What is the difference between an MSP, an MSSP and MDR?

Treat the names as starting points for scope questions. An MSP commonly manages IT operations, an MSSP sells security services, and MDR emphasizes detection, investigation and response; the contract determines what your provider actually does.

CISA's managed-service guidance stresses customer/provider responsibilities and the security consequences of external access. It does not make a service label a guarantee. Read the joint advisory.

Ask every bidder to complete the same action matrix: receive telemetry; validate an alert; investigate related activity; disable a user; isolate a device; preserve evidence; rebuild systems; coordinate communications. Mark each action as included, customer-owned, separately charged or unavailable. Require the same answers outside business hours. “We notify your team” and “we contain a confirmed threat under agreed authority” create different workloads for the buyer.

Also identify subcontractors and the party that actually staffs the service. A reseller relationship may work well, but the escalation path must reach the operating team without a chain of unanswered tickets.