Before you quote “managed security,” agree who does what
Published
A prospect asks whether your monthly service includes security. Before answering with a package name, ask which work they expect someone to perform: approve access, review alerts, install updates, restore data or coordinate an incident. Then ask who can authorize those actions.
For an MSP owner or sales lead, the immediate decision is whether you know enough to quote the work. A price beside “security included” leaves too much room for different expectations. Bring delivery into the conversation and write down the responsibilities that the proposed service would actually cover.
There is a clear basis for doing this. The May 2022 joint cybersecurity advisory, summarized by the NSA, recommends that MSP-customer contracts identify ownership of security roles and responsibilities and reflect the customer's particular security requirements. It does not say that one package fits every customer. NSA, May 11, 2022
Start with the work the customer expects
Take the phrase the customer used and turn it into actions. “Backups” might mean checking whether jobs run, investigating failures, testing restoration or restoring an application after an outage. Ask which of those the customer expects and which systems matter.
Keep this first pass narrow. Choose the services being considered for this proposal rather than attempting a complete security assessment in a sales call. Useful starting subjects are access changes, patching, backup and restoration, alert handling and incident coordination. Add specialist systems only when they are relevant to the opportunity.
For each subject, record the current arrangement separately from the proposed one. “The incumbent handles it” is a question to resolve with the customer, not proof that responsibility will transfer on your preferred start date.
If your team cannot support the required platform, hours or locations, return to the service-fit guide before polishing the proposal.
Put five questions beside each task
Create a simple table with one task per row. Leave answers blank until discussed; mark unresolved items as unknown.
| Field | Question to settle |
|---|---|
| Task and boundary | What action, on which systems, is included? What is outside it? |
| Person doing the work | Does your team, the customer or a named third party perform it? |
| Authority and dependency | Who approves the action, and what access or information is needed? |
| Coverage and escalation | When is it handled, and where does it go outside that coverage? |
| Evidence | What record will show the agreed task was performed or a problem was escalated? |
A row marked “shared” needs another sentence. One party may carry out the work while another approves it. Separate those roles so a delivery technician can tell what to do next.
The NCSC's SME guidance recommends a responsibility matrix, clear service inclusions and exclusions, incident reporting arrangements and defined contract terms. Its customer-facing questions provide a useful prompt for this discussion; they are not a ready-made service promise for your MSP. NCSC, November 24, 2025
Test one uncomfortable situation
Choose a situation that crosses the boundary between your team and the customer. For example: an alert arrives outside the proposed support hours and the recommended action could interrupt a business system.
Ask who receives the alert, who investigates, who can approve disruption and what happens if the customer contact is unavailable. Ask which third party must join if the affected application is outside your support scope. Record the answer or the unresolved dependency.
Use the exercise to uncover a missing decision while the scope can still change. NIST CSF 2.0 includes relevant suppliers in incident planning, response and recovery; it also calls for supply-chain security requirements to be integrated into agreements. The framework leaves organizations to choose how to achieve its outcomes. NIST CSF 2.0, GV.SC-05 and GV.SC-08, February 26, 2024
Work through a proposal row
Illustrative example: a prospect requests “backup included.” During discovery, your team learns that the customer expects restoration of both office files and a specialist business application. The application's vendor handles part of the environment, but its restoration responsibilities have not been confirmed.
Do not answer by changing the row to “all data protected.” Split it into the work your delivery lead can assess and the vendor-dependent work still unresolved. Ask what must be restored, who can provide access, who performs the restoration and how the customer would check that the recovered application is usable.
The next step may be a joint call with the vendor. It may be a narrower proposal covering the systems your team can support. If restoration of the specialist application is essential to the customer's purchase, hold that commitment until the dependency is settled. Confirm the recovery requirements with the customer before promising a recovery time or pricing the work.
Decide whether to quote, change scope or wait
Review the table with delivery before issuing a committed scope and start date.
- Quote the defined work when delivery can support the proposed tasks and coverage, the required approvals are clear and dependencies are understood. Carry those boundaries into the proposal and agreement review.
- Re-scope the offer when the customer needs work outside the proposed service. Explain what would change, who would deliver it and what remains excluded before revising price or timing.
- Wait on the affected commitment when a necessary fact, authority or third-party responsibility remains unknown. Assign a person and next step to resolve it rather than hiding it in a general assumption.
A clearly understood exclusion can be a valid service boundary. An unknown is still unanswered. Check that the customer understands how an excluded task will be handled and that the remaining service makes sense for both sides. Have the people responsible for the agreement reconcile the final wording with the approved operational scope.
For the next proposal, choose one ambiguous promise and complete its row with your delivery lead. Bring the customer colleagues who can answer the open questions; the buying-role guide helps identify them. Use the discovery worksheet to note those people and the next conversation. A finished row should tell both sides what work they are agreeing to—and what still needs a decision.