Why managed security engagements disappoint, the SLA and contract terms that matter, hidden costs, legal authorisation for pen tests, sector rules and official sources.
Most disappointments with managed security follow a few patterns: half the devices were never onboarded, alerts went to an inbox nobody read, the SLA promised a response but not containment, logs were kept for 30 days when CERT-In expects 180, and the contract made leaving slow. These guides describe those patterns generically, without naming companies.
Start with why managed security engagements fail, which links to every guide in this section. The others cover SLA and contract questions, hidden costs, legal authorisation and scope letters for penetration tests, sector rules from RBI and SEBI, and a list of official sources.
This is general information, not legal advice. For regulated entities, large contracts or an incident in progress, consult a lawyer or a qualified security professional, and report incidents to CERT-In as the Directions require.
Failure Patterns, Contracts and Official Sources
The charges that make managed security cost more than the quote — log overages, server multipliers, minimums, true-ups, onboarding, retests, travel, FX and renewal uplift — with illustrative sums.
Failure Patterns, Contracts and Official Sources
The common patterns behind disappointing MSSP, MDR and SOC contracts — partial onboarding, alerts nobody reads, short log retention, weak SLAs, lock-in — and the fixes for each.
Failure Patterns, Contracts and Official Sources
The service levels and contract clauses that matter in Indian managed security deals — acknowledge, notify and contain times, service credits, liability caps, data, term, renewal and exit.
Failure Patterns, Contracts and Official Sources
Where to check the CERT-In Directions, empanelled auditors, IT Act and DPDP texts, sector rules, GST and TDS, and where to report incidents and cyber crime in India, with what to look for on each.
Failure Patterns, Contracts and Official Sources
Why pen tests in India need written authorisation under IT Act sections 43 and 66, what a scope letter and rules of engagement should contain, and how to handle cloud, SaaS and hosting providers.
Failure Patterns, Contracts and Official Sources
A short, hedged overview of RBI cyber, IT and outsourcing directions, SEBI's 2024 CSCRF and IRDAI guidelines, and what they mean for regulated entities and suppliers buying managed security.
