Cyber Security Services Provider: Read the Fine Print

Quick answer: A good cyber security services provider is one whose contract says exactly what they watch, how fast they act, who they call, and what you get back when you leave. Before you sign, check scope, response SLAs, log ownership, CERT-In reporting support, named people, monthly evidence and exit terms. The checklist below covers each one.

Many companies only read their security contract properly on the night something goes wrong. That is when they learn the provider "monitors" alerts but does not isolate machines, that the 15-minute SLA only covers acknowledging a ticket, and that the logs needed for the CERT-In report sit in the provider's tool, not theirs. The money was spent, yet the risk stayed with the business.

This guide is for IT heads, CFOs and department heads in India who are choosing a cyber security services provider or renewing one. It does not rank companies. It gives you the questions and contract clauses that separate real protection from a monthly invoice.

Why Security Contracts Fail When You Need Them

Most failures are not about weak technology. They come from vague words in the agreement. Here are the most common patterns in weak proposals:

• "Monitoring" with no action. The provider watches alerts and emails you. Nobody on their side is allowed to block an IP address, disable a user or isolate a laptop.
• SLAs that measure the wrong thing. A fast "response time" often means a ticket was opened, not that the threat was contained.
• Partial coverage. Servers are covered, but cloud accounts, Microsoft 365, firewalls or branch offices are not, and the gap is never written down.
• Logs you cannot reach. Your logs are stored in the provider's platform. When the contract ends, or when an auditor asks, you have no copy.
• Reports nobody reads. A 60-page monthly PDF full of charts, with no list of open risks and no owner for each.

Each of these has a simple fix, and every fix is a clause or a test you can ask for before signing. The sections below go through them in order.

What a Cyber Security Services Provider Should Actually Deliver

Before comparing vendors, decide which services you are buying. The words "managed security" can mean very different things. A typical scope is built from these blocks:

• Security monitoring: collecting logs from firewalls, servers, endpoints, email and cloud, and watching for threats around the clock or in agreed hours.
• Detection and response: investigating alerts and taking agreed actions to contain an attack.
• Vulnerability management: regular scans, a prioritised list of fixes and re-tests after patching.
• Testing: VAPT of applications and networks, and audits where your regulator or customers require them.
• Advisory and compliance: policies, risk reviews, support for ISO 27001, DPDP Act readiness and sector rules.
• Incident response: forensic support, recovery help and reporting support after a serious incident.

You do not need every block on day one. You do need to know which blocks are in the contract and which are not. If you are still deciding what to buy, our guide on which cyber security services to buy first helps you set priorities.

Compare Proposals Side by Side

Put every proposal into one table. The differences become clear very quickly.

Question	Weak answer	Strong answer
What is covered?	"Your IT environment"	A named list of devices, cloud accounts, sites and log sources, with counts
What does the SLA measure?	Time to acknowledge an alert	Separate times to acknowledge, to start investigation and to contain, by severity
Who can take action?	"We will notify your team"	A written list of actions the provider may take without asking, and those that need approval
Where are logs kept, and for how long?	"In our platform"	Location stated, retention period stated, and your right to export at any time
Help with CERT-In reporting?	Not mentioned	Named support to prepare the report within the required time
Who works on our account?	"Our SOC team"	A named account lead, escalation contacts and backup cover
What do we get each month?	Dashboard access	A short report with incidents, open risks, owners and due dates
What happens when we leave?	Not mentioned	Handover of logs, rules, reports and documents within a fixed number of days

If a proposal has many answers in the middle column, it is not necessarily a bad provider. It means the proposal is not specific enough to hold anyone to account. Ask them to rewrite it.

The Fix: A 9-Point Checklist Before You Sign

Use these steps in order. They work whether you are choosing a new provider or renewing an existing one.

1. List your assets first. Write down the servers, endpoints, firewalls, cloud accounts, email platform, websites and branch sites you want covered, with rough counts, so every provider prices the same scope.
2. Define severity levels together. Agree in writing what counts as critical, high, medium and low, with one example of each from your own business.
3. Ask for three SLA numbers per severity. Get separate commitments for time to acknowledge, time to begin investigation and time to contain or escalate, and ask how each is measured.
4. Write down the allowed actions. Agree which containment actions the provider may take on its own, such as blocking an IP or disabling an account, and which need your approval, and name who approves.
5. Secure your logs. Confirm where logs are stored, how long they are kept, and that you can export them at any time, including at the end of the contract.
6. Plan for CERT-In and DPDP reporting. Make the provider responsible for helping you collect facts and draft the incident report within the time the rules require, and for preserving evidence.
7. Name the people. Ask for the account lead, the escalation chain and the backup arrangements, and the right to request a change if service slips.
8. Fix the monthly evidence. Agree a short monthly report: incidents handled, SLA results, open vulnerabilities, risks with owners and dates, and what changed since last month.
9. Write the exit plan now. Agree a handover period, the list of items you receive (logs, detection rules, reports, documents) and the provider's help during transition.

A provider who is confident in its service will usually accept most of these points. Pushback on logs, named people or exit terms is a signal worth noting.

Indian Compliance Points to Build Into the Contract

Several Indian rules affect what your provider must help you do. These are not legal advice, so confirm details with your adviser, but they should shape the contract.

CERT-In directions of April 2022

CERT-In's directions issued on 28 April 2022 require organisations to report specified cyber incidents to CERT-In within six hours of noticing them, and to keep logs of their ICT systems for a rolling 180 days within Indian jurisdiction. Your provider's log retention and its incident process should support both. Our CERT-In 6-hour reporting checklist explains the steps.

Digital Personal Data Protection Act, 2023

If personal data is involved in a breach, the DPDP Act and the DPDP Rules, 2025 place duties on your organisation to inform the Data Protection Board and affected people. The provider will not carry this duty for you, but it must give you facts quickly enough to meet it.

Sector rules

Banks, NBFCs, insurers, listed companies and government bodies often have extra requirements from RBI, SEBI, IRDAI or their own departments. Share these with the provider at the proposal stage, not after signing.

Red Flags in a Proposal

Watch for these during evaluation. Each one has a simple test.

• Tool-first pitch. The proposal spends pages on a product and little on people and process. Test: ask who will investigate a critical alert at 2 am on a Sunday, and how.
• Unlimited everything. "Unlimited log sources" and "unlimited incidents" at a fixed low price usually means limits appear later. Test: ask for fair-use terms in writing.
• No reference to your setup. A proposal that never mentions your firewall, cloud or email platform was not written for you. Test: ask for a short onboarding plan for your environment.
• No trial or onboarding period. Test: ask for a 30 to 60 day onboarding phase with tuning, and a review at the end.
• Vague certifications. Test: ask which certifications apply to the actual team and service you are buying, and ask for the certificate scope.

If you want to see how vendor evaluation works more broadly, read our guide on how to choose a cyber security company.

In-House, Hybrid or Fully Managed?

Not every organisation should hand everything to a provider. The right model depends on your team and risk.

Model	Works well when	Watch out for
In-house team	You have budget for several trained staff and need deep knowledge of internal systems	Night and holiday cover, hiring and retention
Hybrid	Your IT team handles daily fixes; the provider covers monitoring and specialist response	Clear hand-offs so alerts do not fall between teams
Fully managed	You have a small IT team and need round-the-clock cover quickly	Keeping internal ownership of risk decisions and logs

For many mid-size companies, the hybrid model is a practical middle path. For a closer look at round-the-clock coverage, see managed cyber security services and SOC as a service in India.

Frequently Asked Questions

What does a cyber security services provider do?

It protects your systems and data through services such as monitoring, threat detection, incident response, vulnerability scanning, penetration testing and compliance support. The exact work depends on the scope written in your contract.

How do I check if a provider's SLA is meaningful?

Ask for separate times to acknowledge, investigate and contain, for each severity level, and ask how they are measured and reported. A single "response time" is not enough.

Should the provider keep our logs?

The provider can store them, but the contract should say where, for how long, and give you the right to export them at any time, including when the contract ends.

Can a provider report incidents to CERT-In for us?

The reporting duty stays with your organisation. A good provider helps you gather facts and prepare the report in time, so put that support in the contract.

How long should onboarding take?

It depends on the size of your setup. Many providers need a few weeks to connect log sources and tune alerts. Agree an onboarding plan with a review at the end.

How Affix Center Can Help

Affix Center works with enterprises, SMEs and government departments in Mumbai and Maharashtra on cybersecurity services, from VAPT and monitoring to policy and compliance work. We can also review an existing security contract or proposal with you and point out gaps in scope, SLAs, log access and exit terms, as part of our enterprise advisory work.

If you are choosing or renewing a cyber security services provider, talk to our team for a clear, practical review.