MSSP Contract Checklist 2026: 25 Clauses to Review Before Signing
The most comprehensive MSSP contract evaluation guide available. 25 clauses organized by category with what good looks like, red flags, and negotiation tips. Bookmark this page.
25
Contract clauses covered
6
Categories
25
Negotiation tips
SLA and Performance
MTTD SLA
What Good Looks Like
Under 15 minutes for P1 incidents with financial penalty for misses
Red Flag
No defined MTTD or 'best effort' language
Negotiation Tip
Require quarterly SLA reporting with trend data, not just pass/fail.
MTTC SLA
What Good Looks Like
Under 4 hours for P1 containment with escalation path
Red Flag
MTTC not defined or measured differently than expected
Negotiation Tip
Clarify whether MTTC means 'containment started' or 'containment complete'.
Uptime Guarantee
What Good Looks Like
99.9%+ for monitoring platform with credited downtime
Red Flag
No uptime commitment or maintenance windows excluded from SLA
Negotiation Tip
Ensure maintenance windows are scheduled and communicated 72+ hours in advance.
False Positive Rate
What Good Looks Like
Committed to under 15% false positive rate with tuning included
Red Flag
No false positive target or tuning charged separately
Negotiation Tip
High false positive rates waste your team's time. Include tuning in the base contract.
Scope and Coverage
Coverage Hours
What Good Looks Like
24/7/365 explicitly stated including holidays
Red Flag
24/7 claimed but holidays and weekends have reduced staffing
Negotiation Tip
Ask for holiday coverage evidence. Some MSSPs drop to skeleton crew on holidays.
Asset Scope
What Good Looks Like
Clear enumeration of covered assets with process for adding new ones
Red Flag
Vague scope that leads to coverage gaps or surprise charges
Negotiation Tip
Include a quarterly scope review to catch new assets that need monitoring.
Technology Coverage
What Good Looks Like
Named platforms supported (your SIEM, EDR, cloud providers)
Red Flag
Generic 'we support major platforms' with no specifics
Negotiation Tip
Verify they have certified staff for your specific tech stack.
Escalation Procedures
What Good Looks Like
Named escalation contacts with response time commitments per severity
Red Flag
Generic ticketing system with no named contacts
Negotiation Tip
Test the escalation path during onboarding. Run a simulated P1.
Data Handling
Data Retention
What Good Looks Like
12+ months hot storage, 7+ years cold storage, included in base price
Red Flag
90-day retention with paid extensions or no retention guarantee
Negotiation Tip
Compliance often requires 1-7 years of log retention. Verify this is included.
Data Location
What Good Looks Like
Named data centers, region-locked if required, GDPR/SOC 2 certified
Red Flag
No data location disclosure or right to move data between regions
Negotiation Tip
For regulated industries, require data to stay in your jurisdiction.
Data Portability on Exit
What Good Looks Like
Full data export in standard format (CEF, JSON) included in contract
Red Flag
No export clause or export charged at premium rates
Negotiation Tip
Negotiate data export terms before signing, not during exit.
Data Deletion
What Good Looks Like
Committed deletion within 30 days of contract end with certification
Red Flag
No deletion timeline or 'reasonable efforts' language
Negotiation Tip
Require written confirmation of deletion for compliance evidence.
Incident Response
Containment Authority
What Good Looks Like
Agreed containment actions per severity (isolate host, block IP, disable account)
Red Flag
No containment authority or all actions require your approval
Negotiation Tip
Pre-authorize specific containment actions for P1 to avoid delays at 3 AM.
Breach Support
What Good Looks Like
Breach response hours included (40-80 hours) with clear hourly rate for overages
Red Flag
Breach response entirely at surge rates ($250-$500/hour)
Negotiation Tip
Include at least 40 hours of breach response in the annual contract.
Forensic Capability
What Good Looks Like
Digital forensics capability in-house or through named partner
Red Flag
No forensic capability or unnamed third-party with no SLA
Negotiation Tip
Forensic evidence is time-sensitive. Ensure capability is available within 4 hours.
Communication Plan
What Good Looks Like
Defined communication cadence during incidents (hourly for P1)
Red Flag
Ad-hoc communication with no committed frequency
Negotiation Tip
Include executive briefing commitment for P1 incidents.
Post-Incident Review
What Good Looks Like
Formal PIR within 5 business days for P1/P2 with root cause analysis
Red Flag
No post-incident review process defined
Negotiation Tip
PIRs are critical for continuous improvement. Make them contractual.
Reporting
Report Frequency
What Good Looks Like
Monthly operational, quarterly strategic, annual review
Red Flag
Reports only on request or at irregular intervals
Negotiation Tip
Monthly reports should include MTTD, MTTC, alert volume, and false positive trends.
Executive Reporting
What Good Looks Like
Board-ready executive summary included quarterly
Red Flag
Only technical reports, no executive-level content
Negotiation Tip
CISOs need slides they can present to the board. Include this in the contract.
Custom Reporting
What Good Looks Like
Custom report templates available, aligned to your compliance frameworks
Red Flag
Fixed report format with no customization
Negotiation Tip
Ask to see sample reports before signing. Quality varies enormously between MSSPs.
Commercial Terms
Pricing Model Clarity
What Good Looks Like
All-inclusive pricing with clear overage thresholds and caps
Red Flag
Base price with unlimited uncapped overages
Negotiation Tip
Set a monthly overage cap at 15-20% of base. Any more triggers a contract review.
Contract Length
What Good Looks Like
12-24 months with renewal option, 60-day notice for non-renewal
Red Flag
36+ months with auto-renewal and 90+ day cancellation notice
Negotiation Tip
Shorter initial terms (12 months) reduce risk. Negotiate longer terms for better pricing.
Termination for Cause
What Good Looks Like
Right to terminate for repeated SLA failures with 30-day cure period
Red Flag
No termination for cause or prohibitively expensive exit
Negotiation Tip
Define 'material breach' explicitly: 3+ consecutive months of SLA misses qualifies.
Price Escalation
What Good Looks Like
Fixed for term or capped at CPI + 2%
Red Flag
Unlimited annual price increases or 'market rate adjustment' clause
Negotiation Tip
Lock pricing for the initial term. Cap renewals at CPI + 3% maximum.
Vendor Evaluation Scorecard
Use this weighted scoring template when comparing 3-5 MSSP proposals side by side.
| Category | Weight | Scoring Criteria |
|---|---|---|
| Technical Capability | 30% | Detection accuracy, MTTD/MTTC, technology coverage, threat hunting depth |
| Service Delivery | 25% | Reporting quality, communication, account management, escalation effectiveness |
| Commercial Terms | 20% | Pricing transparency, contract flexibility, exit terms, price escalation controls |
| Experience and References | 15% | Industry experience, client references, analyst ratings, breach response track record |
| Cultural Fit | 10% | Communication style, timezone coverage, responsiveness during evaluation, willingness to customize |
Score each vendor 1-5 per category, multiply by weight, sum for a total score out of 5.
Sample RFP Questions
- Describe your SOC staffing model, including analyst-to-client ratios and tier coverage.
- What is your committed MTTD and MTTC for P1 incidents? Provide SLA with financial penalties.
- What SIEM, SOAR, and EDR platforms do you operate? Are these shared or dedicated per client?
- Describe your onboarding process, timeline, and any one-time fees.
- What data do you retain, where is it stored, and what is your data export process on contract exit?
- Provide three client references in our industry with 12+ months of service history.
- Describe a recent P1 incident you managed. What was the MTTD, MTTC, and outcome?
- What is your pricing model? Provide a total cost estimate including all fees for our scope.
- What containment actions can you take autonomously, and which require our approval?
- How do you handle contract termination? What are the exit fees and data portability terms?
Related Pages
Updated 11 April 2026. Checklist compiled from Gartner guidance, practitioner forums, and MSSP contract reviews.