Buy a response capability.
Not an alert queue.

People, process and technology each support the handoffs. Sensors need coverage and maintenance. Analysts need access to relevant evidence and a route to business context. Response procedures need authority and people who can act out of hours.

A provider that can notify but cannot contain may still be useful—if the retained team can respond when the notification arrives. Calling both services “24/7 response” conceals an important difference. Put the boundary in the contract and test the handoff.

NIST SP 800-61 Revision 3 places incident response within wider cybersecurity risk management. The practical implication is that the SOC should connect to preparation, recovery and improvement across the business, rather than end at a closed ticket.

A real operating model also needs supervision, specialist investigation, detection engineering, platform administration and resilience when people are unavailable. Workload peaks and concurrent incidents can require more capacity than simple coverage arithmetic suggests.

This is why a small internal team may struggle to provide sustainable round-the-clock coverage on its own. It does not establish that outsourcing is always cheaper or better. A managed service still needs enough customer knowledge, access and cooperation to turn a finding into a useful response.

Unscoped cost estimates make poor market benchmarks. Price the same outcome and responsibilities in each option, making assumptions visible rather than assuming a universal saving.

A low headline price can move cost into ingestion charges, excluded incident hours or work left to your existing team. An internal salary budget can omit platform engineering, absence cover and specialist support. Compare total cost alongside the capability and control you obtain.

Ask how the service handles a sudden increase in log volume, an acquisition or an incident that generates many simultaneous cases. Commercial predictability matters during a disruption; the moment of greatest need should not be the first time the business discovers an exclusion.

Centralised, federated and follow-the-sun arrangements describe where and how the work is organised. In-house, managed and hybrid describe who supplies the capability. These are different decisions and can be combined.

A hybrid buying arrangement can use any of these delivery shapes. Specify where evidence is stored and processed, who can access it and how investigations transfer between teams. The arrangement must work with the organisation’s contractual and information-handling requirements.

A provider serving many customers may have valuable experience, but broad visibility does not automatically become useful detection for your business. Ask what relevant knowledge is shared, how customer confidentiality is protected and how improvements reach the rules covering your environment.

Report distributions and severe outliers as well as averages. One long containment delay on an important service can matter more than many quickly closed low-risk alerts. Explain whether metrics cover all relevant cases or only those inside a supplier’s control.

Quality matters alongside speed: accurate escalation, useful evidence, appropriate containment and learning from missed detections. Rewarding closure volume can encourage premature closure; rewarding low alert counts can encourage tuning away the problem.

MITRE ATT&CK can help organise relevant threat behaviours and detection tests. A rule mapped to a technique does not prove coverage of every implementation. Test representative scenarios in your environment and retain the evidence and limits of the result.

• Scope: which systems, identities, hours and data sources are included, and who maintains coverage?
• Authority: what can the provider do immediately, what needs approval, and who is available to approve it?
• Assurance: what do relevant ISO 27001 certificates or SOC 2 reports actually cover, and what exceptions or customer responsibilities remain?
• Evidence: can your organisation obtain logs, case records, detection content and an investigation timeline when required?
• Continuity: what happens if the provider, integration or monitoring platform fails?
• Improvement: how are detections reviewed, changes tested and lessons carried into exercises?

Frameworks and regulation can inform the requirements, but there is no universal rule that every SME must buy a named SOC product. Establish the obligations relevant to the entity and sector, then demonstrate how the operating capability supports them. Do not use a regulatory acronym as a substitute for a service specification.

Detection as code, controlled automation and AI assistance can improve consistency or analyst capacity. They need testing, change control and oversight appropriate to their impact. Agree which actions can run automatically, how they can be stopped and how a mistaken containment action is recovered.

Use a joint exercise to test the arrangement. A plausible event should travel from telemetry through investigation to an authorised action, with a record of the business consequences. Review the missed handoffs and retest the fixes, rather than accepting a demonstration limited to a prearranged alert.