Question

An organization has outsourced its 24/7 security monitoring to a managed security service provider (MSSP). Six months into the engagement, the information security manager notices that although the MSSP delivers monthly reports, several confirmed incidents were escalated hours later than the contract's stated response times, and internal teams were unsure who owned remediation. Which action should the information security manager take FIRST to strengthen oversight of this external service?

Accepted Answer

Establish and monitor service level agreements with defined response metrics and clear escalation and responsibility handoffs

Answer

Terminate the MSSP contract and rebuild the monitoring capability internally

Answer

Increase the frequency of MSSP reporting from monthly to weekly

Answer

Require the MSSP to provide additional security certifications for its analysts