A step-by-step checklist for Indian MSMEs choosing an MSSP, MDR or SOC provider: scope, response, logs, CERT-In, data protection, pricing and exit.
0 / 13 completed
Work through the list in order: scope first, response second, price and contract last. Many MSMEs compare per-endpoint prices of services that do completely different things: one only forwards alerts by email, another isolates an infected laptop at 3 a.m.
How to use it. Send the scope items to every shortlisted provider as part of your request for proposal and ask them to answer in writing. Tick an item only when you have the answer in the proposal or contract, not when a salesperson said it on a call. Items you cannot tick become negotiation points or reasons to drop a provider.
Worked example. A 60-person firm sends the checklist to three providers. One cannot confirm 180-day log retention without a higher tier; another excludes Microsoft 365 logs. Normalising scope changes which quote is cheapest.
Limits. The checklist is general. Regulated entities (banks, NBFCs, market intermediaries, insurers) have their own requirements from RBI, SEBI or IRDAI. See the best-fit method and SLA and contract questions.
Managed Security Costs, Price Drivers and 2026 Rules
What the CERT-In Directions of 28 April 2022 under IT Act section 70B(6) require from Indian businesses, what they cost to meet, and what to demand from a managed security provider.
Cost Estimates, Best-Fit Selection and Checklists
A step-by-step method to choose the managed security provider that fits your business — risk profile, scope, weighted criteria, test questions and a scored shortlist — without relying on rankings.
Cost Estimates, Best-Fit Selection and Checklists
Basics of business cyber insurance in India — first-party and third-party cover, exclusions, proposal-form security questions, panels, and how MDR, MFA and backups affect cover and premium.
Managed Security Costs, Price Drivers and 2026 Rules
What DPDP Act sections 8(5)–(6), the phased DPDP Rules 2025 and IT Act sections 43, 43A, 66 and 72A mean for buying managed security in India, as of October 2026.
Failure Patterns, Contracts and Official Sources
The common patterns behind disappointing MSSP, MDR and SOC contracts — partial onboarding, alerts nobody reads, short log retention, weak SLAs, lock-in — and the fixes for each.
Cost Estimates, Best-Fit Selection and Checklists
The questions to send managed security, MDR and SOC providers before you sign — scope, analysts, response, logs and CERT-In, data protection, pricing, exit — with what a good answer looks like.
