Cybersecurity buying researchScorecard
Score the evidence for three proposals while keeping mandatory gates in control.
Let evidence set the score.
Let gates set the boundary.
The weights and thresholds are original editorial recommendations for a midmarket MDR or co-managed security purchase. They are not benchmarked provider ratings. No named provider has been scored.
Weight total: 100 /100
| Criterion / evidence | Weight | |||
|---|---|---|---|---|
| Must-pass conditions / a score never overrides these gates | ||||
| Applicable legal and data restrictionsAccountable reviewer accepts the proposed data flows, access and contract terms | ||||
| Safe response authorityWritten permissions and exceptions agreed with business/clinical/plant owners | ||||
| Required technical coverageAll mandatory sources supported with a credible acceptance plan | ||||
| Reachable response and escalationNamed roles, backup contacts and a usable out-of-hours process | ||||
| Responsible commercial agreementRequired scope, material exclusions, charges, access and exit responsibilities are explicit | ||||
| Weighted evaluation / points = weight × rating ÷ 4 | ||||
| 01 · Business and scope fitCompare against the signed buying brief; inspect every mandatory scope row | ||||
| 02 · Telemetry and integration coverageRequest source inventory, ingestion test and missing-data handling | ||||
| 03 · Response authority and overnight operationRun a scenario with an unavailable primary contact | ||||
| 04 · Investigation and detection qualityInspect sanitized cases and a representative validation exercise | ||||
| 05 · Customer workload and service managementReview task matrix, sample review and internal capacity | ||||
| 06 · Incident and recovery hand-offsWalk through an incident-to-restore case with the business owner | ||||
| 07 · Total cost and commercial clarityReconcile quote, terms and workbook; test a buyer-defined growth case | ||||
| 08 · Access, data and assuranceReview permissions, assurance report and data lifecycle | ||||
| 09 · Onboarding and acceptanceInspect plan and require a written acceptance checklist | ||||
| 10 · Exit and continuityWalk through an orderly exit and provider-unavailability scenario | ||||
Provisional total · 10 unknown ratings
Not demonstrated is not a pass. Resolve the gates before recommending award.
Arithmetic band: Material weaknesses or too little evidence · gates override this band
Provisional total · 10 unknown ratings
Not demonstrated is not a pass. Resolve the gates before recommending award.
Arithmetic band: Material weaknesses or too little evidence · gates override this band
Provisional total · 10 unknown ratings
Not demonstrated is not a pass. Resolve the gates before recommending award.
Arithmetic band: Material weaknesses or too little evidence · gates override this band
15 × 3 ÷ 4 = 11.25
A criterion weighted at 15 with a rating of 3 earns 11.25 points. Rating every criterion 3 with the original weights gives 75/100. Neither example represents a supplier result.
A high score is a structured judgment about fit and evidence, not a certification, probability of protection or guarantee of performance. A proposal with 92 and a failed gate cannot outrank a proposal with 82 that meets all mandatory conditions.
Scope and qualifications
Research cutoff: 20 October 2026. Geography: United States unless expressly stated.
Use this scorecard to compare suppliers against the same buying brief. A high score is a structured judgment about fit and evidence, not a certification, probability of protection or guarantee of performance.
The weights and thresholds are original editorial recommendations for a midmarket MDR or co-managed security purchase. They are not benchmarked provider ratings. Adjust them before seeing bids if your procurement has a different purpose, such as a penetration test or vCISO engagement.
The framework draws context from CISA's managed-service customer guidance and NIST's incident-response guidance. No named provider has been scored.
Read the research.
What must pass before a proposal can win?
A gate is pass, fail or unresolved.
How should each criterion be scored?
A contract is not the correct evidence for every fact, and a demo is not the correct evidence for every commitment.
Which criteria carry the most weight?
Weighted points = criterion weight × rating ÷ 4.
What does a completed worksheet look like?
For illustration only, a rating of 3 on a 15-point criterion earns 11.25 points.
What do the totals mean?
A proposal with 92 and a failed gate cannot outrank a proposal with 82 that meets all mandatory conditions.
How should we run the evaluation meeting?
Have the IT owner and one business or procurement reviewer score independently first.
How should total cost enter the decision?
Use a comparable recurring-service scope and show required licenses, setup, consumption, incident work, internal effort, renewal uplift and exit.
How can this be adapted to another security purchase?
For a penetration test, increase emphasis on authorized scope, methodology, manual validation, reporting and retest.
Frequently asked questions
No; the gates are deliberately separate from the weighted total.
Read →Gaps for the next research pass
The weights and thresholds have not been empirically validated against service outcomes. No provider proposals, contracts, demonstrations or assurance…
Read →Buyer search language
MDR vendor scorecard; cybersecurity supplier evaluation criteria; MSSP RFP scoring; managed security service comparison matrix; cybersecurity total cost comparison.
Read →Research quality score
Complete weighted model with 100-point arithmetic, evidence anchors, gates and a worked calculation.
Read →Sources
Sources and publication dates for Scorecard. Undated product and job pages are observations at the research cutoff.
Read →Complete weighted model with 100-point arithmetic, evidence anchors, gates and a worked calculation. It is an editorial procurement aid and deliberately avoids unsupported provider rankings.
Read the scoring context →