Cost Estimates, Best-Fit Selection and Checklists
Best managed cybersecurity service for an Indian MSME: a best-fit selection method
A step-by-step method to choose the managed security provider that fits your business — risk profile, scope, weighted criteria, test questions and a scored shortlist — without relying on rankings.
There is no "best" managed security provider in general; there is a best fit for your assets, your risks, your obligations and your budget over three years. The method that works for most Indian MSMEs has six steps: map what you must protect, decide what level of service you actually need (hours and response), write one scope that every provider prices, score proposals against weighted criteria, test the shortlist with practical questions, and only then compare normalised prices. This guide sets out each step with an illustrative scoring example and links to every guide in this section.
Step 1: map what you must protect
Write down, with counts:
- People and devices: users, laptops, desktops, phones used for work, servers (on-premises and cloud).
- Network: offices, plants, warehouses, firewalls, remote access.
- Cloud and SaaS: email and office suite, accounting and ERP, CRM, e-commerce platforms, cloud accounts.
- Data: customer personal data, employee data, card or payment data, designs and source code.
- Obligations: CERT-In Directions (most businesses), customer contracts asking for VAPT or a SOC, sector rules if you are regulated, and from 13 May 2027 the main DPDP obligations.
Step 2: decide the level of service
| Question | If yes | If no |
|---|---|---|
| Would one day of shutdown cost more than ₹5 lakh? (set your own number) | Price 24×7 detection and containment | Business-hours monitoring may be enough |
| Does anyone in your team answer the phone at 2 a.m.? | Co-managed may work | You need a provider who can act |
| Do customers or regulators ask for a SOC, logs or VAPT reports? | Choose a provider that produces audit evidence | Focus on protection and response |
| Do you hold sensitive personal or payment data? | Include logging, encryption and breach procedure | Still include CERT-In logging |
| Are you on Microsoft 365 or Google Workspace with security features? | Ask providers to manage what you own | Budget licences |
Service types are explained in MSSP, MDR and SOC-as-a-service.
Step 3: write one scope for every provider
Send the same scope document to each shortlisted provider: asset counts, log sources, hours, response you expect, retention (at least 180 days), reporting and contract term. Ask for prices per item, plus one-time costs. The due-diligence checklist and RFP questions guide give the wording.
Step 4: score against weighted criteria
Set the weights before you read any proposal so price does not dominate unconsciously.
| Criterion | Illustrative weight | What a high score looks like |
|---|---|---|
| Coverage of your scope | 20% | Every asset and log source named, no "out of scope" surprises |
| Detection and response | 20% | 24×7, containment allowed, clear severity definitions |
| SLA and escalation | 15% | Acknowledge, notify and contain times by severity, with service credits |
| Compliance support | 10% | 180-day logs in India, CERT-In reporting support, audit evidence |
| Reporting and governance | 10% | Monthly report you can understand, quarterly review |
| Exit and data ownership | 10% | Logs, configs and reports handed over; reasonable notice |
| Normalised 3-year cost | 15% | Lowest cost for equal scope |
Illustrative scoring
| Criterion (weight) | Provider P | Provider Q | Provider R |
|---|---|---|---|
| Coverage (20) | 4 | 5 | 3 |
| Detection and response (20) | 5 | 4 | 3 |
| SLA (15) | 4 | 4 | 2 |
| Compliance (10) | 3 | 5 | 4 |
| Reporting (10) | 4 | 3 | 4 |
| Exit (10) | 3 | 4 | 5 |
| Cost (15) | 3 | 3 | 5 |
| Weighted score (out of 5) | 3.85 | 4.05 | 3.55 |
Each score is the sum of score × weight, divided by 100. For Q: (5 × 20 + 4 × 20 + 4 × 15 + 5 × 10 + 3 × 10 + 4 × 10 + 3 × 15) ÷ 100 = (100 + 80 + 60 + 50 + 30 + 40 + 45) ÷ 100 = 4.05. For P: (80 + 100 + 60 + 30 + 40 + 30 + 45) ÷ 100 = 3.85. For R: (60 + 60 + 30 + 40 + 40 + 50 + 75) ÷ 100 = 3.55.
The cheapest provider (R) is not the best fit here because its SLA and response are weak. The providers are fictional; the method is the point.
Step 5: test the shortlist
Ask each finalist to:
- Walk through a real scenario: "A laptop in our Pune office starts encrypting files at 1 a.m. on Diwali. What happens, minute by minute, and who calls whom?"
- Show a sample monthly report with client details removed.
- Show how they would produce 180 days of logs for CERT-In.
- Name the people: where the analysts sit, shifts, escalation path.
- Explain exit: what you get and how agents are removed.
Step 6: compare normalised cost
Only now look at cost, using the same assets and three years. Worked estimates for typical businesses:
Add a response safety net with incident-response retainers and risk transfer with cyber insurance basics. Use the cost estimator and build-versus-buy calculator.
FAQ
How many providers should we shortlist?
Three is usually enough to see a spread without drowning in proposals. Five or more adds work without much new information.
Should price have a higher weight?
If budgets are tight, you can raise it, but keep coverage and response at least as heavy. A cheap service that does not act is not a saving.
Can we start small?
Yes. Many MSMEs start with MDR on endpoints plus a managed firewall, and add SIEM log sources later. Make sure the contract allows adding scope at known prices.
Sources
- CERT-In — Directions, advisories and empanelled auditor list
- MeitY — IT Act and DPDP framework
- Ministry of MSME — MSME schemes and classification
