Cyber Pehra

Cost Estimates, Best-Fit Selection and Checklists

Managed security RFP questions: 30 due-diligence questions for Indian MSMEs

The questions to send managed security, MDR and SOC providers before you sign — scope, analysts, response, logs and CERT-In, data protection, pricing, exit — with what a good answer looks like.

Updated · 4 min read

Managed security RFP questions: 30 due-diligence questions for Indian MSMEs

The fastest way to compare managed security providers is to send every shortlisted provider the same written questions and ask for written answers that become part of the contract. The 30 questions below cover scope, people, detection and response, logs and CERT-In support, data protection, pricing and exit, with notes on what a good answer looks like. They turn the due-diligence checklist into an RFP you can paste into an email. This guide belongs to the best-fit selection method.

Scope (questions 1–5)

  1. List every asset and log source included in your price, by type and count. Good answer: a table matching your asset list, with any exclusions named.
  2. What is the price for each additional endpoint, server, user, site and GB of logs? Good answer: unit prices fixed for the term.
  3. Which cloud and SaaS sources (office suite, cloud accounts, CRM, ERP) can you connect, and at what cost? Good answer: named connectors, included or priced.
  4. What do you need from us to onboard, and how long does onboarding take? Good answer: a plan in weeks with milestones and your responsibilities.
  5. How do you confirm that all endpoints are reporting, and how will we be told when one stops? Good answer: a weekly or monthly "silent endpoints" report.

People and operations (6–10)

  1. Where are your analysts located, and how many are on shift at night?
  2. What are the qualifications and experience of the analysts who will handle our alerts? Ask for roles and experience, not just certificates.
  3. Is the SOC staffed 24×7×365, including Sundays and national and festival holidays?
  4. Do you subcontract monitoring to another company? If yes, who, and where?
  5. Who is our named contact, and who covers when they are away?

Detection and response (11–17)

  1. Define your severity levels and give the time to acknowledge, notify and contain for each. Good answer: numbers in minutes or hours, with service credits.
  2. What can your analysts do without asking us (isolate a laptop, disable a user, block an IP)? Good answer: a written list we approve at onboarding.
  3. How do you notify us at night, and what happens if nobody answers? Good answer: a call tree and a default action.
  4. Walk us through a ransomware alert at 2 a.m. on a holiday. Good answer: minute-by-minute steps.
  5. Do you do proactive threat hunting? How often, and how is it reported?
  6. What incident-response hours are included, and what does extra work cost? See IR retainers.
  7. How do you tune false positives so we are not flooded?

Logs and CERT-In (18–22)

  1. How long are logs kept, hot and archived, and where is the copy in India? Good answer: at least 180 days, with location named. See the CERT-In Directions guide.
  2. How will you help us report a specified incident to CERT-In within six hours? Good answer: pre-filled format, a named person, and a timeline.
  3. How quickly can you produce logs if CERT-In asks for them?
  4. Are all managed devices and your platform synchronised to NTP servers of NIC or NPL, or traceable to them?
  5. Can you support us when the DPDP breach rules apply from 13 May 2027 (72-hour detailed report to the Board)?

Data protection and security of the provider (23–26)

  1. Will you sign a data processing agreement covering purpose, access, sub-processors, breach notice to us and deletion at exit? See DPDP and the IT Act.
  2. Which of your staff and sub-processors can access our data, and from where?
  3. What independent assurance do you have (for example ISO/IEC 27001 certification or audit reports)? Ask for the certificate scope.
  4. How do you protect your own access to our systems (MFA, privileged access, logging)? A provider breach can be your breach.

Pricing and contract (27–30)

  1. Give a three-year price for our exact scope, with one-time costs separate and GST shown separately.
  2. What is the renewal uplift, and will you cap it in writing? See the renewal uplift calculator.
  3. What are the notice period, auto-renewal terms and termination rights if SLAs are missed?
  4. At exit, what do we get (logs, reports, configurations), in what format, and how are agents removed? See SLA and contract questions.

How to score the answers

Answer qualityScore
Specific, measurable, offered as a contract term5
Specific but "subject to" conditions3
General marketing language1
No answer or refused0

Weight the sections as in the best-fit method. An answer you cannot get in writing is worth little.

Red flags

  • A price without an asset count.
  • "24×7" without saying how many analysts are on shift.
  • No written limits on what analysts may do.
  • Log retention under 180 days with no archive option.
  • Reluctance to sign a data processing agreement.
  • Exit terms that leave you without your own logs.

FAQ

Is it rude to ask providers so many questions?

No. Good providers expect them and often have standard answers. Long, vague answers are themselves information.

Should we ask for references?

You can ask to speak to existing clients of similar size. Treat it as one input; it is not a substitute for written answers.

How long should the process take?

For an MSME, two to six weeks from sending questions to signing is common.

Sources

Related guides