Failure Patterns, Contracts and Official Sources
MSSP and MDR SLA and contract terms: what to agree before you sign
The service levels and contract clauses that matter in Indian managed security deals — acknowledge, notify and contain times, service credits, liability caps, data, term, renewal and exit.
A managed security contract should fix four things in numbers: how fast the provider acknowledges, notifies and contains incidents by severity; what it is allowed to do without asking; what you get if it misses (service credits and termination rights); and what happens to your data during the contract and at exit. Price terms (uplift caps, true-ups, currency) and legal terms (liability, confidentiality, data processing under the DPDP framework) come next. This guide lists the clauses with sample wording ideas and belongs to why managed security engagements fail. It is general information, not legal advice; have a lawyer review large contracts.
The service levels that matter
| SLA metric | What it measures | Illustrative target for critical incidents |
|---|---|---|
| Time to acknowledge | Alert seen by an analyst | 15 minutes |
| Time to notify | You told, by phone for critical | 30 minutes |
| Time to contain | Device isolated or account disabled (where allowed) | 60 minutes |
| Report time | Written incident summary | 24 hours |
| Platform availability | SIEM or EDR console uptime | 99.5% a month |
| Change requests | Firewall rule or policy change done | 1 business day (urgent: 4 hours) |
These numbers are illustrative; what is achievable depends on the service and price. The important point is that each is defined, measured and reported monthly.
Define the clock
An SLA without a start point is meaningless. Write down when each clock starts (alert generated, analyst triage, customer call) and stops (call answered, isolation confirmed). Ask how the provider measures and whether you can see the raw data.
Response authority
| Action | Default in contract | Your choice |
|---|---|---|
| Isolate an endpoint | Allowed for critical | Allow / ask first |
| Disable a user account | Ask first | Allow for confirmed compromise |
| Block IP or domain at firewall | Allowed | Allow |
| Shut down a server | Never without approval | Ask first |
Approve this table at onboarding and keep it in the contract or runbook.
Service credits and remedies
- Service credits: a percentage of the monthly fee for each missed SLA, with a cap. Illustrative: 5% per critical miss, capped at 20% a month.
- Chronic failure: a right to terminate without penalty if SLAs are missed in, say, three months out of six.
- Root-cause review: after any critical miss, a written analysis within a set time.
Illustrative example. Monthly fee ₹50,000. Two critical incidents missed the contain SLA: 2 × 5% = 10% → ₹5,000 credit. Credits rarely compensate a real loss; their value is in focusing attention.
Liability and indemnity
Providers usually cap their liability, often at the fees paid in a period such as 12 months, and exclude indirect losses. Points to negotiate:
- higher caps or uncapped liability for breach of confidentiality and data protection;
- an indemnity for losses caused by the provider's own security failure (for example a compromise of its remote access tool);
- clarity that service credits are not your only remedy.
Check what your cyber insurance requires of providers.
Data protection and confidentiality
- The provider processes data only on your instructions, as a data processor in DPDP terms. See DPDP and the IT Act.
- Breach notice to you without delay, and in any case within a stated number of hours.
- Sub-processors listed, with notice of changes.
- Location of logs and data, with a copy in India for CERT-In purposes.
- Confidentiality surviving the end of the contract. Disclosure of personal information in breach of a lawful contract is also dealt with under section 72A of the IT Act.
Term, price and renewal
| Clause | What to aim for |
|---|---|
| Initial term | 1–3 years, with an exit right for chronic SLA failure |
| Price | Unit prices for extra endpoints, users, GB and sites fixed for the term |
| Uplift | Written cap, for example the lower of a fixed percentage or an index |
| True-up | Based on average, not peak, counts |
| Auto-renewal | Notice period long enough to retender (60–90 days) |
| Currency | INR where possible; if USD, who bears FX risk |
Model the effect of uplift with the renewal uplift calculator.
Exit and transition
- Hand-over of logs for the retention period in a standard format.
- Monthly reports and incident records.
- Firewall and policy configurations, admin credentials and documentation.
- Agent removal procedure that does not leave devices unprotected; overlap with the next provider.
- Certified deletion of your data after hand-over.
- Transition assistance at agreed rates.
FAQ
Are SLAs enforceable?
They are contractual terms; their force depends on the wording and remedies. Vague SLAs are hard to enforce. Measurable ones with credits and termination rights are easier.
Should we accept a standard contract?
For small amounts, often yes, after checking the key clauses above. For larger contracts, ask for a schedule that adds your SLAs, data and exit terms.
What if the provider refuses to define containment time?
Then response is advisory. Price it accordingly, or choose a provider whose MDR includes containment.
Sources
- CERT-In — Directions on logs and incident reporting
- MeitY — IT Act section 72A and DPDP Act
- e-Gazette of India — DPDP Rules, 2025
