Frequently asked questions

Can our MSP remain our main supplier?

Yes, if its written scope and delivery evidence meet the responsibilities you need. Use the joint MSP advisory to frame questions about privileged access, shared duties and incident coordination.

Does EDR include people who investigate overnight?

EDR product functionality and a staffed service are separate buying decisions. Compare a published endpoint software offering with the operating scope of a managed detection and response service, then verify your actual contract.

Should every company buy the same compliance package?

No; applicability depends on the entity, data, activities and contractual commitments. Compare the separate coverage descriptions in HHS's Security Rule summary and the FTC Safeguards Rule guide before asking for a tailored scope.

Can we accept a supplier's standard response SLA?

Use it as a starting point and define the event that starts and stops every clock. The broader NIST incident-response framework is a reminder to assess decisions and recovery as well as initial alert handling.

What should we do first if renewal is approaching?

Locate the actual notice clause and assemble one scope-and-responsibility sheet before requesting quotes. That follows the contracting and accountability focus of CISA's MSP customer guidance without assuming that switching suppliers is necessary.