As much as they’d like to be able to, not many enterprises can afford a dedicated, in-house SWAT team of security experts, ready to pounce on and deflect the latest threats to the organization. Most companies are time- and resource-constrained as it is. Others are still feeling the crunch from the ever-worsening skills shortage, a problem that’s made the process of hiring and retaining talented cybersecurity pros a challenge.
The ABCs of MSPs
Enter managed security providers. MSPs, whose expertise is being sought by organizations hard-pressed to protect their critical assets from bad actors, are now more popular than ever.
But does your organization know the first thing about engaging with an MSP? Once deployed, how does your business establish and ensure coordination between the internal security team and the MSP? When it comes to roles and responsibilities, you should aim to address your business’ security gaps without overlap and oversight.
With so many companies rushing to get an effective data protection plan in place—both to comply with rapidly changing data privacy laws and to mitigate the ongoing onslaught of ransomware attacks—here are the ABCs of MSPs; three ways your business can help foster a valuable IT-MSP relationship.
Articulate Security Needs
Identify and understand the critical assets that need protection. This, along with data classification, can often be the cornerstone of any successful information security strategy. As a business, consider what absolutely needs to be protected: Think intellectual property, source code, mission-critical data. As the Cybersecurity & Infrastructure Security Agency (CISA) notes, “critical assets are the organizational resources essential to maintaining operations and achieving the organization’s mission.” If jeopardized, these items would likely have an adverse effect on your business and pose an operational risk.
Critical assets are the organizational resources essential to maintaining operations and achieving the organization’s mission.
Once completed, knowledge of these assets can greatly aid an organization when it comes to getting an insider threat program off the ground, too.
Once those critical assets have been identified, communicate your security requirements and deficiencies—candidly, effectively—to your new managed services team. This is an essential step in establishing a baseline for protection. It also ensures both the internal team and the MSP are aligned on functional expectations.
Build a Rapport
Like any good relationship, the more interaction and engagement your organization has with the MSP, the better the connection will be. Through this communication, your team will also better understand its function, including what the MSP can and cannot do.
Ensuring there’s a good alignment between IT strategy and the business can help your organization run more smoothly, too. By keeping an open dialogue between teams, you can both learn each other’s skill sets and develop a rapport—something that can lead to operational efficiencies in the long run.
Try viewing—and treating—the MSP as an extension of the security team. This can help ensure operational synergies when addressing security incidents. Also, it can uncover areas where the MSP can deliver additional value during periods of downtime—like when conducting threat investigations or researching phishing attempts.
Continue to Communicate and Collaborate
As mentioned earlier, maintaining an open, active dialogue is key to some of the best MSP/IT relationships.
While the client and the MSP are bound by a contractual, service-level agreement (SLA), what starts off as a fairly high-level partnership can grow into a beneficial relationship. No matter what the MSP provides —network, application, infrastructure or security—schedule periodic check-ins, including quarterly business reviews (QBRs), to discuss trends, incidents, policy changes, etc. to ensure all parties are kept in the loop.
These meetings can deliver valuable insight, enabling collaboration between the security team and the MSP to determine areas of improvement. They can also help the security team better communicate the value of the MSP when reporting to the company’s senior executives.
The financial benefits of working with an MSP are well-documented, but having metrics and being able to demonstrate return on investment (ROI) can help further your cause. An MSP can pay dividends over time after it’s become ingrained with your IT department; hopefully, these three tips can help get your organization on the right path toward a successful MSP relationship.
