other part of the arrangement. Priya also keeps a printed contact sheet in case email and chat are down during an incident. These details seem small, but they decide whether the provider can actually reach someone when it matters.
Worked example
The first night test: admin change at 01:00, provider alert at 01:03, call to Priya at 01:12, within the 15-minute target. The second test, three months later, took 26 minutes because the provider's on-call analyst was handling another client. The provider adds a backup analyst.
Synthetic case. Tests and results are invented.
Errors and limits
A provider shared across many clients may be stretched during wide attacks.
Exercises
- EX026 — Context shared. List four items of context shared. Rubric: 3 = assets, travel, change windows, VIPs, shifts (four); 2 = two; 1 = one; 0 = none.
- EX027 — Morning handover. What happens at 08:00? Rubric: 3 = provider summary; Tom reviews and asks questions; 2 = partial; 1 = vague; 0 = none.
- EX028 — Test results. Compare the two night tests. Rubric: 3 = 12 min within target; 26 min missed; backup analyst added; 2 = partial; 1 = one; 0 = none.
- EX029 — Data ownership. Why must Fenwick own logs and rules? Rubric: 3 = to move to new provider if needed; 2 = partial; 1 = vague; 0 = none.
- EX030 — Monthly review. What is checked monthly? Rubric: 3 = response times, false positives, missed alerts, context; 2 = two; 1 = one; 0 = none.
Synthesis
A provider works well only with a clear agreement, shared context and regular tests.
Continue studying — chapter 06 of 12
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →