Managed SOC and MSP: who does what?

In a managed SOC model delivered through an MSP, the MSP runs the client’s IT, holds the contract and remains the client’s point of contact. The SOC monitors continuously, triages alerts, applies first containment actions and supports remediation. The boundary between the two is set from day one, in an escalation procedure.

This article is part of our series on managed SOC. For the general principle, see SOC for MSP: what it is and how it works.

The split of roles

Activity	MSP	Managed SOC
Commercial relationship, contract, billing	Owner	Not involved
Administering endpoints, servers, Microsoft 365	Owner	Not involved
Deploying the EDR and connectors	Owner, with SOC support	Support
24/7 monitoring	Not involved	Owner
Alert triage	Provides context	Owner
First containment actions	Approves where required	Applies authorised actions
Remediation (patching, rebuilding)	Owner	Advises, with the CERT if needed
Communication with the end client	Owner	Provides the facts
Reports	Shares and explains	Produces

What the MSP keeps

The MSP remains in charge of the client’s IT: it holds admin access, knows the history and applies changes. It also remains the only commercial contact. That is Cyna’s model: Cyna works through its partner MSPs, who own the relationship with their clients.

What the SOC brings

The SOC brings what is hard to build inside an MSP:

• 24/7 presence, with analysts on rotation;
• detection skills and knowledge of attacker techniques;
• a platform that centralises events from every client, with strict separation;
• incident response capability, with a CERT for serious cases.

See What is included in a managed SOC?.

The shared zone: containment

This is the point that deserves most attention. When an attack is confirmed, you have to act fast, sometimes at 3am. So decide in advance:

• which actions the SOC applies without waiting (isolating an endpoint, disabling a compromised account);
• which actions need the MSP’s approval (shutting down a production server, blocking a business flow);
• who to call, in which order, depending on severity.

These rules form the escalation procedure. Test it and update it whenever contacts or organisation change. See What happens when a managed SOC detects an attack?.

Getting started: a checklist

1. List the sources to connect for each client.
2. Define authorised actions and escalation thresholds.
3. Record on-call contacts for the MSP and the client.
4. Plan how incidents will be communicated to the client.
5. Schedule a review after a few weeks to tune rules.

And NIS2?

Annex I of NIS2 lists ICT service management among the sectors covered, with size thresholds set by Article 2, so an MSP may fall within scope; this is checked case by case, with legal advice. Article 21 also provides that entities in scope address supply chain security, including their suppliers. A clear, documented split of roles helps both sides. See Does a managed SOC help with NIS2?.

Talk to an expert

Are you an MSP who wants to see how day-to-day collaboration works? Visit our Partner programme page or get in touch.

Frequently asked questions

Who is responsible if an attack is missed?

That is a matter for the contracts: between the client and the MSP, and between the MSP and the SOC. These contracts generally cover the monitored scope, service levels and each party's limits. For a specific liability question, a legal adviser is the right person to ask.

Does the end client see the SOC?

It depends on the model. At Cyna, the client deals only with the MSP; Cyna is named in the offer as the MSP's SOC, and monthly reports can be produced white-labelled.

Does the MSP need security skills?

It needs to apply the SOC's recommendations and carry out remediation on the systems it manages. Analysis and investigation skills come from the SOC and the CERT.

Can the SOC act on systems without going through the MSP?

Only for actions set out in the procedure, such as isolating an endpoint through the EDR or disabling an account. Other interventions go through the MSP, which stays in charge of the IT environment.

What if the MSP cannot be reached at night?

The procedure includes fallback contacts. For serious incidents, the SOC can apply the containment actions authorised in advance in the procedure, then informs the designated contacts.