What questions should you ask a SOC provider before signing?

Before signing with a SOC provider, ask questions on seven areas: monitoring scope, staffing and hours, incident response, integrations with your tools, reporting, data handling and exit terms. Insist on specific, verifiable answers, and make sure they end up in the contract rather than only in the sales presentation.

These questions put into practice the criteria in our guide How to choose a SOC provider. You can send them as they are to every provider you consult, then compare the answers line by line.

1. Scope

• What exactly is monitored? Endpoints, servers, email (Microsoft 365, Google Workspace), firewalls, cloud applications. Ask what is not covered, too.
• Which log sources are collected, and how long are they kept? Retention determines how far back an investigation can go.
• What do you need from us at the start, and how long does onboarding take? See What information should you give a SOC at onboarding?.

2. Staffing

• Are analysts actually on shift at night and at weekends? “24/7” can hide a simple on-call phone line.
• Are analysts employed by the provider, and where do they work? Subcontracting multiplies access to your data. See Why choose a European SOC provider?.
• Who is our day-to-day contact, and who do we call in an emergency?

3. Incident response

This is the most underestimated area. A detected alert protects nothing if nobody acts on it.

• What does the SOC do once an attack is confirmed? Just notify you, or act directly by isolating a device or blocking an account?
• Who handles investigation and remediation, and how quickly? An in-house CERT, a partner, or nobody?
• Is incident response included, or quoted separately in the middle of the crisis? Approving a quote during an attack wastes precious time.
• Will the SOC provide what you need for regulatory reporting? NIS2 (Article 23) sets an early warning within 24 hours and a notification within 72 hours for significant incidents; Article 33 of the GDPR provides for notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

To go further, see How to assess a SOC provider’s incident response.

4. Integrations

• Which EDRs and tools are natively integrated? And what happens if you use something else: a custom connector, a migration, or a refusal?
• Do any existing tools need replacing, and who bears the cost?

5. Reporting and relationship

• What does the monthly report contain, and can we see an example? Activity, incidents handled, vulnerabilities, recommendations.
• Which metrics are tracked? Time to detect, time to respond, number of qualified alerts.
• For MSPs: can reports carry your brand, and will the provider commit not to approach your clients? See Managed SOC and MSP: who does what?.

6. Data and compliance

• Where is the collected data hosted?
• Does the contract govern the processing of personal data? Article 28 of the GDPR provides that processing carried out on behalf of another organisation be governed by a contract. How each party qualifies in your situation is a question for your legal adviser.
• Which certifications or qualifications does the provider hold? ISO 27001, or national schemes such as ANSSI’s PDIS qualification in France. Ask to see the corresponding certificates and documents.

Cyna’s certifications and security documents are available on its Trust Center.

7. Contract and exit

• Which service levels are in the contract, and with what penalties?
• How long is the commitment, and how do we leave?
• What do we get back at the end: logs, configurations, incident history?

How to read the answers

A good answer is specific (a timeframe, a tool name, a location), verifiable (a demo, a sample report, a certificate) and written into the contract. Be wary of vague answers, promises of “total security” and topics pushed to later. Score each provider on the same grid, and give extra weight to incident response and staffing: they are the hardest to change once the contract is signed. See Red flags in a managed SOC offer.

Talk to an expert

Want to test these questions against a real offer? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Should I ask for a demo before signing?

Yes. Ask to see the console, a sample report and the handling of a real, anonymised alert. It is the best way to check what the provider claims.

How many SOC providers should I compare?

Two or three is usually enough, as long as you ask each of them exactly the same questions so the answers can be compared.

What service levels should I require?

They depend on alert severity and should be in the contract. See What SLAs should you require from a managed SOC?.

Should I require a nationally qualified provider?

Only some contexts require it, but frameworks such as France's PDIS qualification make good assessment grids. See Should you require a PDIS-qualified detection provider?.